|
|
|
|
|
|
Ministry of Communication
Technologies National Agency for Computer
Security A Tunisian leading strategy in the field of Computer Security From late 1999 the Republic of Tunisia embodied its leading policy in the
field of computer security through the creation of an administrative
organism that presents a unity of management having a purpose to fulfill
the project of computer security development. Thus, during the council of Ministers held on January 31st,
2003, the President of Republic announced the creation of the National
Agency for Computer Security, approving the obligation for periodic
audit in security, launching a corpus of certified information security
experts, and delivering high level trainings for experts in this field.
The creation of the National
Agency for Computer Security: The National Agency for Computer Security is in charge: -
to look after the execution of
the national orientations and the general strategy in information
systems and networks security, -
to follow the execution of
plans and programmes related to the computer security in the public
sector, -
to insure the coordination
between the intervenants in this field, and -
to insure the technological
awakening in the computer security field and to establish norms that are
specific to the computer security and to elaborate technical guides for
this purpose and to procede to their publication .
The National Agency for Computer Security set up the Cert-TCC (Computer
Emergency Response Team – Tunisian Coordination Center) which is an
organization dedicated in providing help and support in information
security. Cert-TCC: Computer Emergency Response Team – Tunisian Coordination
Center: The Cert-TCC plays the same functions as the worldwide known CERTs just
as the Carnegie-Mellon University CERT. The Cert-TCC missions are as follows:
The compulsory and periodic audit in the field of computer security: -
The Risk Assessment operation shall
be carried out by experts, whether natural or legal persons, previously
certified by the National Computer Security Agency. It shall be laid
down by decree the conditions and procedures governing the certification
of such experts. -
The computer systems and networks
coming under various public institutions are subject to a compulsory and
periodic Risk Assessment of their information systems security, with the
exception of computer systems and networks that belong to the Ministry
of National Defense and the Ministry of the Interior and Local
Development. -
Anyone who operates a computer system
or a network, whether a public or a private institution, must
immediately inform the National Computer Security Agency of any attacks,
intrusions and other disruptions liable to hinder the functioning of
another computer system or network so that the Agency can take the
necessary measures to tackle them. The operator shall comply to the
measures decided upon by the National Computer Security Agency in order
to put end to such disruptions. -
The employees of the National Agency
for Computer Security and the Auditors are responsible about the
preservation of the confidentiality of any information they came to know
in the exercise of their functions. It shall be liable to the sanctions
stipulated in Article 254 of the Penal Code anyone who discloses,
participates in, or incites to, the disclosure of such information. -
In the cases mentioned in the
foregoing article, and in order to protect information systems and
networks, the National Computer Security Agency may purpose the
isolation of the concerned computer system or network pending cessation
of the disruptions. The isolation shall be pronounced by the Minister in
charge of Communication Technologies.
This report was compiled for the African Information Security Association (AISA) by Mr. Nabil SAHLI CEO of the National Agency for Computer Security, Tunisia and his deputy, Mr. Naoufel FRIKHA, who are the AISA contact representatives for Tunisia. Join the African Information Security Association (AISA) Read the 2006 Computer Security and Cybercrime in Africa Conference Report Objectives of the African Information Security Association (AISA) More Information Security Resources
|
Subscribe to the FREE IT Career Newsletter with valuable information bringing you practical, how-to tips and articles.
|
