Establish and maintain a comprehensive security architecture

Systems here mean servers, workstations, active network devices (firewalls, routers, switches, wireless base stations, etc.) and the like. Hardening, on the other hand, means changing the system's settings in such a way that the system's vulnerability area can be reduced.

Organization has defined operating processes through which:

• Only essential features, devices and services (in terms of usage and data processing requirements) are put into use. Redundancies are also removed at the BIOS level.
• There is a procedure in which systems are systematically installed so that the end result is a hardened installation.
• A hardened installation contains only such components and services, and users and processes rights that are necessary to meet operational requirements and ensure security.
• Software such as operating systems, applications, and firmware are set to collect the necessary log information to detect abuse.
• Starting the data system from an unknown (other than defined as primary) is blocked from the device.
• Software (e.g. firmware, applications) is kept up-to-date.
• Connections to the target, including management connections, are limited, hardened, user-identified and time-limited (session timeout).< /li>

Establish and maintain a comprehensive security architecture. The following functionality should be implemented into the ICT system:

• Functionality for managing users and accounts
• Functionality for staying in control of devices (e.g. clients)
• Functionality for managing access to resources and services
• Functionality for controlling software execution and software installation (especially on clients)
• Tools for operating and virtualising all or parts of the ICT architecture (on-prem and cloud)
• Network devices (switches, routers, access points) and firewalls
• Mechanisms for dealing with malware (antivirus)
• Cryptographic modules
• Digital certificates and public key infrastructure (PKI)
• Databases
• Tools for system monitoring
• Tools for managing security configurations
• Intrusion detection (IDS) and protection (IPS) systems
• Backup and restore

Design the ICT system using ICT products which integrate well. This means that:

• Used ICT products should be module-based. (The principle of least functionality in systems)
• Used ICT products should comply with the industry standards
• Products and security functionality (also from different vendors) should work well together from a security perspective. These products should reuse identities taken from shared database of organisations identities.