Search

By number By text StandardPublic Safety & Disaster

Categories (match all selected)Network Operators Service Providers Equipment Suppliers Property Managers Public Safety Government Cable Internet/Data Satellite Wireless Wireline Access Control Buildings Business Continuity Contractors & Vendors Corporate Ethics Cyber Security Disaster Recovery Documentation Emergency Preparedness Essential Services Facilities-Transport Fire Guard Services Hardware Human Resources Industry Cooperation Information Protection Liaison Materials Movement Network Design Network Elements Network Interoperability Network Operations Network Provisioning Pandemic Physical Security Management Policy Power Procedures Public Safety Service Security Systems Software Supervision Technical Support Training and Awareness Visitors Encryption Intrusion Detection

1098 matching practices

Number	Best Practice
13-12-8925	Network Operators, Service Providers should ensure that SS7 signaling interface points that connect to the IP Private and Corporate networks interfaces are well hardened and protected with packet filtering firewalls and strong authentication. Similar safeguards should be implemented for e-commerce applications to the SS7 network.
13-12-8926	Service Providers, Public Safety should ensure that signaling interfaces to Legacy Network Gateways and Legacy Selective Router Gateways (in transitional NG9-1-1 architectures) are well-hardened and protected with packet filtering firewalls and strong authentication.
13-12-8927	Network Operators, Service Providers should implement rigorous screening on both internal and interconnecting signaling links.
13-12-8928	Network Operators, Service Providers, Equipment Suppliers, Public Safety and Government should proactively monitor all security issues associated with computing workstations and promptly apply security fixes, as necessary.
13-12-8929	Network Operators, Service Providers and Public Safety should employ authentication, authorization, accountability, integrity, and confidentiality mechanisms (e.g., digital signature and encrypted VPN tunneling), when they employ the Public Internet for signaling, transport, or maintenance communications and any maintenance access to Network Elements.
13-12-8930	Network Operators, Service Providers should employ limited SS7 authentication by enabling logging for SS7 element security related alarms on SCPs and STPs, such as: unauthorized dial up access, unauthorized logins, logging of changes and administrative access logging.
13-12-8931	Public Safety should enable logging for SS7 element security-related alarms on Legacy Network Gateways and Legacy Selective Routing Gateways for transitional NG9-1-1 architectures.
13-12-8932	Network Operators should mitigate limited SS7 authentication by enabling logging for SS7 element security related alarms on SCPs and STPs, such as: unauthorized dial up access, unauthorized logins, logging of changes and administrative access logging.
13-12-8933	Network Operators, Public Safety should establish login and access controls that establish accountability for changes to node translations and configuration.
13-12-8934	Network Operators, Public Safety should when making use of dial-up connections for maintenance access to Network Elements, employ dial-back modems with screening lists. One-time tokens and encrypted payload VPNs should be the minimum.
13-12-8935	Network Operators, Service Providers, Equipment Suppliers and Property Managers should conduct regular review of their alarming thresholds and selection.
13-13-3290	Network Operators, Service Providers should apply caller authentication/verification techniques (e.g., using the SHAKEN framework) to mitigate Caller ID spoofing in general, including on incoming 9-1-1 calls, call backs and administrative emergency lines.
13-13-8118	Network Operators, Service Providers, Public Safety and Government should provide DNS DDoS protection by implementing protection techniques such as: 1) Rate limiting DNS network connections 2) Provide robust DNS capacity in excess of maximum network connection traffic 3) Have traffic anomaly detection and response capability 4) Provide secondary DNS for back-up 5) Deploy Intrusion Prevention System in front of DNS to provide near real time alerts of a cyber-attack to provide near real time alerts of a cyber-attack. 6) Use cloud technologies to enable rapid instantiation of alternate networks and DNS capabilities. This BP applies to Public Safety only in an NG9-1-1 environment.
13-13-8527	Network Operators, Service Providers, Public Safety and Government should prepare a disaster recovery plan to implement upon DNS server compromise. The plan should incorporate procedures to, first flush the DNS cache and, failing that, implement elements that may include but are not limited to: 1) bring-on additional hot or cold spare capacity, 2) bring up a known good DNS server from scratch on different hardware, 3) Reload and reboot machine to a known good DNS server software (from bootable CD or spare hard drive), 4) Reload name resolution records from a trusted back-up. After the DNS is again working, conduct a post-mortem of the attack/response. This applies to Public Safety only in an NG9-1-1 environment.
13-13-8561	Network Operators, Service Providers, Public Safety and Government should when a network element or server is under DoS attacks, evaluate the network and ensure the issue is not related to a configuration/hardware issue,. If it is not a configuration/hardware issue, determine direction of traffic and work with distant end to stop inbound traffic. Consider adding more local capacity (bandwidth or servers) to the attacked service. Where available, deploy DoS/DDoS specific mitigation devices and/or use anti-DoS capabilities in local hardware. Coordinate with HW vendors for guidance on optimal device configuration. Where possible, capture hostile code and make available to organizations such as US-CERT and NCS/NCC for review. This BP applies to Public Safety only in an NG9-1-1 environment.
13-13-8768	Network Operators, Service Providers, Equipment Suppliers, Public Safety and Government should support multi-factor authentication to increase confidence in the identity of an entity.
13-13-8936	Network Operators, Service Providers, Equipment Suppliers, Public Safety and Government should exercise third-party vulnerability testing on a regular basis.
13-13-8937	Public Safety, Government should provide three (3) system back-ups on two (2) different forms of media storage (such as cloud, tape, external drive, flash drive) that can be connected on demand. Further, do not allow any of them to be connected until needed. One of the backups should be stored offsite, and geographically & logically separated from the others. Routine testing should be done to allow the ECC to restore hosts.
13-13-8938	Network Operators, Public Safety and Government should identify deleted logs by searching for instances of log deletion or last-seen log events.
13-13-8939	Network Operators, Public Safety and Government should ensure adequate logging and visibility on ingress and egress points.

Download matching Best Practices

Next results