Best Practice Detail

13-9-8018

Network Operators, Service Providers and Equipment Suppliers should for OAM&P applications and interfaces, harden the access control capabilities of each network element or system before deployment to the extent possible (typical steps are to remove default accounts, change default passwords, turn on checks for password complexity, turn on password aging, turn on limits on failed password attempts, turn on session inactivity timers, etc.).  A preferred approach is to connect each element or system's access control mechanisms to a robust AAA server (e.g., a RADIUS or TACAS server) with properly hardened access control configuration settings.

Status: Rollover New

References/Comments: http://www.atis.org/ - ATIS-0300276.2008 Operations, Administration, Maintenance, and Provisioning Security Requirements for the Public Telecommunications Network: A Baseline of Security Requirements for the Management Plane: March 2008. Note: This Best practice could impact 9-1-1 operations.

Historical events:

• Network Operators
• Service Providers
• Equipment Suppliers
• Internet/Data
• Cyber Security
• Network Operations
• CSRIC VII: Rollover New In CSRIC VII