General Security Reference (RGS)

Security by design

Information systems must be designed from the outset to be secure. This means that security should be considered at the design stage, not added as an additional layer.

For example, an information system designed from the ground up to be secure could use strong authentication techniques, such as biometrics or multiple factors, or even encryption techniques to protect sensitive data.

Protection by default

Information systems must be configured by default to be protected. This means that default configurations must be secure, and users must be informed of the risks associated with insecure configurations.

For example, an information system configured by default to be protected could use complex passwords and advanced security protocols.

Strong authentication

User authentication must be strong and based on several factors. This means that authentication should not rely on a single factor, such as a password, but on multiple factors, such as a password, security key or fingerprint.

For example, an information system that uses strong authentication could ask the user to enter a password, present a security key and be identified by facial recognition.

Separation of functions

Sensitive functions must be separated from each other. This means that functions that require privileged access to sensitive data, such as data modification or network access, must be isolated from other functions.

For example, an information system that segregates functions could use separate user accounts for sensitive functions and non-sensitive functions.

Traceability

Actions carried out on information systems must be traced. This means that information systems must be able to record the actions performed by users, the events that occur and the data that is processed.

For example, an information system that records user actions could keep a log of connections, data changes, and network access.

Pseudonymization and encryption

Sensitive data must be pseudonymized or encrypted.

For example, an information system that pseudonymizes or encrypts sensitive data could use hash pseudonymization or block encryption techniques.

Access management

Access to data must be limited to authorized persons.

For example, an information system that limits access to data could use access control lists (ACLs) to control who can access what data.

Data backup

Data should be backed up regularly.

For example, an information system that backs up data regularly could use an automatic backup solution to save data to external media.

Security incident management

Security incidents must be handled appropriately.

For example, an information system that manages security incidents could use an incident management plan to identify, analyze and resolve security incidents.

Protection of personal data

Personal data must be protected against the risks of destruction, loss, alteration, unauthorized, accidental or illicit disclosure or access.

For example, an information system that protects personal data might use pseudonymization or encryption techniques to make the data non-identifiable.

Systems containing personal data must be audited to identify flaws and vulnerabilities that allow malicious people to gain access to the data.