2.7.1
Application of Cryptographic Policy
Based on official sourcesISMSISMS-PCheckpoints 2Evidence 4Cases 5
Certification criterion
To protect personal information and key information, the organization shall establish a policy covering encryption targets, cryptographic strength, and cryptographic usage that reflects legal requirements, and shall apply encryption when storing, transmitting, and delivering personal information and key information.
Key checkpoints
- To protect personal information and key information, has the organization established a cryptographic policy that reflects legal requirements and includes encryption targets, cryptographic strength, cryptographic usage, etc.?
- In accordance with the cryptographic policy, is encryption performed when storing, transmitting, and delivering personal information and key information?
Detailed explanation
To protect personal information and key information, the organization shall establish a cryptographic policy that reflects legal requirements and includes encryption targets, cryptographic strength, cryptographic usage, etc..
- Encryption targets : Defined according to legal requirements and the sensitivity and importance of the information being processed
Personal information subject to encryption under the Personal Information Protection Act
| Category | Personal information of data subjects who are not users | Personal information of users | |
|---|---|---|---|
| When transmitted/received via an information and communications network | Information and communications network | Authentication information (passwords, biometric recognition information, etc.) | Authentication information (passwords, biometric recognition information, etc.) |
| When transmitted/received via an information and communications network | Internet network | Personal information ※ However, for those subject to the former Standards for Measures to Ensure the Safety of Personal Information, this takes effect on 2024.9.15 |
Personal information ※ However, for those subject to the former Standards for Measures to Ensure the Safety of Personal Information, this takes effect on 2024.9.15 |
| When stored | Regardless of storage location | Authentication information (passwords, biometric recognition information, etc.) ※ However, passwords shall be one-way encrypted |
Authentication information (passwords, biometric recognition information, etc.) ※ However, passwords shall be one-way encrypted |
| When stored | Regardless of storage location | Resident registration numbers ※ Encrypted pursuant to Article 24-2(2) of the Act |
Resident registration numbers ※ Encrypted pursuant to Article 24-2(2) of the Act |
| When stored | Internet zone, DMZ | Unique identifying information | Resident registration numbers, passport numbers, driver's license numbers, alien registration numbers, credit card numbers, account numbers, biometric recognition information ※ Regardless of storage location |
| When stored | Internal network | Unique identifying information ※ However, when unique identifying information other than resident registration numbers is stored on the internal network, whether and to what extent encryption is applied may be determined and implemented according to the results of a privacy impact assessment or a risk analysis | (same as above) |
| When stored on a personal information handler's computer, mobile device, auxiliary storage media, etc. | Unique identifying information, biometric recognition information | Personal information |
- Encryption algorithm : Select a secure encryption algorithm and security strength taking into account legal requirements and other factors
※ Secure encryption algorithms (examples) (refer to the "Guide to Encryption Measures for Personal Information")
| Category | Algorithm name |
|---|---|
| Symmetric-key encryption algorithms | SEED, ARIA-128/192/256, AES-128/192/256, HIGHT, LEA, etc. |
| Public-key encryption algorithms | RSAES-OAEP, etc. |
| One-way encryption algorithms | SHA-256/384/512, etc. |
In accordance with the cryptographic policy, encryption shall be performed when storing, transmitting, and delivering personal information and key information.
- Select and apply an encryption method taking into account the encryption location, system characteristics, and other factors
※ Encryption methods (examples)
| Category | Encryption method |
|---|---|
| When transmitted/received via an information and communications network | 1. Install an SSL (Secure Socket Layer) certificate on the web server to encrypt the transmitted information for sending and receiving 2. Install an encryption application on the web server to encrypt the transmitted information for sending and receiving 3. Use other encryption technologies : VPN, PGP, etc. |
| When stored in a personal information processing system, etc. | 1. Application-level self-encryption (API method) 2. Database server encryption (Plug-in method) 3. DBMS self-encryption (TDE method) 4. Calling DBMS encryption functions 5. Operating system encryption (file encryption, etc.) 6. Use of other encryption technologies |
| When stored on business computers and mobile devices | 1. Document tool self-encryption (using the password setting function provided by office software, etc.) 2. Encryption using an encryption utility 3. Application of DRM (Digital Rights Management) technology, etc. |
| When stored on auxiliary storage media | 1. Use of secure storage media that provide encryption functions (secure USB, etc.) 2. Encrypting the relevant information before storing it on auxiliary storage media, etc. |
Related laws
- Personal Information Protection Act Article 24-2 (Restrictions on Processing Resident Registration Numbers), Article 29 (Duty of Safety Measures)
- Standards for Measures to Ensure the Safety of Personal Information Article 7 (Encryption of Personal Information)
Evidence (examples)
- Cryptographic control policy (targets, methods, algorithms, etc.)
- Status of encryption application (when storing and transmitting)
- Risk analysis results (when encryption is not applied to unique identifying information other than resident registration numbers on the internal network)
- Management screen of the encryption solution
Nonconformity examples
- Where the internal policy/guidelines do not appropriately specify matters such as encryption targets, cryptographic strength, encryption methods for storage and transmission, and the roles and responsibilities of encryption-related personnel that take into account the legal requirements for cryptographic control
- Where, in establishing the cryptographic policy, the organization misapplies the laws to which it is subject and thus fails to comply with the legal requirements related to encryption (for example, storing a user's account number without applying encryption)
- Where one-way encryption was applied to the passwords of personal information handlers and data subjects, but the insecure MD5 algorithm was used
- Where a personal information controller applied a secure server to an internet shopping mall in accordance with the relevant laws and internal regulations, but encryption measures were omitted in some sections where users' personal information is transmitted, such as member information inquiry and modification, password recovery, and password change
- Where passwords for accessing information systems, authentication key values, etc. are stored in plaintext within system configuration files and source code