Search
1098 matching practices
| Number | Best Practice |
|---|---|
| 13-12-8013 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should authenticate, authorize, attribute, and log all management actions on critical infrastructure elements and management systems. This especially applies to management actions involving security resources such as passwords, encryption keys, access control lists, time-out values, etc. |
| 13-12-8014 | Network Operators, Service Providers and Public Safety should use element and system features that provide \"least-privilege\" for each OAM&P user to accomplish required tasks using role-based access controls where possible. |
| 13-12-8015 | Network Operators, Service Providers and Public Safety should segment administrative domains with devices such as firewalls that have restrictive rules for traffic in both directions and that require authentication for traversal. In particular, segment OAM&P networks from the Network Operator\\\'s or Service Provider\\\'s intranet and the Internet. Treat each domain as hostile to all other domains. Follow industry recommended firewall policies for protecting critical internal assets. This applies to Public Safety only in an NG9-1-1 environment. |
| 13-12-8016 | Network Operators, Service Providers and Public Safety should design and deploy an Operations, Administration, Management, and Provisioning (OAM&P) security architecture based on industry recommendations. |
| 13-12-8017 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should use Operations, Administration, Management and, Provisioning (OAM&P) protocols and their security features according to industry recommendations. Examples of protocols include SNMP, SOAP, XML, and CORBA. This applies to Public Safety only in an NG9-1-1 environment. |
| 13-12-8022 | Network Operators, Service Providers and Public Safety should have a process by which there is a risk assessment and formal approval for all external connections. All such connections should be individually identified and restricted by controls such as strong authentication, firewalls, limited methods of connection, and fine-grained access controls (e.g., granting access to only specified parts of an application). The remote party\\\'s access should be governed by contractual controls that ensure the provider\\\'s right to monitor access, defines appropriate use of the access, and calls for adherence to best practices by the remote party. This applies to Public Safety only in an NG9-1-1 environment. |
| 13-12-8026 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should use an encryption technology in the securing of network equipment and transmission facilities; cryptographic keys must be distributed using a secure protocol that: a) ensures the authenticity of the sender and recipient, b) does not depend upon secure transmission facilities, and c) Cannot be emulated by a non-trusted source. |
| 13-12-8029 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should carefully control and monitor the networked availability of sensitive security information for critical infrastructure by: periodic review of public and internal websites, file storage sites HTTP and FTP sites contents for strategic network information including but not limited to critical site locations, access codes. Documenting sanitizing processes and procedures required before uploading onto public internet or FTP site. Ensuring that all information pertaining to critical infrastructure is restricted to need-to-know and that all transmission of that information is encrypted. Screening, limiting and tracking remote access to internal information resources about critical infrastructure. |
| 13-12-8040 | Network Operators, Service Providers and Public Safety should implement architectural designs to mitigate the fundamental vulnerabilities of many control plane protocols (eBGP, DHCP, SS7, DNS, SIP, etc): 1) Know and validate who you are accepting information from, either by link layer controls or higher layer authentication, if the protocol lacks authentication, 2) Filter to only accept/propagate information that is reasonable/expected from that network element/peer. This applies to Public Safety only in an NG9-1-1 environment. |
| 13-12-8046 | Network Operators, Service Providers and Public Safety should protect against DNS server compromise by implementing protection such as physical security, removing all unnecessary platform services, monitoring industry alert channels for vulnerability exposures, scanning DNS platforms for known vulnerabilities and security breaches, implementing intrusion detection on DNS home segments, not running the name server as root user/minimizing privileges where possible, and blocking the file system from being compromised by protecting the named directory. This applies to Public Safety only in an NG9-1-1 environment. |
| 13-12-8047 | Network Operators, Service Providers and Public Safety should provide DNS DoS protection by implementing protection techniques such as: 1) increase DNS resiliency through redundancy and robust network connections, 2) Have separate name servers for internal and external traffic as well as critical infrastructure, such as OAM&P and signaling/control networks, 3) Where feasible, separate proxy servers from authoritative name servers, 4) Protect DNS information by protecting master name servers with appropriately configured firewall/filtering rules, implement secondary masters for all name resolution, and using Bind ACLs to filter zone transfer requests. This applies to Public Safety only in an NG9-1-1 environment. |
| 13-12-8048 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should mitigate the possibility of DNS cache poisoning by using techniques such as 1) Preventing recursive queries, 2) Configure short (2 day) Time-To-Live for cached data, 3) Periodically refresh or verify DNS name server configuration data and parent pointer records. Service Providers, Network Operators, and Equipment Suppliers should participate in forums to define an operational implementation of DNSSec. This applies to Public Safety only in an NG9-1-1 environment. |
| 13-12-8050 | Network Operators, Service Providers and Public Safety should protect the MPLS router configuration by 1) Securing machines that control login, monitoring, authentication and logging to/from routing and monitoring devices, 2) Monitoring the integrity of customer specific router configuration provisioning, 3) Implementing (e)BGP filtering to protect against labeled-path poisoning from customers/peers. This applies to Public Safety only in an NG9-1-1 environment. |
| 13-12-8067 | Network Operators, Service Providers, Public Safety and Public Safety should develop a set of processes detailing evidence collection and preservation guidelines. Procedures should be approved by management/legal counsel. Those responsible for conducting investigations should test the procedures and be trained according to their content. Organizations unable to develop a forensic computing capability should establish a relationship with a trusted third party that possesses a computer forensics capability. Network Administrators and System Administrators should be trained on basic evidence recognition and preservation and should understand the protocol for requesting forensic services. |
| 13-12-8071 | Network Operators, Service Providers and Public Safety should subscribe to vendor patch/security notifications and services to remain current with new vulnerabilities, viruses, and other security flaws relevant to systems deployed on the network. |
| 13-12-8075 | Network Operators, Service Providers and Public Safety should have procedures for verifying identity of users to IT department and IT personnel to users (secret PINs, callback procedures, etc.). |
| 13-12-8079 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should create an enforceable policy that considers different types of users and requires the use of passwords or stronger authentication methods. Where passwords can be used to enhance needed access controls, ensure they are sufficiently long and complex to defy brute force guessing and deter password cracking. To assure compliance, perform regular audits of passwords on at least a sampling of the systems. |
| 13-12-8080 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should change passwords on a periodic basis implementing a policy which considers different types of users and how often passwords should be changed. Perform regular audits on passwords, including privileged passwords, on system and network devices. If available, activate features across the user base which force password changes. |
| 13-12-8081 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should develop an enforceable password policy, which considers different types of users, requiring users to protect, as applicable, either (a) the passwords they are given/create or (b) their credentials for two-factor authentication. |
| 13-12-8084 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should when using digital certificates, create a valid, trusted PKI infrastructure, using a root certificate from a recognized Certificate Authority or Registration Authority. Assure your devices and applications only accept certificates that were created from a valid PKI infrastructure. Configure your Certificate Authority or Registration Authority to protect it from denial of service attacks. This applies to Public Safety only in an NG9-1-1 environment. |
Download matching Best Practices
Next results