EU4Justice, phase II project, funded by the European Union and implemented in Bosnia and Herzegovina, supports the preparation of the introduction of the asset verification system based on the amendments to the HJPC Law, and has been tasked to support the HJPC in enhancing the security and privacy readiness within the HJPC's Assets and Interests Declaration Process (Process).

As per its Work Plan, the Project has conducted a review of existing security audit and risks assessment reports at the HJPC and submitted a preliminary high level assessment report, outlining key findings, recommendations, and areas for deeper investigation.

Based on the above preliminary high level assessment findings, and with support from the Project, the HJPC, with a selected Judicial Institution, has to evaluate and report on the security posture of the process when accessed from external judicial institutions to the HJPC, that are accessing the Process using a secured network. This to be performed by planning and conducting a penetration testing that identify vulnerabilities and deficiency in security measures and controls when access the process from external judicial institutions to the HJPC, and implement the correction measures and controls accordingly.

To support the efficient and good-quality delivery of the above-described activity, the Project decided to assign an international expert, with expertise in cybersecurity and penetration testing, vulnerability assessment, and network and systems security, also in planning, conducting, reporting and debriefing on the findings and the correction measures.

The assignment is expected to apply the following purposes:

·         Assess the external (from selected judicial institutions) /internal security posture of the Process by identifying vulnerabilities in the network, infrastructure, and system components.

·         Perform an external (from selected judicial institutions) and internal penetration test using the industry standards tools and technologies.

·         Identify misconfigurations, security gaps, and weaknesses in firewalls, authentication mechanisms, and encrypted connections in relation to the Process.

·         Assess the Process resilience against unauthorized access, exploitation, and cyber threats.

·         Provide a detailed vulnerability report with risk classifications and recommended corrective measures.

Expected results of the assignment

The results expected to be achieved from accomplishing the pursued assignment are summarized as follows:

·         Enhancing the security and privacy readiness within the Process.

·         Ensuring compliance with the Law on the HJPC and the Book of Rules and Principles regulating the Process security and privacy requirements.

Description of the assignment

Assignment activities:

Under direct supervision of the Activity Leader, the International Short-Term Expert and following the industry best practices, will conduct the following main tasks:

1)      Plan and discuss the assignment with the Project and the HJPC.

2)      Conduct a joint advanced security assessments and penetration testing from selected external judicial Institutions to assess the effectiveness of the existing measures and report on security weaknesses or deficiency including severity scores, and plan correction measures. An Executive summary report should be developed as a non-technical version of findings for management review.

3)      Present and discuss the report, with the Project and the HJPC, and collect their feedback and take them into consideration to provide a revised version of the report.

4)      Draft and submit a report on the activity to the Project.

Assignment deliverables: