+DER.2.3.A3 Isolation of Affected Network Segments (B)

DER.2.3.A3 Isolation of Affected Network Segments (B)

The network segments affected by an APT incident MUST be isolated completely. In particular, these network segments MUST be cut off from the Internet. In order to effectively lock out the attacker and prevent them from covering their tracks or sabotaging other IT systems, the network segments MUST be isolated simultaneously.

The network segments to be isolated MUST be determined in advance through forensic analysis. This MUST identify all the segments affected. If this cannot be guaranteed, all suspicious network segments MUST be isolated along with all those that are only theoretically infected.

To effectively isolate network segments, all local Internet connections (e.g. additional DSL connections in individual sub-networks) MUST be documented as comprehensively as possible and taken into account.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
blocks G 0.14 Interception of Information / Espionage
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.22 Manipulation of Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.32 Misuse of Authorisation
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information