NET.1.2 Network Management

Network management infrastructure MUST be planned appropriately. This SHOULD address all the items listed in the respective security policy and requirements specification for network management. The following aspects MUST be considered at minimum:

• the network management areas to be separated
• possible ways to access the management servers at hand
• communication for management access
• the protocols used (e.g. IPv4 and IPv6)
• requirements that management tools must fulfil
• interfaces for forwarding collected event or alarm messages
• logging (including the required interfaces to a centralised logging solution)
• reporting and interfaces to overarching solutions
• corresponding requirements to be fulfilled by the network components to be integrated

Based on NET.1.2.A1 Network Management Planning, requirements for the network management infrastructure and processes in question MUST be specified. In so doing, all the essential elements of network management MUST be taken into account. The network management policy at hand SHOULD also be considered.

In terms of network management backups, the system data for integrating the components or objects to be managed, event messages, statistical data, and stored data for configuration management MUST be backed up at minimum.

The following events MUST be logged at minimum:

• unauthorised access or access attempts
• performance or availability fluctuations of the network in question
• errors in automatic processes (e.g. during configuration distribution)
• restricted accessibility of network components

All network management components, including the integrated network components, MUST be synchronised. The time SHOULD be synchronised by means of the NTP service at every location within the local network in question. If a separate management network has been established, an NTP instance SHOULD be positioned within it.

Whenever network management communication takes place via production infrastructure, secure protocols MUST be used. If this is not possible, a dedicated administration network (out-of-band management) MUST be used (see NET.1.1 Network Architecture and Design).

If network management tools are accessed from a network outside the management networks in question, authentication and encryption methods that are considered secure MUST be implemented.

In principle, insecure versions of the Simple Network Management Protocol (SNMP) MUST NOT be used in network management. If insecure protocols are nevertheless used and not secured via other secure network protocols (e.g. VPN or TLS), a separate management network MUST be used. As a matter of principle, SNMP SHOULD ONLY be used for access with the minimum access rights required. The access authorisations SHOULD be limited to dedicated management servers.

For network management, a security policy SHOULD be drawn up and continuously maintained. All persons involved in network management SHOULD be familiar with the security policy. The security policy SHOULD form the basis of their work. Regular and transparent reviews SHOULD be conducted to ensure that the policy's requirements are being implemented. The results SHOULD be appropriately documented.

The security policy SHOULD define which areas of network management are to be implemented using central management tools and services. It SHOULD also define the extent to which tasks in the network management of the organisation in question are to be implemented automatically.

In addition, framework conditions and specifications SHOULD be specified for network separation, access control, logging, and communication protection. Framework conditions and specifications SHOULD also be specified for the network management tools used and for the basic operational rules of network management.

Documentation SHOULD be drawn up that describes the management infrastructure of the network in question. It SHOULD include an initial inventory and all changes made in network management. In particular, it SHOULD document which network components are administered using which management tools. Furthermore, all IT workstations and end devices used for network management, as well as all information and management data available on network management operations, SHOULD be included. Ultimately, all interfaces to applications and services outside of network management SHOULD be documented.

The resulting documentation of the actual status of the management infrastructure SHOULD be compared against the network infrastructure documentation (see module NET.1.1 Network Architecture and Design).

The documentation SHOULD be complete and up to date at all times.

Based on the security policy drawn up for network management, a network management concept SHOULD be established and consistently maintained. In doing so, the following minimum aspects SHOULD be taken into account as required:

• methods, techniques, and tools for network management
• protection of access and communication
• network separation, in particular the assignment of network management components to zones
• the scope of monitoring and alerts for each network component
• logging
• automation (particularly of the central distribution of configuration files to switches)
• reporting chains in the event of malfunctions and security incidents
• provisioning of network management information for other areas of the organisation in question
• integration of network management into contingency planning

Detailed and implementation planning SHOULD be drawn up for network management infrastructure. It SHOULD consider all the items addressed in the respective security policy and network management concept.

