Network routing controls should be implemented by Responsible Parties as necessary to enforce and support the Agency’s access control policy. Business Controls The following general guidance applies regardless of the classification levels of the information assets: Responsible Parties should implement the guidance contained in . (The removal of this control in ISO/IEC 27001:2013 does not absolve Responsible Parties from their obligations under ISMF Standard 91). Good Practice: SNMP services should be disabled or set to read only with a community string other than Where access is required, the community strings should be set to a string other “public”. “write” than Only SNMP queries from known IP addresses (monitoring servers etc) should be “private”. processed by a router. Where possible, restrict hosts that can accept or transmit Routing Information Protocol (RIP) packets. Restrict the use of trivial file transfer protocol (TFTP). TFTP does not have any security controls built in to it. If TFTP needs to be used, make sure that the TFTP host is secured and that the correct ACLs or file/directory permissions are in place. The TFTP server (if needed) should not run other services, as it may be a source of compromise for those services. Checksums should be placed on all files on the TFTP machine. Also, lock down the hosts from layer 2 (e.g. in UNIX, use the file /etc/ethers to set the MAC address to a specific host). Additional controls based on DLMs and protective markings Classification Additional Controls Address translation mechanisms must be implemented to [A4] Availability 4 isolate the internal network from external networks. [P] Protected [SC] Sensitive: Cabinet Address translation mechanisms should be implemented to isolate the internal network from external networks. [I4] Integrity 4 Positive source and destination address checking mechanisms should be adopted (to counter IP spoofing [FOUO] Official Use Only attacks). [SOUO] Sensitive Physical and logical access to consoles for all routers [I2] Integrity 2 should be restricted to only the Network Administrator. [A2] Availability 2 Privileged modes should be password protected. This helps to ensure that only authorised personnel can make modifications to the router’s configuration.
Network routing controls should be implemented by Responsible Parties as necessary to enforce and support the Agency’s access control policy. Business Controls The following general guidance applies regardless of the classification levels of the information assets: Responsible Parties should implement the guidance contained in . (The removal of this control in ISO/IEC 27001:2013 does not absolve Responsible Parties from their obligations under ISMF Standard 91). Good Practice: SNMP services should be disabled or set to read only with a community string other than “public”. Where “write” access is required, the community strings should be set to a string other than “private”. Only SNMP queries from known IP addresses (monitoring servers etc) should be processed by a router. Where possible, restrict hosts that can accept or transmit Routing Information Protocol (RIP) packets. Restrict the use of trivial file transfer protocol (TFTP). TFTP does not have any security controls built in to it. If TFTP needs to be used, make sure that the TFTP host is secured and that the correct ACLs or file/directory permissions are in place. The TFTP server (if needed) should not run other services, as it may be a source of compromise for those services. Checksums should be placed on all files on the TFTP machine. Also, lock down the hosts from layer 2 (e.g. in UNIX, use the file /etc/ethers to set the MAC address to a specific host). Additional controls based on DLMs and protective markings Classification Additional Controls [A4] Availability 4 Address translation mechanisms must be implemented to isolate the internal network from external networks. [P] Protected [SC] Sensitive: Cabinet [I4] Integrity 4 Address translation mechanisms should be implemented to isolate the internal network from external networks. [FOUO] Official Use Only [SOUO] Sensitive [I2] Integrity 2 [A2] Availability 2 Positive source and destination address checking mechanisms should be adopted (to counter IP spoofing attacks). Physical and logical access to consoles for all routers should be restricted to only the Network Administrator. Privileged modes should be password protected. This helps to ensure that only authorised personnel can make modifications to the router’s configuration.
ISMF-v3F.docx