Search
1098 matching practices
| Number | Best Practice |
|---|---|
| 13-7-8077 | Network Operators, Service Providers should use access control lists (ACLs) to restrict which machines can access the device and/or application if they do not have adequate access control capabilities. This applies to legacy systems. In order to provide granular authentication, a bastion host that logs user activities should be used to centralize access to such devices and applications, where feasible. |
| 13-7-8104 | Network Operators and Service Providers should secure Wireless WAN/LAN networks sufficiently to ensure that a) monitoring of RF signals cannot lead to the obtaining of proprietary network operations information or customer traffic and that b) Network access is credibly authenticated. |
| 13-7-8109 | Network Operators, Service Providers, and Equipment Suppliers should ensure that patching distribution hosts properly sign all patches. Critical systems must only use Operating Systems and applications which employ automated patching mechanisms, rejecting unsigned patches. |
| 13-7-8137 | Equipment Suppliers should support diverse notification methods, such as using both e-mail, websites, and tech support in order to properly notify users of newly discovered (hardware and software) relevant vulnerabilities, viruses, or other threats. |
| 13-7-8526 | Network Operators, Service Providers should if the interior routing has been corrupted, implement policies that filters routes imported into the routing table. The same filtering methods used in NRIC 8045 can be applied more aggressively. The malicious routes will expire from the table, be replaced by legitimate updates, or in emergencies, can be manually deleted from the tables. If needed, the authentication mechanism/crypto keys between IGP neighbors should also be changed. |
| 13-7-8565 | Network Operators, Service Providers and Equipment Suppliers should in the event an authentication system fails, make sure the system being supported by the authentication system is in a state best suited for this failure condition. If the authentication system is supporting physical access, the most appropriate state may be for all doors that lead to outside access be unlocked. If the authentication system supporting electronic access to core routers fails, the most appropriate state may be for all access to core routers be prohibited. |
| 13-8-0590 | Network Operators, Service Providers, and Equipment Suppliers should develop Methods of Procedure (MOP) for core infrastructure hardware and software growth and change activities and periodically review and update as appropriate. |
| 13-8-0807 | Service Providers should establish policies and develop internal controls to ensure that individual users have availability, integrity, and confidentiality and are protected from external threats, insider threats and threats from other customers. These policies should cover protocol and port filtering as well as general security best practices. |
| 13-8-0808 | Network Operators and Service Providers should make information available to customers about traffic filtering (both static and dynamic), where required by law. |
| 13-8-0813 | Service Providers should encourage users to take steps to maintain the availability, integrity and confidentiality of their systems and to protect their systems from unauthorized access. Service Providers should enable customers to get the tools and expertise to secure their systems. |
| 13-8-8000 | Network Operators and Service Providers should establish a process, during design/implementation of any network/service element or management system, to identify potentially vulnerable, network-accessible services (such as Network Time Protocol (NTP), Remote Procedure Calls (RPC), Finger, Rsh-type commands, etc.) and either disable, if unneeded, or provided additional compensating controls, such as proxy servers, firewalls, or router filter lists, if such services are required for a business purpose. |
| 13-8-8003 | Network Operators and Service Providers should minimize single points of failure in the control plane architecture (e.g., Directory Resolution and Authentications services). Critical applications should not be combined on a single host platform. All security and reliability aspects afforded to the User plane (bearer) network should also be applied to the Control plane network architecture. |
| 13-8-8004 | Equipment Suppliers should work closely and regularly with customers to provide recommendations concerning existing default settings and to identify future default settings which may introduce vulnerabilities. Equipment Suppliers should proactively collaborate with network operators to identify and provide recommendations on configurable default parameters and provide guidelines on system deployment and integration such that initial configurations are as secure as allowed by the technology. |
| 13-8-8006 | Network Operators and Service Providers should protect servers supporting externally accessible network applications by preventing the applications from running with high-level privileges and securing interfaces between externally accessible servers and back-office systems through restricted services and mutual authentication. |
| 13-8-8010 | Equipment Suppliers should implement current industry baseline requirements for Operations, Administration, Management, and Provisioning (OAM&P) security in products -- software, network elements, and management systems. |
| 13-8-8020 | Network Operators, Service Providers, and Equipment Suppliers should have special processes and tools in place to quickly patch critical infrastructure systems when important security patches are made available. Such processes should include determination of when expedited patching is appropriate and identifying the organizational authority to proceed with expedited patching. This should include expedited lab testing of the patches and their affect on network and component devices. |
| 13-8-8024 | Network Operators, Service Providers, and Equipment Suppliers should not permit users to log on locally to the Operation Support Systems or network elements. System administrator console logon should require as strong authentication as practical. |
| 13-8-8025 | Network Operators and Service Providers should be isolated from other OAM&P networks, e.g., SCADA networks, such as for power, water, industrial plants, pipelines, etc. · Isolate the SCADA network from the OAM&P network (segmentation) · Put a highly restrictive device, such as a firewall, as a front-end interface on the SCADA network for management access. · Use an encrypted or a trusted path for the OAM&P network to communicate with the SCADA "front-end." |
| 13-8-8031 | Network Operators, Service Providers, and Equipment Providers should develop and communicate Lawfully Authorized Electronic Surveillance (LAES) policy. They should: · Limit the distribution of information about LAES interfaces · Periodically conduct risk assessments of LAES procedures · Audit LAES events for policy compliance · Limit access to those who are authorized for LAES administrative functions or for captured or intercepted LAES content · Promote awareness of all LAES policies among authorized individuals |
| 13-8-8033 | Network Operators, Service Providers, and Equipment Suppliers should adopt internationally accepted standard methodologies, such as ISO 15408 (Common Criteria) or ISO 17799, to develop documented Information Security Programs that include application security development lifecycles that include reviews of specification and requirements designs, code reviews, threat modeling, risk assessments, and training of developers and engineers. |
Download matching Best Practices
Next results