Decoding NESA

The Next Frontier in Banking

Mobile App s and the

Associate Security Risks &
Threats

Understanding UAEs Information

Security Standard
Understanding UAEs Information Security Standard PALADION NETWORKS 2

maintaining, and continuously improving Information

Introduction to NESA
Assurance. This life cycle approach ensures continual
The National Electronic Security Authority (NESA) is a improvement of the UAEs Information Assurance
UAE federal authority that operates under the Supreme capabilities based on well-defined activities:
Council for National Security. NESA is responsible for the
UNDERSTANDING an entitys and/or sectors
advancement of the nations cyber security, expanding
information security requirements, identifying the
cyber awareness and creating a collaborative culture
need to establish a clear policy, and meeting the
rooted in information technology and innovation. To
objectives for raising information security;
achieve these tasks, NESA have outlined a set of
standards known as the UAE IA Standards to CONDUCTING risk assessments, identifying

implement information security controls around appropriate risk treatment actions, and selecting the
appropriate controls to manage the risks;
information infrastructures supporting critical national
services.. These standards are a crucial part of the NCSS IMPLEMENTING and operating security controls to
(National Cyber Security Strategy) and are the minimum manage information security risks in the context of
requirements for entities to assimilate into the Sector the entitys or sectors overall business risks;
and National platforms.
MONITORING and reviewing the performance and
It is mandatory for all UAE government entities and effectiveness of the information security processes
other entities identified as critical by NESA to apply its and its controls.
requirements to the usage, processing, storage, and
ENSURING continual improvement based on
transmission of information, both in physical &
objective measurements.
electronic form. Compliance with NESA can help
entities in the following ways: Performing a risk management policy is a key step
towards the implementation of the UAE IA Standard,
Strengthen security of critical information
as it helps entities identify, prioritize, and measure the
infrastructure and reduce corresponding risk levels;
effectiveness of the security controls that are needed
Detect, respond, and recover from significant cyber to treat identified entity-specific risks. Critical entities
security threat incidents and reduce its impact to the implementing this standard will have to refer to the
society and economy of the UAE; National Cyber Risk Management Framework
(NCRMF), which highlights the National Risk
Increase cyber security awareness among its
Management approach and process of Critical
workforce and the capability of the nation;
Information Infrastructure.
Foster collaboration at sector and national level.
The security controls contained in NESA UAE IA
The UAE IA Standards provides management and Standard are developed to treat a typical entity risk
technical information security controls for entities to profile and are grouped in four priority levels based on
establish, implement, maintain, and continuously their relative impact to:
improve information assurance. It promotes a life
cycle approach for establishing, implementing,
Understanding UAEs Information Security Standard PALADION NETWORKS 3

1. Mitigate common threats and begin implementing these Standards with P1 security
controls given their highest relative impact in
2. Build foundational capabilities.
protecting against critical threats and building
foundational Information Assurance capabilities.

Priority Level Number of Controls The overall set of security controls that are Always
Applicable and those security controls that have been
P1 39
determined as being applicable based on the risk
P2 69 assessment are mandatory for the entity to

P3 35 implement, and will be the basis of the compliance

monitoring scheme.
P4 45
The figure below describes the four levels of
monitoring that NESA will use to manage entities

While this common risk profile including the above 188 meeting compliance of the NESA UAE IA Standard:

controls are widely applicable to implementing

entities, NESA recognizes that entity risk profiles do National
Testing Security
differ based on their specific business and operational Intervention
Auditing
context. Therefore, UAE IA Standard requires entities Reporting
considering implementation to identify security
controls based on risk assessment results. An
individual entity may exclude some security controls
on the basis of the risk assessment outcomes,
provided that adequate justification is submitted to
NESA. Reporting:

However, there are 35 mandatory controls out of the NESA will consolidate maturity-based self-
above 188 controls that are referred as Always assessments by stakeholders to generate entity,
Applicable in the standard, as these represents sector and national views. This may be more targeted
requirements for instituting foundational IA for diagnostic analysis of critical entities.
capabilities within an entity. Given their foundational
Auditing
role, the Always Applicable security controls needs
to be implemented by each relevant entity regardless When appropriate, NESA may audit stakeholders by
of its risk assessment outcomes. Prior to performing requesting specific evidence in support of self-
the risk assessment process, an entity should assessment reports.
consider all security controls to be applicable.
Testing
While all the applicable security controls across the
four priority levels are mandatory for critical entities
implementing these Standards, they are required to
Understanding UAEs Information Security Standard PALADION NETWORKS 4

