Search
1098 matching practices
| Number | Best Practice |
|---|---|
| 13-12-8085 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should ensure certificates have a limited period of validity, dependent upon the risk to the system, and the value of the asset. If there are existing certificates with unlimited validity periods, and it is impractical to replace certificates, consider the addition of passwords that are required to be changed on a periodic basis. This applies to Public Safety only in an NG9-1-1 environment. |
| 13-12-8087 | Network Operators, Service Providers and Public Safety should restrict access to specific time periods for high risk users (e.g., vendors, contractors, etc.) for critical assets (e.g., systems that cannot be accessed outside of specified maintenance windows due to the impact on the business). Assure that all system clocks are synchronized. |
| 13-12-8088 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should charter an independent group (outside of the administrators of the devices) to perform regular audits of access and privileges to systems, networks, and applications. The frequency of these audits should depend on the criticality or sensitivity of the associated assets. |
| 13-12-8089 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should perform a risk assessment of all systems and classify them by the value they have to the company/agency, and the impact to the company/agency if they are compromised or lost. Based on the risk assessment, develop a security policy which recommends and assigns the appropriate controls to protect the system. |
| 13-12-8091 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should evaluate cache expiration and timeouts of security material (such as cryptographic keys and passwords) to minimize exposure in case of compromise. Cached security material should be immediately deleted from the cache when the cached security material expires. |
| 13-12-8097 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should create an enforceable policy clearly defining who can disseminate information, and what controlsshould be in place for the dissemination of such information. The policyshould differentiate according to the sensitivity or criticality of the information. |
| 13-12-8098 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should have policies on changes to and removal of access privileges upon staff members status changes such as terminations, exits, transfers, and those related to discipline or marginal performance. |
| 13-12-8099 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should perform background checks that are consistent with the sensitivity of the position\\\'s responsibilities and that align with HR policy. These checks could include those that verify employment history, education, experience, certification, and criminal history. |
| 13-12-8100 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should establish security training programs and requirements for ensuring security staff knowledge and compliance. This training could include professional certifications in cyber security. |
| 13-12-8101 | Network Operators, Service Providers and Public Safety should ensure that all security operational procedures, system processes, and security controls are documented, and that documentation is up to date and accessible by appropriate staff. Perform gap analysis/audit of security operational procedures as often as security policy requires relative to the asset being protected. Using results of analysis or audit, determine which procedures, processes, or controls need to be updated and documented. |
| 13-12-8102 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should provide adequate security and control regarding the use of Personal Equipment for corporate activities, telecommuting, virtual office, remote administration, etc. |
| 13-12-8108 | Network Operators, Service Providers and Public Safety should determine how the system requiring support of the authentication system responds (i.e., determine what specific effect(s) the failure caused) in the event of an authentication system failure. The system can either be set to open or closed in the event of a failure. This will depend on the needs of the organization. For instance, an authentication system supporting physical access may be required to fail OPEN in the event of a failure so people will not be trapped in the event of an emergency. However, an authentication system that supports electronic access to core routers may be required to fail CLOSED to prevent general access to the routers in the event of authentication system failure. In addition, it is important to have a means of alternate authenticated access to a system in the event of a failure. In the case of core routers failing CLOSED, there should be a secondary means of authentication (e.g., use of a one-time password) reserved for use only in such an event; this password should be protected and only accessible to a small key-contingent of personnel. |
| 13-12-8110 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should ensure news sources are authenticated and cross-verified to ensure accuracy of information, especially when not from a trusted source. Information from news sources may be spoofed, faked, or manipulated by potential attackers. |
| 13-12-8111 | Network Operators, Service Providers and Public Safety should encrypt sensitive data from web servers, and other externally accessible applications, while it is in transit over any networks they do not physically control. This applies to Public Safety only in an NG9-1-1 environment. |
| 13-12-8112 | Network Operators, Service Providers and Public Safety should protect the systems configuration information and management interfaces for Web servers and other externally accessible applications, so that it is not inadvertently made available to 3rd parties. Techniques, at a minimum, should include least privilege for external access, strong authentication, application platform hardening, and system auditing. This applies to Public Safety only in an NG9-1-1 environment. |
| 13-12-8119 | Network Operators, Service Providers and Public Safety should correlate data from various sources, including non-security related sources, (i.e., syslogs, firewall logs, IDS alerts, remote access logs, asset management databases, human resources information, physical access logs, etc.) to identify security risks and issues across the enterprise. This applies to Public Safety only in an NG9-1-1 environment. |
| 13-12-8123 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should handle violations of policy in a manner that is consistent , and, depending on the nature of the violation, sufficient to either deter or prevent a recurrence. There should be mechanisms for ensuring this consistency. |
| 13-12-8124 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should ensure staff is given awareness training on security policies, standards, procedures, and general best practices. Awareness training should also cover the threats to the confidentiality, integrity, and availability of data including social engineering. Training as part of new employee orientation should be supplemented with regular \"refreshers\" to all staff. |
| 13-12-8125 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should ensure that employees formally acknowledge their obligation to comply with their corporate/agency Information Security policies. |
| 13-12-8126 | Network Operators, Service Providers, Equipment Suppliers and Public Safety should employ authentication methods commensurate with the business risk of unauthorized access to the given network, application, or system. For example, these methods would range from single-factor authentication (e.g., passwords) to two-factor authentication (e.g., token and PIN) depending on the estimated criticality or sensitivity of the protected assets. When two-factor authentication generates one-time passwords, the valid time-duration should be determined based on an assessment of risk to the protected asset(s). |
Download matching Best Practices
Next results