Network device requirements

Organization must be able to monitor that devices, data systems and networks are maintained in accordance with the defined configurations (including security features) both during the implementation phase and throughout their entire life cycle.

For this, the organization has defined standard templates for secure configurations of devices, data systems and networks. When specifying standard templates, the following are taken into account:

• publicly available guidelines (e.g. templates from suppliers and independent security organizations)
• the level of protection required for different assets
• fulfilling related information security requirements
• feasibility and applicability of the configurations to the organization's operations

Standard templates should be checked regularly and updated when significant new threats or vulnerabilities need to be responded to or new software or hardware versions are released.

The following points should be taken into account when defining standard templates:

• the number of root-level rights is minimized
• unnecessary access rights are disabled
• unnecessary functions and services are deactivated
• access to powerful utilities and important settings is strictly controlled
• the clocks are synchronized
• the supplier's default passwords are changed immediately and the security-related settings are checked
• timeout functions are used if necessary (e.g. automatic logout)
• license requirements are met

The security arrangements required for critical online services, such as security features, service levels, and management requirements, are carefully defined in advance. Online services include e.g. connections, networks and network security solutions (e.g. firewalls).

The security features of online services can be e.g. the following:

• required security-related technologies such as authentication, encryption technology, and network connection management tools
• the technical parameters required for a secure connection to network services
• online service usage criteria that restrict access to the online service or applications as needed

The use of the wireless network is secured with sufficient keys and the connection traffic to the network router is encrypted. The wireless network for guest use is isolated from the company's own internal network.

For example, when the fault tolerance of a telecommunication network is critical, it can be further improved by procuring basic network services through several routes and through several service providers.

The organisation should ensure its networds has sufficient redundancy. The following aspects should be considered:

• Multiple Internet Service Providers (ISP)
• Redundant network links
• Redundant network devices (multiple switchers, routers and other devices and use of network load balancers)
• Power redundancy (UPS)