Search
1098 matching practices
| Number | Best Practice |
|---|---|
| 13-8-8760 | Network Operators and Service Providers should remove the device from the network until remediated if a Voice over IP (VoIP) server has been compromised. |
| 13-8-8761 | Network Operators and Service Providers should attempt to collect data via log files or other means to aid law enforcement investigations if a VoIP masquerading event is occurring. If VoIP device masquerading is causing significant harm, the portion of the network where the attack is originating can be isolated. |
| 13-8-8763 | Network Operators should act swiftly when a password management system or other source of passwords has been compromised, to mitigate the weaknesses that allowed the compromise, restore the compromised system to a secure state, and require all users to change their passwords immediately. Procedures should be in place to notify all affected users that their passwords have been reset or need to be changed immediately. |
| 13-8-8764 | Service Providers should clearly define and enforce policies for identity lifecycle management. This includes processes, procedures and policies for the proofing, enrolling, issuing and revoking of identity information (e.g., identifiers, credentials and attributes) to be used for a specific context (e.g., for specific transactions ranging from commercial to social activities). |
| 13-8-8765 | Service Providers should only issue the identity information (e.g., identifiers, credentials and attributes) associated with an identity after successful identity proofing of the entity. An entity requesting enrollment should be verified and validated according to the requirements of the context (i.e., in which the identity will be used) before enrolling or issuing any associated identifiers, credentials or attributes. The proofing process and policies should be based on the value of the resources (e.g., services, transactions, information and privileges) allowed by the identity and the risks associated with an unauthorized entity obtaining and using the identity. Specifically, measures to ensure the following is recommended: (a) An entity (e.g., person, organization or legal entity) with the claimed attributes exists, and those attributes are suitable to distinguish the entity sufficiently according to the needs of the context. (b) An applicant whose identity is recorded is in fact the entity to which the identity is bound; (c) It is difficult for an entity which has used the recorded identity and credentials to later repudiate the registration/enrolment and dispute an authentication. |
| 13-8-8766 | Service Providers should ensure secure management and maintenance of the identity data and the status of data (e.g., identifiers, credentials, attributes) by logging updates or changes to an identity, provide notifications about the updates or changes to an identity(s) or any of the data associated with the identity(s) to the systems and network elements that needs to be aware of the updates or changes, and by periodically validating the status of an identity. |
| 13-8-8767 | Service Providers should have applicable policies and enforcement for revoking an identity. Specifically, (a) Enforce policies and terminate or destroy the credentials associated (e.g., digital certificates or tokens) with an identity when it is no longer valid or has a security breach. (b) Provide notifications about the revocation or termination of an identity(s) or any of the data associated with the identity to the entity and to the systems and network elements that needs to be aware (i.e., All systems and processes with which the identity can be used for access have to be notified that the identity is no longer valid). |
| 13-8-8769 | Service Providers should protect Personally Identifiable Information by reasonable security safeguards against such risks as loss or unauthorized access, destruction, use, modification or disclosure of data. Policies for PII protection should be clearly identified and enforced. Specifically, (a) Organizations should identify all PII residing in their environment. (b) Organizations should minimize the use, collection, and retention of PII to what is strictly necessary to reduce the likelihood of harm caused by a breach involving PII. Also, an organization should regularly review its holdings of previously collected PII to determine whether the PII is still relevant and necessary for meeting the organization’s business purpose and mission. For example, organizations could have an annual PII purging awareness day. (c) Organizations should categorize their PII based on confidentiality impact levels. For example, PII confidentiality impact level—low, moderate, or high should be used to indicate the potential harm that could result to the subject individuals and/or the organization if PII were inappropriately accessed, used, or disclosed. (d) Organizations should apply the appropriate safeguards for PII based on the PII confidentiality impact level. Specifically, operational safeguards, privacy-specific safeguards, and security controls should be used. (e) Organizations should develop an incident response plan to handle breaches involving PII. The plan should include elements such as determining when and how individuals should be notified, how a breach should be reported. (f) Organizations should establish processes for coordination and addressing issues related to PII when multiple parties are involved (e.g., users, relying parties and identity providers or members of a federation). |
