+DER.2.3.A4 Blocking and Changing Access Data and Cryptographic Keys (B)

DER.2.3.A4 Blocking and Changing Access Data and Cryptographic Keys (B)

All access data MUST be changed after an affected network is isolated. Furthermore, access data managed in a centralised manner MUST also be reset, including in Active Directory environments or when the Lightweight Directory Access Protocol (LDAP) has been used.

If the central authentication server (domain controller or LDAP server) has been compromised, all the users on it MUST be blocked and have their passwords changed. This MUST be implemented by experienced administrators and with the help of internal or external forensics experts, if necessary.

If TLS keys or an internal certification authority (CA) has been compromised by the APT attack, corresponding keys, certificates, and infrastructures MUST be regenerated and redistributed. The compromised keys and certificates MUST also be reliably blocked and withdrawn.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
blocks G 0.14 Interception of Information / Espionage
blocks G 0.15 Eavesdropping
blocks G 0.16 Theft of Devices, Storage Media and Documents
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.21 Manipulation with Hardware or Software
blocks G 0.22 Manipulation of Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.24 Destruction of Devices or Storage Media
blocks G 0.32 Misuse of Authorisation
blocks G 0.39 Malware
blocks G 0.40 Denial of Service
blocks G 0.41 Sabotage
blocks G 0.43 Attack with Specially Crafted Messages
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information