85 Deny use of source routing. Prevent denial-of-service attacks. 86 Use technologies like firewalls and virtual local area Achieve network segmentation to networks (VLANs) to properly segment your achieve compartmentalization. organization’s network in order to increase compartmentalization (e.g., machines with access to business services like e-mail should not be on the same network segment as your SCADA machines). Routinely review and test your firewall rules to confirm expected behavior. 87 Separate development, test, and production Avoid production data leaks into test environments. environments. Have controls in place around access to and changes in the production environment. 88 Ensure channel security of critical communication Secure data in transit. with technologies like Transport Layer Security (TLS). Where possible, implement Public Key Infrastructure (PKI) to support two-way mutual certificate-based authentication between nodes on your network. 89 Ensure availability of data traversing your networks. If Detect failures and promote fault a proper acknowledgement (ACK) is not received from tolerance. the destination node, ensure that provisions are in place to resend the packet. If that still does not work, reroute the packet via a different network link. Implement proper physical security controls to make your network links harder to compromise.
85 Deny use of source routing. Prevent denial-of-service attacks. 86 Use technologies like firewalls and virtual local area networks (VLANs) to properly segment your organization’s network in order to increase compartmentalization (e.g., machines with access to business services like e-mail should not be on the same network segment as your SCADA machines). Routinely review and test your firewall rules to confirm expected behavior. Achieve network segmentation to achieve compartmentalization. 87 Separate development, test, and production environments. Avoid production data leaks into test environments. Have controls in place around access to and changes in the production environment. 88 Ensure channel security of critical communication with technologies like Transport Layer Security (TLS). Where possible, implement Public Key Infrastructure (PKI) to support two-way mutual certificate-based authentication between nodes on your network. Secure data in transit. 89 Ensure availability of data traversing your networks. If a proper acknowledgement (ACK) is not received from the destination node, ensure that provisions are in place to resend the packet. If that still does not work, reroute the packet via a different network link. Implement proper physical security controls to make your network links harder to compromise. Detect failures and promote fault tolerance.
2014-Coop-Cyber-Security-Plan-Template-Update-1-SampleData.docx