Cybersecurity for Public Sector Fiscal Risk Use Case

Context: Public Sector Digital Transformation

The Fiscal Digitalization Challenge

The Regional Digital Agency leads public administration digital transformation. The fiscal risk use case represents one of the most sensitive projects: processing and analyzing tax data to detect risk and fraud patterns, while simultaneously protecting the privacy of millions of citizens.

Unique Security Requirements

Data to Protect:

• Tax information of 8+ million citizens
• Business and self-employed data
• Cross-references with other administrations
• Risk models (intellectual property)

Regulatory Framework:

• National Security Framework (ENS) High level
• General Data Protection Regulation (GDPR)
• Organic Law on Data Protection (LOPDGDD)
• Specific fiscal regulations
• Law 40/2015 on Public Sector Legal Regime

Security Architecture

Defense-in-Depth Model

┌─────────────────────────────────────────────────────────┐
│                    Perimeter Layer                       │
│         WAF │ DDoS Protection │ Secure CDN             │
├─────────────────────────────────────────────────────────┤
│                    Network Layer                         │
│    Segmentation │ NSGs │ Firewall │ IDS/IPS            │
├─────────────────────────────────────────────────────────┤
│                    Application Layer                     │
│      API Gateway │ AuthN/AuthZ │ Input Validation      │
├─────────────────────────────────────────────────────────┤
│                    Data Layer                            │
│    Encryption │ Tokenization │ Masking │ DLP           │
├─────────────────────────────────────────────────────────┤
│                    Monitoring Layer                      │
│         SIEM │ Audit Logs │ Alerts │ Forensics         │
└─────────────────────────────────────────────────────────┘

Zero Trust for Public Administration

Applied Principles:

1. Never Trust, Always Verify

   • Continuous authentication of users and services
   • Context validation on every request
   • No implicit access by network location

2. Least Privilege Access

   • Granular roles by function
   • Just-in-time access for sensitive operations
   • Automated duties segregation

3. Assume Breach

   • Workload microsegmentation
   • Lateral movement detection
   • Prepared incident response

Results

Security:

• Critical vulnerabilities: 0
• Security incidents: 0 breaches
• Alert response time: < 15 min
• Monitoring coverage: 100%

Compliance:

• ENS High certification: ✓
• GDPR Compliance: Positive audit
• Audit findings: 0 critical
• Action plans: 100% closed

Operation:

• Availability: 99.97%
• Response time: < 200ms p95
• Capacity: 10M transactions/day
• Scalability: Tested at 3x load

This project demonstrated that enterprise-level security can be implemented in the public sector, protecting sensitive data of millions of citizens while enabling the digital transformation necessary for a modern and efficient administration.