When appropriate, NESA can commission tests of evaluations of information security controls on
information security measures in place at applicable services.
stakeholders.
3) Awareness and Training
National Security Intervention
An awareness and training program shall be
In extreme cases, NESA may directly intervene when implemented to inform entities of risks associated
an entity's activities are consistently leading to with their activities and to ensure that entities are
unacceptable national security risks. adequately trained to carry out their assigned
information security responsibilities.
Determining the correct compliance check for the
organization depends on the amount of security 4) Human Resource Security
threat it poses to the UAE information infrastructure.
Human resources security requirements and security
This depends on the type of security controls currently
responsibilities shall be addressed prior to
employed by the organization, as well as the type of
employment, during employment, and after
sector in which it operates that will inform the extent
termination or change of employment.
to which NESA and the sectors regulator will be
working with the organization. 5) Compliance

Entities shall comply with legal requirements, security

policies, and technical standards.
NESA Security Controls 6) Performance Evaluation and Improvement
NESA recommends 188 security controls structured Entities shall ensure that information security
into 6 management control families and 9 technical performance is measured, analyzed, and evaluated.
control families as described below. There are also 6
The 9 Technical Control Families are explained as the
Management Control Families that are detailed as
following:
follows:
1) Asset Management
1) Strategy and Planning
Assets shall be managed and information shall be
An information security strategy shall be defined and
classified and labeled to ensure that assets, along
an operating model will be developed to adhere to the
with information, receive an appropriate level of
strategy. In addition, information security plans shall
information security.
be developed for each major service to identify and
mitigate the risks corresponding to each service. 2) Physical and Environmental Security

2) Information Security Risk Management Physical and environmental security measures shall
be implemented to ensure critical or sensitive
An information security risk management process
information systems are physically protected from
shall be implemented to conduct risk assessments,
unauthorized access, damage and interference, and all
statements of applicability, security testing, and
Understanding UAEs Information Security Standard PALADION NETWORKS 5

equipments are protected from physical and ensure that a cryptographic control policy is in place
environmental threats. for maintaining security in development and support
processes, as well as to manage technical
3) Operations Management
vulnerabilities.
Operational procedures and responsibilities shall be
8) Information Security Incident Management
developed to ensure an adequate level of information
security is achieved. In addition, backup, media Information security events and weaknesses shall be
handling, e-services security, and monitoring reported and evidence of security incidents shall be
capabilities shall be addressed to ensure protection collected and analyzed to ensure that information
against malicious code and spyware. security events and weaknesses are properly
communicated and security incidents are adequately
4) Communications Security
managed.
Network security and information sharing shall be
9) Information Security Continuity Management
addressed to ensure protection of information in
transit. A business continuity management process shall be
implemented to counteract interruptions to business
5) Access Controls
activities, in addition to protecting critical business
Access control processes shall be developed to control processes from information system failures.
access to information, manage user access, and
Paladion Control Implementation Advisory
control access to internal and external network
services, operating systems, applications, and to apply All of the aforementioned security controls should be
appropriate protection when using mobile computing implemented through adequate planning by
and teleworking services. addressing 5 critical parameters of any management
system:
6) Third Party Security
1. Organizational structure implementation;
Third-party security shall be managed to ensure third
parties implement and maintain the appropriate level 2. Manpower recruitment;
of information security and service delivery. Also, all
3. Information security processes implementation;
information that is stored, processed, and retrieved,
including via cloud services, will be ensure that it is 4. Infrastructure and application implementation;
secure.
5. Awareness and Training requirements.
7) Information Systems Acquisition Development and
Paladion has expertise in enabling organizations to
Maintenance meet NESA compliance standards. We propose a
An information systems acquisition, development, detailed implementation of the NESA UAE IA Standard
and maintenance process shall be implemented to in a phased wise manner as shown below.
prevent unauthorized modification or misuse of
information in applications. This will be carried out to
Understanding UAEs Information Security Standard PALADION NETWORKS 6

Phase 2: Gap & Risk Assessment- This will involve

Critical Services Identification comprehensive benchmarking of existing information
security capabilities of the implementing entities vis-
Gap & Risk Assessment
-vis the 188 controls of NESA UAE IA Standard,
assessing the threats, vulnerabilities, and risks that
Control Development & Implementation can result from the identified gaps, and defining cyber
security controls that can mitigate the identified risks,
Control Effectiveness Check & Audit
along with a detailed NESA implementation roadmap
based upon identified applicable cyber security
controls. The implementation roadmap will consider
the control prioritization as prescribed by NESA.

