MAC Address; Encryption and digital signatures; Caller Line Identification (CLID); Remote Access Service Call-back. Additional controls based on DLMs and protective markings There is no additional guidance specific to information asset classification levels. Remote diagnostic/configuration port protection ISMF Standard 88 (Configuration port protection) Access to diagnostic and configuration ports shall be securely controlled and where necessary, a key lock and a procedure shall be implemented to ensure that the facility is only accessible by arrangement between the Responsible Party and the support personnel requiring access. Business Controls The following general guidance applies regardless of the classification levels of the information assets: Responsible Parties may implement the guidance described in . (The removal of this control in ISO/IEC 27001:2013 does not absolve Agencies from their obligations under ISMF Standard 88). Supervisory control and data acquisition (SCADA) networks are used to monitor and control key functions in provision of various services and products. Responsible Parties must implement appropriate controls for the protection of SCADA networks as part of the protection of the organisation’s overall network infrastructure and should consider additional product and/or feature specific control(s) that may be applied to protect these assets including a combination of physical and logical controls, such as using non-standard virtual port identifiers and dedicated firewalls or remote access devices. Default passwords must be changed and, applicable, Simple Network Management Protocol (SNMP) and/or Wireless LAN (i.e. Wi-Fi, 3G, GSM etc.) should be disabled on SCADA devices. Additional controls based on DLMs and protective markings Classification Additional Controls [FOUO] Official Use Only Hardware that supports remote connections for ad-hoc support [SOUO] Sensitive (e.g. modems and VPN switches) should be powered off or [I2] Integrity 2 otherwise disabled, and only enabled when specifically required. [A2] Availability 2
MAC Address; Encryption and digital signatures; Caller Line Identification (CLID); Remote Access Service Call-back. Additional controls based on DLMs and protective markings There is no additional guidance specific to information asset classification levels. Remote diagnostic/configuration port protection ISMF Standard 88 (Configuration port protection) Access to diagnostic and configuration ports shall be securely controlled and where necessary, a key lock and a procedure shall be implemented to ensure that the facility is only accessible by arrangement between the Responsible Party and the support personnel requiring access. Business Controls The following general guidance applies regardless of the classification levels of the information assets: Responsible Parties may implement the guidance described in . (The removal of this control in ISO/IEC 27001:2013 does not absolve Agencies from their obligations under ISMF Standard 88). Supervisory control and data acquisition (SCADA) networks are used to monitor and control key functions in provision of various services and products. Responsible Parties must implement appropriate controls for the protection of SCADA networks as part of the protection of the organisation’s overall network infrastructure and should consider additional product and/or feature specific control(s) that may be applied to protect these assets including a combination of physical and logical controls, such as using non-standard virtual port identifiers and dedicated firewalls or remote access devices. Default passwords must be changed and, applicable, Simple Network Management Protocol (SNMP) and/or Wireless LAN (i.e. Wi-Fi, 3G, GSM etc.) should be disabled on SCADA devices. Additional controls based on DLMs and protective markings Classification Additional Controls [FOUO] Official Use Only [SOUO] Sensitive [I2] Integrity 2 [A2] Availability 2 Hardware that supports remote connections for ad-hoc support (e.g. modems and VPN switches) should be powered off or otherwise disabled, and only enabled when specifically required.
ISMF-v3F.docx