Search

By number By text StandardPublic Safety & Disaster

Categories (match all selected)Network Operators Service Providers Equipment Suppliers Property Managers Public Safety Government Cable Internet/Data Satellite Wireless Wireline Access Control Buildings Business Continuity Contractors & Vendors Corporate Ethics Cyber Security Disaster Recovery Documentation Emergency Preparedness Essential Services Facilities-Transport Fire Guard Services Hardware Human Resources Industry Cooperation Information Protection Liaison Materials Movement Network Design Network Elements Network Interoperability Network Operations Network Provisioning Pandemic Physical Security Management Policy Power Procedures Public Safety Service Security Systems Software Supervision Technical Support Training and Awareness Visitors Encryption Intrusion Detection

1098 matching practices

Number	Best Practice
13-12-8127	Network Operators, Service Providers, Equipment Suppliers and Public Safety should validate any regular auditing activity through spot-checking to validate the competency, thoroughness, and credibility of those regular audits.
13-12-8128	Network Operators, Service Providers, Equipment Suppliers and Public Safety should promptly verify and address audit findings assigning an urgency and priority commensurate with their implied risk to the business. The findings as well as regular updates to those findings should be reported to management responsible for the affected area.
13-12-8129	Network Operators, Service Providers and Public Safety should ensure that technical staff participate in ongoing training and remain up-to-date on their certifications for those technologies to remain current with the various security controls employed by different technologies.
13-12-8138	Network Operators, Service Providers, Equipment Suppliers and Public Safety should establish a procedure to track the expiration date for digital certificates used in services and critical applications, and start the process to renew such certificates in sufficient time to prevent disruption of service. This applies to Public Safety only in an NG9-1-1 environment.
13-12-8500	Network Operators, Service Providers, Equipment Suppliers and Public Safety should in the event the key in a digital certificate becomes compromised, should immediately revoke the certificate, and issue a new one to the users and/or devices requiring it. Perform Forensics and Post-mortem, as prescribed in NRIC BP 8061, to review for additional compromise as soon as business processes allow. This applies to Public Safety only in an NG9-1-1 environment.
13-12-8501	Network Operators, Service Providers, Equipment Suppliers and Public Safety should secure a new root key, and rebuild the PKI (Public Key Infrastructure) trust model, in the event the root key in a digital certificate becomes compromised. Perform Forensics and Post-mortem, as prescribed in NRIC BP 8061, to review for additional compromise as soon as business processes allow. This applies to Public Safety only in an NG9-1-1 environment.
13-12-8503	Network Operators, Service Providers and Public Safety should when improper use of keys or encryption algorithms is discovered, or a breach has occurred, conduct a forensic analysis to assess the possibility of having potentially compromised data and identify what may have been compromised and for how long it has been in a compromised state; implement new key (and revoke old key if applicable), or encryption algorithm, and ensure they are standards-based and implemented in accordance with prescribed procedures of that standard, where possible. When using wireless systems, ensure vulnerabilities are mitigated with proper and current security measures. This applies to Public Safety only in an NG9-1-1 environment.
13-12-8517	Network Operators, Service Providers, Equipment Suppliers and Public Safety should review audit trails if information has been leaked or the release policy has not been followed. Change passwords, review permissions, and perform forensics as needed. Inform others at potential risk for similar exposure, and include security responsibilities in performance improvement programs that may include security awareness refresher training.
13-12-8521	Network Operators, Service Providers and Public Safety should terminate the VPN (Virtual Private Network) connection and issue a warning in accordance with the employee code of conduct, in the event of misuse or unauthorized use in a remote access situation. If repeated, revoke employee VPN remote access privileges.
13-12-8528	Network Operators, Service Providers and Public Safety should consider one or more of the following steps if the DNS server is under attack, 1) Implement reactive filtering to discard identified attack traffic, if possible, 2) Rate-limiting traffic to the DNS server complex, 3) Deploy suitable Intrusion Prevention System in front of DNS servers, 4) Deploy additional DNS server capacity in a round-robin architecture, 5) Utilize DoS/DDoS tracking methods to identify the source(s) of the attack, or 6) Move name resolution service to a 3rd party provider. This applies to Public Safety only in an NG9-1-1 environment.
13-12-8540	Network Operators, Service Providers and Public Safety should consider terminating all current remote access, limiting access to the system console, or other tightened security access methods, when an unauthorized remote access to an OAM&P system occurs. Continue recovery by re-establishing new passwords, reloading software, running change detection software, or other methods, continuing quarantine until recovery is validated, as practical.
13-12-8567	Network Operators, Service Providers, Equipment Suppliers and Public Safety should ensure that actions taken due to a spoofed, faked or distorted news item should be cross-correlated against other sources. Any actions taken should be \\\'backed out\\\' and corrective measures taken to restore the previous state. News source authentication methods should be implemented to ensure future accuracy.
13-12-8633	Network Operators, Service Providers, Equipment Suppliers and Public Safety should design passwords used for an application login to be consistent with applicable industry security guidelines and policies. Whether between the client and the server or among servers, passwords must not be transmitted “in the clear.” SSL should be used for any transaction involving authentication. The transmission of session IDs should be similarly protected with SSL.
13-12-8642	Network Operators, Service Providers and Public Safety should consider integration of open standardized protocols to meet communication-level performance and security goals.
13-12-8652	Network Operators, Service Providers and Public Safety should implement access controls (firewalls, access control lists, etc.) to administrative interfaces as well as those normally carrying customer traffic.
13-12-8653	Network Operators, Service Providers and Public Safety should test current equipment for IPv4/IPv6 compatibility for the specific network deployment. This applies to Public Safety only in an NG9-1-1 environment.
13-12-8670	Network Operators, Service Providers, Equipment Suppliers and Public Safety should consider establishing information exchange policies and procedures, establish information and software exchange agreements, safeguard transportation of physical media.
13-12-8671	Network Operators, Service Providers and Public Safety should have policies and enforce that unattended workstations should be protected from unauthorized access 1) Individual Username/Password authentication must be required to access resources. 2) Physical access must be restricted to workstations. 3) Where possible idle workstations must default to password protected screensaver after an established time lapse (e.g. 15 minutes).
13-12-8691	Network Operators, Service Providers, Equipment Suppliers and Public Safety should develop or adopt employee education programs that emphasize the need to comply with security policies.
13-12-8693	Network Operators, Service Providers, Equipment Suppliers and Public Safety should create a security awareness strategy that includes communicating to everyone from new hires to human resources to senior management. Utilize multiple channels and target each audience specifically.

Download matching Best Practices

Next results