CRA-F Hong Kong Monetary Authority:
Proactive Measures to Boost Your
Organization’s Cybersecurity Position

The Hong Kong Monetary Authority issued the Cybersecurity Fortification Initiative (CFI) in 2016 with aview to raising the cyber resilience of Hong Kong’s banking system. The initiative is underpinned by threepillars, including the Cyber Resilient Assessment Framework (C-RAF). The C-RAF is a risk-based framework for
authorized institutions to assess their own risk profiles and benchmark the level of defence and resilience that would
be required to accord appropriate protection against cyber attacks.
This document maps the capabilities provided by Tufin Orchestration Suite against four of the C-RAF requirements.

Tufin for CRA-F at-a-glance
CRA-F Requirements

Tufin Functions and Features

3.2.1 Changes to firewall rules are reviewed before
becoming effective. CRA-F 3.2.1 requirement

Tufin’s SecureChange automates a change workflow that can include
a “what if” risk assessment that simulates the impact of the proposed
network change and approval of the firewall rule changes. The Tufin
SecureTrack module can automatically generate least-privilege
policies and illuminate the changes necessary for cloud security
groups and cloud firewalls, if using SecureCloud.

3.2.1 The firewall rules are regularly audited orverified on a risk-based approach at least annually.

With SecureTrack Tufin clients have been able to implement dailyrule audits. Tufin’s SecureTrack logs every change on every device or
cloud resource - physical or virtual. Users are able to view all rules
by vendor, device and policy across their entire enterprise – onpremises and cloud. It enables continuous compliance with real-time,
vendor-agnostic alerting for policy violations, and it allows users toquickly identify rules for decommissioning.

3.2.1 The enterprise network is segmented in multiple,
separate trust or security zones with defence-indepth strategies (e.g. logical network segmentation,
hard backups, air-gapping, etc.) to mitigate the risk ofcyber attacks.

SecureTrack delivers vendor-agnostic, end-to-end visibility, andallows users to set and manage accurate segmentation policies
across the hybrid cloud environment. It provides a realtime hybrid
network topology map and segmentation policy orchestration,
irrespective of the network infrastructure or cloud platform.

4.3.2 Automated tools are installed to detect
unauthorised changes to critical system files,
firewalls, IPS, IDS, or other security devices.

Tufin’s SecureTrack makes it possible to manage the entire networklayer, next-generation and IPv6 firewalls, as well as network security
infrastructure - including routers, switches, load balancers and more
— from a central platform. It provides always-on audit logging,
continuously checks rules against policy and delivers real-time
violations alerts with the option to automate workflows for exceptions
handling or remediation proposals.

www.tufin.com

1© Copyright 2022 Tufin. All rights reserved.

CRA-F 3.2.1 requirement Changes to firewall rules are reviewed before becoming effective
Tufin Functionality Supporting CRA-F
Tufin provides end-to-end, fully customisable network change workflows that automate changes across the hybrid environment.
These automated/semi-automated workflows reduce the time it takes to fulfill change requests, because Tufin translates between
zones, tags, and namespaces, and from security group rules to firewall rules, and designs and implements the required accesschanges.
As part of this workflow, Tufin can automate review and risk assessment to ensure continuous compliance. SecureChange carries out
this integrated risk assessment step by vetting the change against an organisation’s security policy, as well as external third-party
data (e.g., vulnerability score, SIEM, SOAR, or endpoint security data) to enforce compliance and prevent regulatory violations andassociated fines.

CRA-F 3.2.1 requirement -Firewall rules are regularly audited or verified on a risk-based approach at least annually
Tufin Functionality Supporting CRA-F
With Tufin’s SecureTrack, organisations can review and recertify rules across their hybrid, multi-cloud environments — with full
topology visibility and always-on audit trail. Using the Tufin dashboard, organisations can perform daily rules reviews against theirunified security policy, because expired and shadowed rules are immediately enumerated in the dashboard, and real-time alerts
are generated as violations occur. Further, SecureTrack provides automated processes for approvals, exceptions handling andproposed remediation.

www.tufin.com

2© Copyright 2022 Tufin. All rights reserved.

