Search

By number By text StandardPublic Safety & Disaster

Categories (match all selected)Network Operators Service Providers Equipment Suppliers Property Managers Public Safety Government Cable Internet/Data Satellite Wireless Wireline Access Control Buildings Business Continuity Contractors & Vendors Corporate Ethics Cyber Security Disaster Recovery Documentation Emergency Preparedness Essential Services Facilities-Transport Fire Guard Services Hardware Human Resources Industry Cooperation Information Protection Liaison Materials Movement Network Design Network Elements Network Interoperability Network Operations Network Provisioning Pandemic Physical Security Management Policy Power Procedures Public Safety Service Security Systems Software Supervision Technical Support Training and Awareness Visitors Encryption Intrusion Detection

1098 matching practices

Number	Best Practice
13-12-8694	Network Operators, Service Providers, Equipment Suppliers and Public Safety should keep their programs flexible. What is considered a security best practice today might be obsolete tomorrow. Changing factors include new technologies, changing business models, emerging threats and growth of the network and the user base.
13-12-8695	Network Operators, Service Providers, Equipment Suppliers and Public Safety should obtain senior management approval and support for a corporate wide People/Awareness/Security Awareness program. This will help to lead to behavior and policy changes.
13-12-8701	Network Operators, Service Providers, Equipment Suppliers and Public Safety should measure the effectiveness of their Security programs.
13-12-8703	Network Operators, Service Providers, Equipment Suppliers and Public Safety should establish and enforce policy to lock up paperwork and magnetic media containing confidential information and destroy it when it is no longer needed.
13-12-8704	Network Operators, Service Providers, Equipment Suppliers and Public Safety should establish and enforce policy to physically secure the computers and network devices.
13-12-8705	Network Operators, Service Providers and Public Safety should have procedures for verifying identity of users to IT department and IT personnel to users (secret PINs, callback procedures, etc.).
13-12-8706	Network Operators, Service Providers and Public Safety should establish and enforce policy to prohibit disclosing passwords, to whom (if anyone) passwords can be disclosed and under what circumstances, procedure to follow if someone requests disclosure of passwords.
13-12-8711	Network Operators, Service Providers and Public Safety should engineer networks to provide redundant and highly available application layer services. (e.g., DNS and other directory services, SIP, H.323). This applies to Public Safety only in an NG9-1-1 environment.
13-12-8712	Network Operators, Service Providers and Public Safety should implement applicable industry standards governing protocol (e.g., IP Protocols from the IETF) and established policies and procedures to maintain currency within these publications to ensure interoperability. This applies to Public Safety only in an NG9-1-1 environment.
13-12-8722	Network Operators, Public Safety should be particularly vigilant with respect to signaling traffic delivered by or carried over Internet Protocol networks. Network Operators that utilize the Public Internet for signaling, transport, or maintenance communications should employ authentication, authorization, accountability, integrity, and confidentiality mechanisms (e.g., digital signature and encrypted VPN tunneling). This applies to Public Safety only in an NG9-1-1 environment.
13-12-8728	Network Operators, Public Safety should consider industry guidelines for logical diversity (e.g. multi-homing), and perform network diversification validation on a scheduled basis (e.g., twice a year). Processes and procedures should exist for tracking discrepancies and maintaining a historical record. This applies to Public Safety only in an NG9-1-1 environment.
13-12-8732	Service Providers, Public Safety should classify identity management services against the service architecture and deployment model being utilized to determine the general “security” posture of the identity services, how it relates to asset’s assurance and security protection requirements, and define the needed security architecture to mitigate security risks. Specifically, if identity related functions are distributed among multiple parties, all parties involved should be clearly identified (e.g., relying parties such as users and service providers, credential providers, verification or authentication providers, or federation members) with clearly defined roles, responsibilities, and accountability for the security of the identity service and all associated assets. This applies to Public Safety only in an NG9-1-1 environment.
13-12-8734	Service Providers, Public Safety should when creating, maintaining, using or disseminating individually identifiable information, take appropriate measures to assure its reliability and should take reasonable precautions to protect it from loss, misuse or alteration. Organizations/Agencies should take reasonable steps to assure that third parties to which they transfer such information are aware of these security practices, and that the third parties also take reasonable precautions to protect any transferred information. This applies to Public Safety only in an NG9-1-1 environment.
13-12-8736	Service Providers, Public Safety should ensure that identity information is only accessible to authorized entities subject to applicable regulation and policy. Specifically, (a) an entity (e.g., relying party or requesting party) requesting identity data should be authenticated, and its authorization to obtain the requested information verified before access to the information is provided or the requesting identity data is exchanged. (b) policy and rules for requesting and exchanging identity data among multiple parties involved (e.g., users, relying party and identity provider) should be clearly defined and enforced.
13-12-8737	Service Providers, Public Safety should analyze each of the steps in the interaction (and any subsequent uses of data obtained from the transactions) of a Security Assertion Markup Language (SAML) transaction to ensure that information that should be kept confidential is actually being kept confidential. This applies to Public Safety only in an NG9-1-1 environment.
13-12-8742	Service Providers, Public Safety should use encryption for data at rest. This applies to Public Safety only in an NG9-1-1 environment.
13-12-8749	Network Operators, Service Providers and Public Safety should have documented processes in place for reviewing new vulnerabilities as they are announced.
13-12-8758	Network Operators, Service Providers and Public Safety should establish policies, and procedures to support early recognition and isolation of potential bad actors to minimize impact to the network. This applies to Public Safety only in an NG9-1-1 environment.
13-12-8770	Service Providers, Public Safety should use secure network protocols such as TLS or IPsec to provide integrity and confidentiality protection of SAML communications. In addition, the following measures should be implemented to counter replay, denial of service and other forms of attacks: (a) Clients should be required to authenticate at some level below the SAML protocol level (for example, using the SOAP over HTTP binding, with HTTP over TLS/SSL, and with a requirement for client-side certificates that have a trusted Certificate Authority at their root) to provide traceability and counter DOS attacks. (b) Use of the XML Signature element [ds:SignatureProperties] containing a timestamp should be required to determine if a signature is recent to counter replay attacks. (c) Maintaining state information concerning active sessions, and validate correspondence. (d) Correlation of request and response messages. This applies to Public Safety only in an NG9-1-1 environment.(a) Clients should be required to authenticate at some level below the SAML protocol level (for example, using the SOAP over HTTP binding, with HTTP over TLS/SSL, and with a requirement for client-side certificates that have a trusted Certificate Authority at their root) to provide traceability and counter DOS attacks. (b) Use of the XML Signature element [ds:SignatureProperties] containing a time stamp should be required to determine if a signature is recent to counter replay attacks. (c) Maintaining state information concerning active sessions, and validate correspondence. (d) Correlation of request and response messages.
13-12-8771	Network Operators, Service Providers and Public Safety should implement media gateway controllers according to appropriate industry standards (i.e. Internet Engineering Task Force (IETF), Alliance for Telecommunications Industry Solutions (ATIS)) in order to achieve interoperability between the IP Multimedia (IM) Core Network (CN) subsystem and Legacy Emergency Services networks.

Download matching Best Practices

Next results