Search
1098 matching practices
| Number | Best Practice |
|---|---|
| 13-8-8530 | Network Operators and Service Providers should isolate the source to contain the attack if a DHCP ((Dynamic Host Configuration Protocol) attack is underway. Plan to force all DHCP clients to renew leases in a controlled fashion at planned increments. Re-evaluate architecture to mitigate similar future incidents. |
| 13-8-8531 | Network Operators and Service Providers should 1) restore customer specific routing configuration from a trusted copy, 2) notify customer of potential security breach, 3) Conduct an investigation and forensic analysis to understand the source, impact and possible preventative measures for the security breach if a customer MPLS-enabled trusted VPN (Virtual Private Network) has been compromised by mis-configuration of the router configuration. |
| 13-8-8532 | Network Operators and Service Providers should consider in a severe case, disconnecting the Signal Control Point (SCP), if compromised, to force a traffic reroute, then revert to known good, back-up tape/disk and cold boot. It will depend on the situation and the compromise mechanism. No prescribed standard procedures currently exist for this scenario. |
| 13-8-8533 | Network Operators, Service Providers should if an SS7 Denial of Service (DoS) attack is detected, more aggressively apply the same thresholding and filtering mechanism used to prevent an attack (NRIC BP 8053). The alert/alarm will specify the target of the attack. Isolate, contain, and, if possible, physically disconnect the attacker. If necessary, isolate the targeted network element and disconnect to force a traffic reroute. |
| 13-8-8534 | Network Operators and Service Providers should remove invalid records if logs or alarms determine an SS7 table has been modified without proper authorization, or in the event of a modification, rollback to last valid version of record. Investigate the attack to identify required security changes. |
| 13-8-8535 | Network Operators and Service Providers should disconnect the server if a Voice over IP (VoIP) server has been compromised; the machine can be rebooted and reinitialized. Redundant servers can take over the network load and additional servers can be brought on-line if necessary. In the case of VoIP device masquerading, if the attack is causing limited harm, logging can be turned on and used for tracking down the offending device. Law enforcement can then be involved as appropriate. If VoIP device masquerading is causing significant harm, the portion of the network where the attack is originating can be isolated. Logging can then be used for tracking the offending device. |
| 13-8-8537 | Network Operators, Service Providers should if anonymous use or theft of service is discovered, 1) disable service for attacker, 2) Involve law enforcement as appropriate, since anonymous use is often a platform for crime. If possible, triangulate client to identify and disable. If the wireless client was cloned, remove the ESN (Electronic Serial Number) to disable user thus forcing support contact with service provider. |
| 13-8-8539 | Network Operators and Service Provider and should if the attack is IP based, reconfigure the Gateway General Packet Radio Service Support Node (GGSN) to temporarily drop all connection requests from the source. Another approach is to enforce priority tagging. Triangulate the source(s) to identify and disable. (It is easier to recover from a cellular network denial of service attack if the network is engineered with redundancy and spare capacity). |
| 13-8-8549 | Network Operators and Service Providers should bring together an ad-hoc team to address the current incident when a Business Recovery Plan (BRP) does not exist. The team should have technical, operations, legal, and public relations representation. Team should be sponsored by senior management and have a direct communication path back to management sponsor. If situation exceeds internal capabilities consider contracting response/recovery options to 3rd party security provider. |
| 13-8-8551 | Network Operators and Service Providers should follow processes similar to Appendix Y of the NRIC VII, Focus Group 2B Report Appendices when responding to a new or unrecognized event. |
| 13-8-8555 | Network Operators, Service Providers and Equipment Suppliers should if an incident occurs and a communications plan is not in place and depending on availability of resources and severity of the incident, assemble a team as appropriate: · In person · Conference Bridge · Other (Email, telephonic notification lists) Involve appropriate organizational divisions (business and technical) · Notify Legal and PR for all but the most basic of events · PR should be involved in all significant events · Develop corporate message(s) for all significant events – disseminate as appropriate If not already established, create contact and escalation procedures for all significant events. |
| 13-8-8556 | Network Operators and Service Providers should refer all communications intercept requests to corporate counsel in the absence of a monitoring request policy. |
| 13-8-8557 | Network Operators and Service Providers should if an abuse incident occurs without reporting contacts in place: 1) Ensure that the public-facing support staff is knowledgeable of how both to report incidents internally and to respond to outside inquiries. 2) Ensure public facing support staff (i.e., call/response center staff) understands the security referral and escalation procedures. 3) Disseminate security contacts to industry groups/coordination bodies where appropriate. 4) Create e-mail IDs per rfc2142 and disseminate. |
| 13-8-8559 | Network Operators and Service Providers should upload current IDS/IPS signatures from vendors and re-verify stored data with the updated signatures in the event of a security threat. Evaluate platform's ability to deliver service in the face of evolving threats and consider upgrade/replacement as appropriate. Review Incident Response Post-Mortem Checklist (NRIC BP 8564). |
| 13-8-8562 | Network Operators and Service Providers should isolate the box and check integrity of infrastructure and agent if an infected (zombie) device is detected. Adjust firewall settings, patch all systems and restart equipment. Consider making system or hostile code available for analysis to 3rd party such as US-CERT, NCC, or upstream provider's security team if hostile code does not appear to be known to the security community. Review Incident Response Post-Mortem Checklist (NRIC BP 8548). |
| 13-8-8563 | Equipment Suppliers should work with clients when a denial of service vulnerability or exploit is discovered to ensure devices are optimally configured. Where possible, analyze hostile traffic for product improvement or mitigation/response options, disseminate results of analysis. |
| 13-8-8566 | Network Operators, Service Providers, and Equipment Suppliers should assure that patching distribution hosts properly sign all patches. Critical systems must only use OSs and applications which employ automated patching mechanisms, rejecting unsigned patches. If a patch fails or is considered bad, restore OS and applications from known good backup media. |
| 13-8-8600 | Network Operators and Service Providers should implement policies and practices that prohibit ad-hoc wireless networks. An ad-hoc wireless network is a peer-to-peer style network connecting multiple computers with no core infrastructure. They are not considered secure and are commonly associated with malicious activity. |
| 13-8-8601 | Network Operators and Service Providers should establish policies to ensure only authorized wireless devices approved by the network managing body or network security are allowed on the network. Unauthorized devices should be strictly forbidden. |
| 13-8-8602 | Network Operators and Service Providers should implement applicable industry standards for wireless authentication, authorization, and encryption (e.g. WPA2 should be considered a minimum over WEP which is no longer considered secure). |
Download matching Best Practices
Next results