6.8.3 The relevant entities shall review and, where appropriate, update network segmentation at planned …

Requirement

The relevant entities shall review and, where appropriate, update network segmentation at planned intervals and when significant incidents or significant changes to operations or risks.

Guidance

• Review and, if necessary, update the process for network segmentation rules at least annually.

Examples of evidence

• Reports from recent penetration tests and/or vulnerability scans.
• Plans or schedules for reviewing network segmentation rules.
• Logs or records confirming that the reviews have been conducted in accordance with the schedule.
• Change management documentation for network segmentation changes, in line with risk-assessment results and business needs.
• Incident response documentation to verify that network segmentation rules are reviewed following significant security incidents.
• Post-incident analysis reports that include assessments of segmentation rule effectiveness and any necessary adjustments.
• Internal or external audit logs and reports that cover network segmentation rule reviews.
• Reviews performed periodically and in response to network changes or incidents.
• Minutes from security or IT operations meetings where network segmentation rules are discussed.
• Penetration tests and vulnerability assessments that include evaluations of network segmentation.
• Tests conducted periodically and after major changes or incidents and findings leading to rule reviews.

Tips: guidance

• Limit the data traffic between the different segments to the operationally required extent by means of data flow control for example a firewall.
• Connect to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with the entity’s security architecture such as:
  • gateways;
  • routers;
  • firewalls;
  • network-based malicious code analysis;
  • virtualisation systems; and
  • encrypted tunnels.
• Prevent discovery of specific system components composing a managed interface.
• Monitor exceptions.

Tips: examples of evidence

• Network isolation and implementation of segmented network security zones that limit the impact of a malicious software incident.
• Logging and monitoring active for each zone.
• Alerts for segmentation rule violations.
• Reviews triggered by alerts to segmentation violations.

1. Overzicht

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

3. Gerelateerde regelingen

Gekoppelde issues

• ENISA -