Phase 1: Critical Service Identification- This will Phase 3: Control Development & Implementation-
involve detailed project planning, high level This will involve comprehensive advisory by Paladion
understanding of the organization by Paladion Subject Subject Matter Expert in development &
Matter Experts, identification of critical business implementation of NESA security controls. This will be
services whose loss in CIA can lead to direct sectoral approached in a sequential manner starting from the
and national level. Finally, mapping the underlying P1 controls. Paladion Subject Matter Experts will first
information infrastructure (in both electronic and assist in the development & implementation of P1, P2,
physical form) to the critical business services is also P3, and P4 security controls in a sequential manner.
included. Implementation support will also include a

Project Planning Assess existing control Prioritize development Assess performance of

Phase 1

Phase 2

Phase 3

Phase 4

gaps vis-a-vis NESA of P1 controls the implemented

High Level Organization
UAE IA Standard controls
Understanding Implement P1 controls
Assess threats and Conduct pre-
Identify Critical Develop P2 Controls
vulnerabilities that can compliance audit
Business Services
exploit the gaps Implement P2 Controls
Assist organization in
Identify information
Identify Cybersecurity Develop P3 Controls meeting compliance to
infrastructures
controls that will reduce Implement P3 Controls NESA requirements
supporting critical
the identified risks during the compliance
national service Develop P4 Controls
audit.
Define a detailed NESA
Implement P4 Controls
Implementation
Roadmap Conduct comprehensive
security awareness
program
Understanding UAEs Information Security Standard PALADION NETWORKS 7

comprehensive security awareness program covering Paladion is privileged to offer consulting services to
all the security controls. help organizations meet compliance regulations and
laws. With over 15 years of experience in the
Phase 4: Control Effectiveness Check & Audit- This
information security industry, we know first-hand the
will involve one full round of performance evaluation
challenges in protecting your information assets.
of the implemented P1, P2, P3, and P4 security
controls, one full round of pre-compliance audit to
check the maturity level of entitys security posture,
and assistance provided to the organization in
meeting compliance to NESA requirements during the
compliance audit.

Furthermore, it provides information security

continuity management, in addition to a 5 step
evaluation and improvement approach, development
of SMART goals, and guidelines on hardware,
software, and employee protection.
Understanding UAEs Information Security Standard PALADION NETWORKS 8

ABOUT PALADION
Paladion Networks is a specialized partner for information risk management providing
end-to-end services and solutions in the US,Europe,Asia and the Middle East. Paladion is
rated and has been recognized and awarded by Gartner, Asian Banker and Red
Herring,amongst others.

For over 15 years, Paladion has been actively managing information risks for over 700
customers. Paladion provides a complete spectrum of information risk management
comprising of security assurance, compliance, governance, monitoring, security analytics
and security management services to large and medium-sized organizations. Paladion is
also actively involved in several information risk management research forums and has
authored many books on the same. With a staff of over 800 dedicated security experts,
Paladion has 6 Security Operations Centers (SOCs) across the world.

Please visit www.paladion.net for more information.

.........................................................................................................................................................................

Head Office: Bangalore: Shilpa Vidya, 49 1st Main, 3rd Phase, JP Nagar, Bangalore- 560078
Phone : +91-80-42543444, Fax : +91-80-41208929

Abu Dhabi: +971-55-9891227, Bangkok: +66 23093650-51, Doha: +974 33559018,

Dubai: +971-4-2595526, Jakarta: +62-8111664399,Kuala Lumpur: +60-3-7660-4988,
London: +44(0)20 7148 7475, Mumbai: +91 022 33655151, Riyadh: +966 ( 0 ) 11 4725163,
Stuttgart:+49-711-7224-9626, Toronto: +-416-273-5004, Virginia: +1-703-8713934,
Muscat: +968 99383575 (Business Associates)
[email protected] | www.paladion.net