Rule Viewer Enumerating Fully Shadowed Rules

CRA-F 3.2.1 requirement -The enterprise network is segmented in multiple, separate trust or security zones with defence-in-depth
strategies (e.g. logical network segmentation, hard backups, air-gapping, etc.) to mitigate the risk of cyberattacks
Tufin Functionality Supporting CRA-F
Tufin allows security teams to confidently build a segmentation strategy with the most comprehensive ecosystem integration, topology
mapping and automation. Tufin can see through the firewall into the cloud, providing automated policy generation, impact assessment
and lifecycle management. This enables clients to set and apply micro-segmentation policies automatically, accelerating the journey toa state of zero-trust maturity.
In the cloud, Tufin monitors traffic, automatically learns the app/workload communication flows, and creates an editable whitelist
policy, using natural high-level language to define segmentation policies and create security “guardrails”. Clients receive real-timealerts when configuration attempts are in violation of policy. The result is proactive protection of your cloud-native resources andworkloads, which are often provisioned and configured using CI/CD processes and tools.
For IP-based segmentation, organisations can use the Tufin Unified Security Policy (USP) matrix to create security policies and control
what traffic is allowed between zones. Additionally, Tufin’s Automatic Policy Generator (APG) can analyze and reduce an enforcement
point’s rule base based on how granular you’d like access to be. Users can either upload logs or have the solution “listen” to network
access use over a period of time in order to provide an optimized rule set.
Finally, the Security Policy Builder, further enables security teams to easily analyze access between segments throughout the network(cloud and on-premises), to create a visual model, and — most importantly — recommend a comprehensive, access-based security
policy based on the analysis of existing access in addition to available compliance-based models (e.g. PCI-DSS, NERC).
All historical decisions regarding access are based on the risk framework of network segmentation, while all network access change
implementations can be implemented, verified, and tracked through Tufin SecureChange.

www.tufin.com

3© Copyright 2022 Tufin. All rights reserved.

CRA-F 4.3.2 requirement -Automated tools are installed to detect unauthorised changes to critical system files, firewalls, IPS, IDS, or
other security devices
Tufin Functionality Supporting CRA-F
The SecureTrack provides an at-a-glance view of the security and compliance violations in the organisation’s on-premises and multicloud environments by device. The Violating Rules report shows all the violations that apply to a specified rule, along with the severity,
the creation date of the violation, the security requirement that causes the violation, and the recommended action to mitigate theviolation where available.
In the cloud, Tufin automatically and continually evaluates DevOps toolchain activity, and alerts when any cloud resource is attempted
to be configured in a manner that violates security policy.

At-a-Glance View of All Violations Across Resources

Unified Security Policy Violation Alerts Manager

www.tufin.com

4© Copyright 2022 Tufin. All rights reserved.

Conclusion
Tufin delivers the most comprehensive, vendor-agnostic security policy management solution available, enabling highly regulatedorganizations to reduce the time and resources required to implement changes and maintain compliance. Network security andcloud teams can implement access changes in minutes instead of days, enable consistent security policy across their complex,
fragmented hybrid and multi-cloud environments, and systematically apply network security policy to existing DevOps processes.
With Tufin’s automation capabilities, organizations can easily design and enforce a Unified Security Policy, proactively monitor
environments for potential security and/or compliance risk, and more easily meet compliance and audit obligations.

Tufin® is the leader in Network Security Policy Orchestration for enterprise cybersecurity. More than half of the top 50 companies in the Forbes Global
2000 turn to Tufin to simplify management of some of the largest, most complex networks in the world, consisting of thousands of firewall and network
devices and emerging hybrid cloud infrastructures. Enterprises select the company’s award-winning Tufin Orchestration Suite™ to increase agility in theface of everchanging business demands while maintaining a robust security posture. The Suite reduces the attack surface and meets the need for greater
visibility into secure and reliable application connectivity. Its network security automation enables enterprises to implement changes in minutes withproactive risk analysis and continuous policy compliance. Tufin serves over 2,000 customers spanning all industries and geographies; its products andtechnologies are patentprotected in the U.S. and other countries. Find out more at www.tufin.com.

www.tufin.com
Copyright © All rights reserved. Tufin, Unified Security Policy, Tufin Orchestration Suite and Tufin logo are trademarks of Tufin. All otherproduct names mentioned herein are trademarks or registered trademarks of their respective owners. You may not copy, reproduce,photograph, translate, transmit ,make available to the public, make derivative works, perform in public, rent , broadcast or make any
commercial use of the publication in full and / or in part without prior written approval.

DP20220712