Search
1098 matching practices
| Number | Best Practice |
|---|---|
| 13-9-8522 | Network Operators, Service Providers, and Public Safety should investigate to determine ownership and purpose/use upon discovery of an unsanctioned device on the organizational network. Where possible, this phase should be non-alerting (i.e., log reviews, monitoring of network traffic, review of abuse complaints for suspect IP address) to determine if the use is non-malicious or malicious/suspect. If use is determined to be non-malicious, employ available administrative tools to correct behavior and educate user. Conduct review of policies to determine: If additional staff education regarding acceptable use of network/computing resources is required if processes should be redesigned / additional assets allocated to provide a sanctioned replacement of the capability. Was the user attempting to overcome the absence of a legitimate and necessary service the organization was not currently providing so that s/he could perform their job? If the use is deemed malicious/suspect, coordinate with legal counsel: Based on counsel's advice, consider collecting additional data for the purposes of assessing depending on the scope of the misuse, consider a referral to law enforcement. |
| 13-9-8523 | Network Operators, Service Providers should 1) Turn on logging where appropriate to analyze the logs, 2) Implement the appropriate filter and access list to discard the attack traffic 3) Utilize DoS/DDoS tracking methods to identify the source of attack if the control plane is under attack. |
| 13-9-8553 | Network Operators, Service Providers and Equipment Suppliers should during a security event, release to the National Communications Service National Coordination Center (ncs@ncs.gov) or USCERT (cert@cert.org) information which may be of value in analyzing and responding to the issue, following review, edit and approval commensurate with corporate policy. Information is released to these forums with an understanding redistribution is not permitted. Information which has been approved for public release and could benefit the broader affected community should be disseminated in the more popular security and networking forums such as NANOG and the Security Focus Mailing Lists. |
| 13-9-8554 | Network Operators, Service Providers, and Public Safety should handle and collect information as part of a computer security investigation in accordance with a set of generally accepted evidence-handling procedures insomuch as is possible without disrupting operational recovery. |
| 13-9-8564 | Network Operators, Service Providers, and Public Safety should follow processes similar to those outlined in Appendix X of the NRIC VII, Focus Group 2B Report Appendices after responding to a security incident or service outage to capture lessons learned and prevent future events. |
| 13-9-8629 | Network Operators, Service Providers, Equipment Suppliers, and Public Safety should have processes in place to ensure that all third party software (e.g. operating system) have been properly patched with the latest security patches and that the system works correctly with those patches installed. |
| 13-9-8647 | Service Providers should develop and implement security event logging systems and procedures to allow for collection of security related events. |
| 13-9-8648 | Network Operators and Service Providers should ensure that initial configurations are secure [if they provide or manage Customer Premise Equipment (CPE)]. |
| 13-9-8725 | Network Operators should establish alarming thresholds for various message types to ensure that DoS conditions are recognized. Logs should be maintained and policies established to improve screening and alarming thresholds for differentiating legitimate traffic from DoS attacks. |
| 13-9-8727 | Network Operators, Service Providers, and Public Safety should implement industry guidelines for validating physical diversity, and consider performing signaling link diversification validation on a scheduled basis (e.g., twice a year). |
| 13-9-8729 | Network Operators should establish policies and processes for adding and configuring network elements, that include approval for additions and changes to configuration tables (e.g., screening tables, call tables, trusted hosts, and calling card tables). Verification rules should minimize the possibility of receiving inappropriate messages. |
| 13-9-8748 | Network Operators, Service Providers, Equipment Suppliers, and Public Safety should test new devices to identify unnecessary services, outdated software versions, missing patches, and misconfigurations, and validate compliance with or deviations from an organization’s security policy prior to being placed on a network. |
| 13-9-8755 | Service Providers, Network Operators, Equipment Suppliers, and Public Safety should utilize automated (where possible) Patch Management to quickly deploy patches for known vulnerabilities. PSAP software version control is important for backroom PSAP systems. |
| 13-9-8756 | Network Operators and Public Safety should establish and implement procedures to ensure that all security patches and updates relevant to the device or installed applications are promptly applied. The patching process should be automated whenever possible. The system should be rebooted immediately after patching if required for the patch to take effect. |
| 13-9-8757 | Network Operators, Service Providers, and Public Safety should set policy within each corporation or agency to provide guidance when there is a security breach. |
| 13-9-8759 | Network Operators and Service Providers should remove invalid records whenever it is determined that a network element has been modified without proper authorization, or rollback to the last valid version of record. The attack should be investigated to identify potential security changes. |
| 13-9-8762 | Network Operators and Service Providers should work together to identify, filter, and isolate the originating points of Denial of Service (DoS) attacks when detected, and reroute legitimate traffic in order to restore normal service. |
| 13-9-8772 | Service Providers, Network Operators, Equipment Suppliers and Public Safety should establish a process for releasing information to members of the law enforcement and intelligence communities and identify a single Point of Contact (POC) for coordination/referral activities. |