6.7.2 For the purpose of point 6.7.1., the relevant entities shall: (a) document the architecture of the …

Requirement

For the purpose of point 6.7.1., the relevant entities shall: (a) document the architecture of the network in a comprehensible and up to date manner; (b) determine and apply controls to protect the relevant entities’ internal network domains from unauthorised access; (c) configure controls to prevent accesses and network communication not required for the operation of the relevant entities; (d) determine and apply controls for remote access to network and information systems, including access by service providers; (e) not use systems used for administration of the security policy implementation for other purposes; (f) explicitly forbid or deactivate unneeded connections and services; (g) where appropriate, exclusively allow access to the relevant entities’ network and information systems by devices authorised by those entities;

(h) allow connections of service providers only after an authorisation request and for a set time period, such as the duration of a maintenance operation; (i) establish communication between distinct systems only through trusted channels that are isolated using logical, cryptographic or physical separation from other communication channels and provide assured identification of their end points and protection of the channel data from modification or disclosure; (j) adopt an implementation plan for the full transition towards latest generation network layer communication protocols in a secure, appropriate and gradual way and establish measures to accelerate such transition; (k) adopt an implementation plan for the deployment of internationally agreed and interoperable modern e-mail communications standards to secure e-mail communications to mitigate vulnerabilities linked to e-mail-related threats and establish measures to accelerate such deployment; (l) apply best practices for the security of the DNS and for Internet routing security and routing hygiene of traffic originating from and destined to the network.

Guidance

• Implement secure-by-design principles by integrating security at every layer of network design including the physical, data link, network, transport and application layers.
• Implement secure configurations for wireless networks.
• Where appropriate, consider zero-trust (62) network access.
• Identify the technical measures for the transition to the latest network layer communication protocols (e.g. transition to Internet Protocol version 6).
• Define roles, responsibilities and timelines for the transition to latest-generation network layer communication protocols.
• Approve, log and perform remote maintenance of network and information systems in a manner that prevents unauthorised access.
• Consider the following for email communications (indicative, non-exhaustive list):
  • standards such as Start transport layer security (STARTTLS), DNS-based authentication of named entities (DANE), domain-based message authentication, reporting and& conformance (DMARC), DomainKeys identified mail (DKIM) and sender policy framework (63),
  • internal spam/scam/virus filtering and
  • URL rewriting, URL scanning and URL detonation in a sandbox.
• Consider DNS security good practices (indicative, non-exhaustive list):
  • deploying DNS security extensions (DNS SEC) (64),
  • deploying protective DNS, wherever technically feasible, to provide additional network-wide security capabilities,
  • encrypting DNS traffic, both internal and external, wherever feasible,
  • deploying dedicated DNS servers to reduce attack surface and
  • following all technical guidance on ensuring that DNS deployments and the DNS protocol are as secure and resilient as possible.
• Consider Border Gateway Protocol (BGP) (65) for internet routing.

Examples of evidence

• Up-to-date network diagrams, including OOB connections.
• Firewall(s) configured in accordance with the network traffic rules of the entity’s policies.
• Configuration files and rulesets for firewalls and routers, showing how traffic is filtered and managed.
• Secure configurations for wireless networks for example use of WPA3 (encryption), 802.1X with EAP (authentication), firmware updates.
• Configuration files for switches, including virtual local access network (VLAN) settings and ACLs.
• Documentation of ACLs implemented on network devices to control traffic flow.
• Documented correct usage of mobile devices, including the entity’s connected vehicles that can store data locally on the vehicle and/or share data externally by means of telematics and other remote accesses (e.g. teleworking and OOB connections).
• Evidence of controls over privileged accounts, including logs and policies.
• A list of all devices used (network components), if any, that cannot receive security patches and are not up to date.
• Access logs to confirm that only authorised personnel make changes and conduct reviews of the network security rules.
• Transition to the latest generation plan for implementing network layer communication protocols.

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

Incidencias vinculadas

• ENISA -