| 13-8-8900 | Service Providers should stay informed about the latest botnet/malware techniques so as to be prepared to detect and prevent them. |
| 13-8-8901 | Service Providers should provide or support third-party tutorial, educational, and self-help resources for their customers to educate them on the importance of and help them practice safe computing. ISPs’ users should know to protect end user devices and networks from unauthorized access through various methods, including, but not limited to: • Use legitimate security software that protects against viruses and spywares; • Ensure that any software downloads or purchases are from a legitimate source; • Use firewalls; • Configure computer to download critical updates to both the operating system and installed applications automatically; • Scan computer regularly for spyware and other potentially unwanted software; • Keep all applications, application plug-ins, and operating system software current and updated and use their security features; • Exercise caution when opening e-mail attachments; • Be careful when downloading programs and viewing Web pages; • Use instant messaging wisely; • Use social networking sites safely; • Use strong passwords; • Never share passwords. |
| 13-8-8902 | Service Providers should make available anti-virus/security software and/or services for its end-users. If the ISP does not provide the software/service directly, it should provide links to other software/services through its safe computing educational resources. |
| 13-8-8903 | Service Providers should protect their DNS servers from DNS spoofing attacks and take steps to ensure that compromised customer systems cannot emit spoofed traffic (and thereby participate in DNS amplification attacks). Defensive measures include: (a) managing DNS traffic consistent with industry accepted procedures; (b) where feasible, limiting access to recursive DNS resolvers to authorized users; (c) blocking spoofed DNS query traffic at the border of their networks, and (d) routinely validating the technical configuration of DNS servers by, for example, utilizing available testing tools that verify proper DNS server technical configuration. |
| 13-8-8904 | Service Providers should use Domain Name System (DNS) Security Extensions (DNSSEC) to protect the DNS. ISPs should consider, at a minimum, the following: • sign and regularly test the validity of their own DNS zones, • routinely validate the DNSSEC signatures of other zones; • employ automated methods to routinely test DNSSEC-signed zones for DNSSEC signature validity. |
| 13-8-8905 | Service Providers should encourage users to submit email via authenticated SMTP on port 587, requiring Transport Layer Security (TLS) or other appropriate methods to protect the username and password. In addition, Service Providers should restrict or otherwise control inbound and outbound connections from the network to port 25 (SMTP) of any other network, either uniformly or on a case by case basis, e.g., to authorized email servers. |
| 13-8-8906 | Service Providers should authenticate all outbound email using DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF). Authentication should be checked on inbound emails; DKIM signatures should be validated and SPF policies verified. |
| 13-8-8907 | Service Providers should configure their gateway mail servers to immediately reject undeliverable email, rather than accepting it and generating non-delivery notices (NDNs) later, in order to avoid sending NDNs to forged addresses. |
| 13-8-8908 | Service Providers should share lists of their dynamic IP addresses with operators of DNS Block Lists (DNSBLs) and other similar tools. Further, such lists should be made generally available, such as via a public website. |
| 13-8-8909 | Service Providers should share lists of their dynamic IP addresses with operators of DNS Block Lists (DNSBLs) and other similar tools. Further, such lists should be made generally available, such as via a public website. |
| 13-8-8910 | Service Providers should make IPv4 dynamic address space under their control easily identifiable by reverse DNS pattern, preferably by a right-anchor string with a suffix pattern chosen so that one may say that all reverse DNS records ending in *.some.text.example.com are those that identify dynamic space. |
| 13-8-8911 | Service Providers should make all dynamic address space under their control easily identifiable by WHOIS or RWHOIS lookup. |
Download matching Best Practices
Next results