6.7 Network security

Requirement

The relevant entities shall take the appropriate measures to protect their network and information systems from cyber threats.

Guidance

• Take into account well-known standards when implementing measures for network security (61).

Examples of evidence

• Documented network security measures that are based on relevant standards and good practices.

Requirement

For the purpose of point 6.7.1., the relevant entities shall: (a) document the architecture of the network in a comprehensible and up to date manner; (b) determine and apply controls to protect the relevant entities’ internal network domains from unauthorised access; (c) configure controls to prevent accesses and network communication not required for the operation of the relevant entities; (d) determine and apply controls for remote access to network and information systems, including access by service providers; (e) not use systems used for administration of the security policy implementation for other purposes; (f) explicitly forbid or deactivate unneeded connections and services; (g) where appropriate, exclusively allow access to the relevant entities’ network and information systems by devices authorised by those entities;

(h) allow connections of service providers only after an authorisation request and for a set time period, such as the duration of a maintenance operation; (i) establish communication between distinct systems only through trusted channels that are isolated using logical, cryptographic or physical separation from other communication channels and provide assured identification of their end points and protection of the channel data from modification or disclosure; (j) adopt an implementation plan for the full transition towards latest generation network layer communication protocols in a secure, appropriate and gradual way and establish measures to accelerate such transition; (k) adopt an implementation plan for the deployment of internationally agreed and interoperable modern e-mail communications standards to secure e-mail communications to mitigate vulnerabilities linked to e-mail-related threats and establish measures to accelerate such deployment; (l) apply best practices for the security of the DNS and for Internet routing security and routing hygiene of traffic originating from and destined to the network.

Guidance

• Implement secure-by-design principles by integrating security at every layer of network design including the physical, data link, network, transport and application layers.
• Implement secure configurations for wireless networks.
• Where appropriate, consider zero-trust (62) network access.
• Identify the technical measures for the transition to the latest network layer communication protocols (e.g. transition to Internet Protocol version 6).
• Define roles, responsibilities and timelines for the transition to latest-generation network layer communication protocols.
• Approve, log and perform remote maintenance of network and information systems in a manner that prevents unauthorised access.
• Consider the following for email communications (indicative, non-exhaustive list):
  • standards such as Start transport layer security (STARTTLS), DNS-based authentication of named entities (DANE), domain-based message authentication, reporting and& conformance (DMARC), DomainKeys identified mail (DKIM) and sender policy framework (63),
  • internal spam/scam/virus filtering and
  • URL rewriting, URL scanning and URL detonation in a sandbox.
• Consider DNS security good practices (indicative, non-exhaustive list):
  • deploying DNS security extensions (DNS SEC) (64),
  • deploying protective DNS, wherever technically feasible, to provide additional network-wide security capabilities,
  • encrypting DNS traffic, both internal and external, wherever feasible,
  • deploying dedicated DNS servers to reduce attack surface and
  • following all technical guidance on ensuring that DNS deployments and the DNS protocol are as secure and resilient as possible.
• Consider Border Gateway Protocol (BGP) (65) for internet routing.

Examples of evidence

• Up-to-date network diagrams, including OOB connections.
• Firewall(s) configured in accordance with the network traffic rules of the entity’s policies.
• Configuration files and rulesets for firewalls and routers, showing how traffic is filtered and managed.
• Secure configurations for wireless networks for example use of WPA3 (encryption), 802.1X with EAP (authentication), firmware updates.
• Configuration files for switches, including virtual local access network (VLAN) settings and ACLs.
• Documentation of ACLs implemented on network devices to control traffic flow.
• Documented correct usage of mobile devices, including the entity’s connected vehicles that can store data locally on the vehicle and/or share data externally by means of telematics and other remote accesses (e.g. teleworking and OOB connections).
• Evidence of controls over privileged accounts, including logs and policies.
• A list of all devices used (network components), if any, that cannot receive security patches and are not up to date.
• Access logs to confirm that only authorised personnel make changes and conduct reviews of the network security rules.
• Transition to the latest generation plan for implementing network layer communication protocols.

Requirement

The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

• Although the frequency of reviews of network security measures depends on the entity’s risk assessment as a general rule the entity might (indicative, non-exhaustive list):
  • continuously monitor the networks for real time threats;
  • perform scans for new vulnerabilities weekly;
  • review and possibly update the rules of the firewall and other tools monthly; and
  • thoroughly assess the entire network annually.
• Review logs or records of all changes made to the network security rules, including details of the changes, approvals and implementation dates.
• Ensure that these reviews are conducted regularly and documented comprehensively.

Examples of evidence

• Plans or schedules for upcoming or completed, regular or ad hoc reviews.
• List of reports from past reviews. This should cover various types of reviews.
• Logs from firewalls, routers and other network devices showing access attempts, configuration changes and other relevant activities.
• Reports from SIEM and EDR/XDR systems showing aggregated and analysed security events.
• Virtual private network (VPN) and remote access logs showing remote access, including OOB connections, access attempts, successful connections and any anomalies.
• Evidence of network access control (NAC) or other similar and/or alternative solutions, in place, including logs and configuration settings.
• Logs or records showing the dates and results of regular reviews of the network security rules.
• Logs or records of all changes made to the network security rules.
• Logs or records of firewall and ACL reviews.
• Documentation showing regular reviews of user and administrative access to network devices.
• Audit logs from network security devices (e.g. firewalls, intrusion detection/prevention systems (IDS/IPS)) to ensure that changes and reviews are logged.
• Backup files of network device configurations to ensure that changes and reviews are reflected in the backups.
• Logs of network security incidents to see if they include documentation of rule set reviews following significant incidents.
• Post incident review reports to see if they document reviews and any necessary adjustments to the network security rules.

Tips: guidance

• Communicate to personnel the correct usage of mobile devices, including the entity’s connected vehicles and other remote accesses.
• Where appropriate, apply solutions capable of collecting, analysing and detecting all anomalies, exfiltrations, intrusions and the most sophisticated threats.

Tips: examples of evidence

• The correct usage of mobile devices and other remote accesses (e.g. teleworking and VPN) has been communicated to personnel.
• Existence of IDS/IPS.