Search

By number By text StandardPublic Safety & Disaster

Categories (match all selected)Network Operators Service Providers Equipment Suppliers Property Managers Public Safety Government Cable Internet/Data Satellite Wireless Wireline Access Control Buildings Business Continuity Contractors & Vendors Corporate Ethics Cyber Security Disaster Recovery Documentation Emergency Preparedness Essential Services Facilities-Transport Fire Guard Services Hardware Human Resources Industry Cooperation Information Protection Liaison Materials Movement Network Design Network Elements Network Interoperability Network Operations Network Provisioning Pandemic Physical Security Management Policy Power Procedures Public Safety Service Security Systems Software Supervision Technical Support Training and Awareness Visitors Encryption Intrusion Detection

1098 matching practices

Number	Best Practice
13-9-8061	Service Providers, Network Operators, and Public Safety should establish a set of standards and procedures for dealing with computer security events that should be part of the overall business continuity/disaster recovery plan, exercised periodically and revised as needed, and cover likely threats to those elements of the infrastructure which are critical to service delivery/business continuity. See Appendix X and Y of the NRIC VII, Focus Group 2B Report Appendices.
13-9-8064	Service Providers, Network Operators, and Public Safety should generate and collect security-related event data for critical systems (i.e., syslogs, firewall logs, IDS alerts, remote access logs, etc.). Where practical, this data should be transmitted to secure collectors for storage and should be retained in accordance with a data retention policy. A mechanism should be enabled on these systems to ensure accurate timestamps of this data (e.g., Network Time Protocol).
13-9-8065	Network Operators, Service Providers, Equipment Suppliers, and Public Safety should establish a process for releasing information to members of the law enforcement and intelligence communities and identify a single Point of Contact (POC) for coordination/referral activities.
13-9-8068	Network Operators, Service Providers, Equipment Suppliers, and Public Safety should develop and practice a communications plan as part of the broader Incident response plan identifying key players to include as many of the following items as appropriate: contact names, business telephone numbers, home telephone numbers, pager numbers, fax numbers, cell phone numbers, home addresses, internet addresses, permanent bridge numbers, etc. Notification plans should be developed prior to an event/incident happening where necessary. The plan should also include alternate communications channels (e.g., alpha pagers, internet, satellite phones, VOIP, private lines, smart phones) balancing the value of any alternate method against the security and information loss risks introduced.
13-9-8073	Network Operators, Service Providers, and Public Safety should deploy Intrusion Detection/Prevention Tools (IDS/IPS) with an initial policy that reflects the universe of devices and services known to exist on the monitored network. Due to the ever evolving nature of threats, IDS/IPS tools should be tested regularly and tuned to deliver optimum performance and reduce 0 positives.
13-9-8074	Network Operators, Service Providers, and Equipment Suppliers should design equipment to survive significant increases in both packet count and bandwidth utilization. Infrastructure supporting mission critical services should be designed for significant increases in traffic volume and must include network devices capable of filtering and/or rate limiting traffic. Network engineers must understand the capabilities of the devices and how to employ them to maximum effect. Wherever practical, mission critical systems should be deployed in clustered configuration allowing for load balancing of excess traffic and protected by a purpose built DoS/DDoS protection device. Operators of critical infrastructure should deploy DoS survivable hardware and software whenever possible.
13-9-8083	Network Operators, Service Providers, Equipment Suppliers, and Public Safety should protect authentication databases/files from unauthorized access, and they must be backed-up and securely stored in case they need to be restored.
13-9-8086	Network Operators, Service Providers, Equipment Suppliers and Public Safety should should develop capabilities and processes to determine which users require access to a specific device or application based on the principles of least–privilege (the minimum access needed to perform the job) and separation of duties (certain users perform certain tasks).
13-9-8103	Network Operators, Service Providers, and Public Safety should deploy malware protection tools where feasible, establish processes to keep signatures current, and establish procedures for reacting to an infection.
13-9-8121	Network Operators, Service Providers, Equipment Suppliers, and Public Safety should conduct regular audits of their Information Security practices.
13-9-8131	Network Operators, Service Providers and Public Safety should factor into Business Continuity and Recovery Plans, potential Information Security threats of a plausible likelihood or significant business impact.
13-9-8132	Network Operators and Service Providers should leverage the BCP/DR Business Impact Assessment (BIA) efforts as input to prioritizing and planning Information Security Incident Response efforts.
13-9-8134	Service Providers should carefully consider possible impacts on their networks from changes in the configuration or authentication information on devices beyond the service demarcation point, and thus beyond their physical or logical scope of control. Service Providers should consider network filters or network authentication to protect against malicious traffic or theft of service caused by such insecure devices.
13-9-8136	Network Operators, Service Providers, and Public Safety should deploy tools to detect unexpected changes to file systems on Network Elements and Management Infrastructure systems where feasible and establish procedures for reacting to changes. Use techniques such as cryptographic hashes.
13-9-8139	Network Operators, Service Providers, and Public Safety should review and analyze security-related event data produced by critical systems on a regular basis to identify potential security risks and issues. Automated tools and scripts can aid in this analysis process and significantly reduce the level of effort required to perform this review.
13-9-8502	Network Operators, Service Providers, and Public Safety should perform an audit of available network services when a compromise occurs, or new exploits are discovered, to reassess any vulnerability to attack and re-evaluate the business need to provide that service, or explore alternate means of providing the same capability.
13-9-8506	Network Operators, Service Providers, and Public Safety should re-evaluate the architecture for single points of failure following a compromise and reestablishment of lost service. Review the process of evaluating and documenting single points of failure and provide spares for redundancy in the architecture to ensure adequacy of the security architecture.
13-9-8508	Network Operators, Service Providers, and Public Safety should re-evaluate the adequacy of existing security architecture immediately following incident recovery and implement revisions as needed.
13-9-8509	Network Operators, Service Providers should as part of a post-mortem process, review segmentation design to evaluate adequacy of the architecture and data isolation when, through audit or incident, a co-mingling of data or violation of a trust relationship is discovered.
13-9-8510	Network Operators, Service Providers, Equipment Suppliers, and Public Safety should upon an occurrence of compromise or trust violations conduct a forensic analysis to determine the extent of compromise, revoke compromised keys, and establish new crypto keys as soon as possible, and review crypto procedures to re-establish trust.

Download matching Best Practices

Next results