smallest number of endpoints, workstations, devices, and services possible. Protection.45 Non-adjacent Network Prohibit all direct DHS 2.8.7, Restrictions communication (without 2.8.5 additional, appropriate security controls) between devices/systems in network segments. Protection.46 Internet and e-mail No system, workstation, or DHS 2.8.7, Restrictions device in any DM network 2.8.5 should have access to the Internet. This includes workstations in the DM Control Systems User Network. Utility employees primary workstations are in these Internet-restricted network segments should be provided secondary accessible systems for Internet and email access. Protection.47 Centralized Authentication Authentication servers for DHS 2.8.7, the DM systems shall be 2.8.5 separate from authentication servers used for corporate and business systems. The DM authentication system should be placed in the DM Control System Server Network and should not have any trust relationships with other non-DM centralized authentication systems. Protection.48 Secure Coding Practices DM software components DHS 2.8.5, shall be developed in 2.5.8 accordance with secure coding standards (e.g., the CERT C secure coding standard) or avoidance of cataloged coding flaws and weaknesses (e.g., the NIST SAMATE Reference Dataset or the MITRE
smallest number of endpoints, workstations, devices, and services possible. Protection.45 Non-adjacent Network Restrictions Prohibit all direct communication (without additional, appropriate security controls) between devices/systems in network segments. DHS 2.8.7, 2.8.5 Protection.46 Internet and e-mail Restrictions No system, workstation, or device in any DM network should have access to the Internet. This includes workstations in the DM Control Systems User Network. Utility employees primary workstations are in these Internet-restricted network segments should be provided secondary accessible systems for Internet and email access. DHS 2.8.7, 2.8.5 Protection.47 Centralized Authentication Authentication servers for the DM systems shall be separate from authentication servers used for corporate and business systems. The DM authentication system should be placed in the DM Control System Server Network and should not have any trust relationships with other non-DM centralized authentication systems. DHS 2.8.7, 2.8.5 Protection.48 Secure Coding Practices DM software components shall be developed in accordance with secure coding standards (e.g., the CERT C secure coding standard) or avoidance of cataloged coding flaws and weaknesses (e.g., the NIST SAMATE Reference Dataset or the MITRE DHS 2.8.5, 2.5.8
DM%20Security%20Profile%20-%20v1_0%20-%2020120220.docx