A concept for secure operation of network management infrastructure SHOULD be drawn up based on the relevant security policy for network management and the network management concept. This concept SHOULD take into account the application and system operations for the network management tools in use. The manner in which the performance of other operative units can be integrated and controlled SHOULD also be checked.

Network management solutions SHOULD be established, configured securely, and put into operation based on the security policy, the specified requirements (see NET1.2.A2 Specification of Network Management Requirements), and the detailed and implementation plan in the case at hand. Afterwards, the specific processes for network management SHOULD be set up.

The extent to which the network management solution in use corresponds to the target state SHOULD be checked regularly and transparently. In so doing, whether the existing solution still complies with the relevant security policy and requirements specification SHOULD be checked. The extent to which the management structure implemented and the processes used comply with the current status SHOULD also be checked. A comparison SHOULD also be made to determine whether the management infrastructure is up to date.

Training measures SHOULD be developed and carried out for the network management solutions used. The measures SHOULD cover the individual circumstances at hand in terms of configuration, availability, and capacity management, as well as typical situations in the field of error management. The training SHOULD be repeated at regular intervals, but at least when there are major technical or organisational changes within the network management solutions.

Administrators SHOULD avoid using direct management access to interface with network components from IT systems outside of their organisation's management networks. If such access is necessary without a central management tool, the communication SHOULD be decoupled. Jump servers of this kind SHOULD be integrated into the management network in question and located in a separate access segment.

The management functions enabled SHOULD be limited to those that are actually required.

It SHOULD be possible to automatically distribute, install, and activate software, firmware, configuration data, and network components over a given network without interrupting operations. The information required for this SHOULD be securely available from a central point and integrated into version management and data backup processes. The central configuration management used for this purpose SHOULD be maintained continuously and audited regularly.

The basic performance and availability parameters of central network components SHOULD be monitored continuously. For this purpose, the respective threshold values SHOULD be determined in advance (baselining).

Important events on network components and network management tools SHOULD be automatically transmitted to a central management system and logged there (see OPS.1.1.5 Logging). In addition, the persons in charge SHOULD be informed automatically. Alerts and logging SHOULD include the following items at minimum:

• failure and non-availability of network or management components
• hardware malfunctions
• failed login attempts
• critical conditions or overloading of IT systems

Event messages and log data SHOULD be transmitted to a central management system either continuously or in a bundled manner. Alarm messages SHOULD be transmitted as soon as they occur.

An organisation's network management solutions SHOULD be integrated into its contingency planning. To this end, network management tools and the configurations of network components SHOULD be backed up and integrated into the organisation's recovery schemes.

Dedicated management clients SHOULD be used for administering both internal and external IT systems. To this end, one management client MUST be located on the external network area (for administering IT systems connected to the Internet) and another in the internal area (for administering internal IT systems).

If management networks are separated by VLANs, it SHOULD be ensured that the external packet filter and the devices connected to this filter are located in their own sub-network. It MUST also be ensured that the ALG is not bypassed in this process.

Central management solutions SHOULD be operated in manner that ensures high availability. To this end, the servers and tools involved (including their network connections) SHOULD be designed redundantly. The individual components SHOULD also be provided in a highly available manner.

Only secure protocols SHOULD be used for network management. All the security features of these protocols SHOULD be used.

An organisation's management network SHOULD be separated physically from its productive networks.

At minimum, physically separated zones SHOULD be established for managing LAN components, security components, and components for external connections.

Collected log data SHOULD be archived for forensic analysis in a legally compliant and audit-compliant manner (see also DER.2.2 Provisions for IT Forensics).

Network management logging SHOULD be integrated into a security information and event management (SIEM) solution. For this purpose, the requirements catalogues used to select network management solutions SHOULD be adapted to reflect the support required for interfaces and transmission formats (see NET.1.2.A2 Specification of Network Management Requirements).

Time synchronisation SHOULD be ensured across all of an organisation's sites. A common reference time SHOULD be used for this purpose.

In order to quickly recover the target software or firmware status and configure the components of network management infrastructure, replacement solutions of a sufficient quality SHOULD be specified.