Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
NCM ICT Security Principles is a framework for ICT security published and maintained by the Norwegian National Security Authority (NSM). The security principles advice businesses and organisations on how to protect their information systems from unauthorized access, damage or misuse.
NCM ICT Security Principles is a framework for ICT security published and maintained by the Norwegian National Security Authority (NSM). The security principles advise businesses and organisations on how to protect their information systems from unauthorized access, damage or misuse.
The principles focus on technological and organisational measures. Measures concerning physical security and the human perspective are generally not covered. The measures apply to both unintentional and intentional acts, although the main focus is on intentional acts.
In this framework there are 21 security principles with a total of 118 security measures, distributed across four categories: i) identify, ii) protect and maintain, iii) detect and iv) respond and recover.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
Deactivate unnecessary functionality. Consider deactivating built-in functions (in both operating systems and applications) on clients, servers and network equipment not needed by the organisation in order to reduce the attack surface. This could include i) older or unused protocols, ii) built-in support for personal cloud services, for example, iii) other built-in services that the organisation will not be using.
Establish and maintain standard security configurations, ideally one template for each type of device across the organisation. This applies to operating systems (client and server), firewalls, network equipment, applications and hardware. a) All management of security configurations should be centralised and standardised for each type of device. b) The configuration should be reviewed and updated regularly to eliminate the latest vulnerabilities and attack vectors. c) Changes to the configuration should follow the organisation’s process for change management and be overseen by authorised staff. d) Security configurations must only be changed by authorised operating staff and not be able to be changed by end users on their clients.
Verify that activated security configurations comply with the organisation’s approved security configurations. a) Regularly compare activated configurations on system components such as network equipment, firewalls, clients and servers with the approved/authorised configuration defined for each type of device across the organisation. b) Any unauthorised changes to the configuration should be investigated, reported and acted on. c) The approved/authorised configuration should be integrity-protected. Only IT and information security staff should have access to the configuration. d) Automate the verification process insofar as possible and run automated processes regularly, e.g. every night.
Ensure that maintenance of all configurations, installations and operations are done securely.
a) Perform management operations in trusted channels. Consider i) installing trusted TLS certificates, ideally issued internally, in as many administrator interfaces as possible, see 2.7.1. and 2.7.2. And ii) avoid exposing administrator interfaces to the internet and to the servers/clients using the service. b) Use trusted and dedicated clients for management operations. c) Reduce interactive log-ins directly on servers and clients to a minimum when performing management operations. Interactive log-in increases the risk (attacks such as “pass the hash”) and goes against the goal of automating and standardising configuration, and also against the goal of automated verification of the configuration.
Change all standard passwords on ICT products before deployment. This includes applications, operating systems, routers, firewalls, printers and access points. If the ICT products support it, one should use certificate-based authentication and reduce use of password-based authentication over the network.
Do not deactivate exploit protection functions. Newer operating systems come with activated exploit protection functions such as DEP, SEHOP and ASLR. They make it more difficult for an attacker to exploit vulnerabilities even when one has not updated the system. Create exceptions for older applications that do not work well with exploit protection so that one is not forced to deactivate the protection in its entirety. Then contact the application provider to remove the vulnerabilities.
Synchronize time across devices and use trusted time sources. Choose time sources that have a high degree of trust, and check that all device clocks use time of the desired quality.
Reduce the risk posed by IoT devices. a) Create a plan for deploying such devices to include security aspects with risk assessments, incl. an assessment of the cloud the devices connect to. b) Only purchase devices with built-in security functions, e.g. which i) provide security updates (2.3.1), ii) are able to change all standard passwords (2.3.7), iii) can be forced to only use networks the organisation has control over. c) Monitor traffic from the devices (see principle 3.2 – Establish security monitoring), d) isolate the devices in separate network zones (see principles 2.2 – Establish a secure ICT architecture and 2.5 – Control data flow) and e) consider their location with regard to unauthorised physical access to the devices.
Establish access control on as many network ports as possible. Keep in mind that ports can be physical, wireless or virtual. a) Network traffic should only be permitted on organisation-approved ports (allowlisting principle). b) Only permit access from managed devices. c) Unmanaged devices should only be able to access a guest network or similar.
Encrypt all wireless and wired connections. a) Encrypt all wireless connections. Use up-to-date protocols such as WPA2/WPA3 in “enterprise mode”. b) Encrypt all wired connections on the organisations own network, as a minimum those connections not physically controlled by the organisation.
Identify physical access to switches and cables. Organisations are often unaware of where their cables run and whether they can be physically accessed by unauthorised parties. If one has not authenticated and encrypted all connections, one should identify where the cabled networks are and determine whether unauthorised parties are able to physically access them (between buildings, between floors in buildings shared with other organisations, between different geographical locations, semi-public reception areas, etc.).
Activate firewall on all clients and servers. Firewalls are usually built into operating systems and can be used for traffic management and logging. Use firewalls to a) regulate incoming/outgoing traffic, b) log security-related events. One should integrate the log with the organisation’s other solutions for security monitoring. c) Integrate client/server logging with centralised logging.
Control data flow between network zones. a) Use the segmentation in principle 2.2 – Establish a secure ICT architecture to filter legitimate (allowlisted) network traffic between zones and to the internet. The filtering can be based on criteria such as IP address, zone identifier, protocol, application, user etc. b) The rules (incl. changes) for the traffic between the zones should be documented and justified. c) Check regularly that the actual configuration of the data flow is in line with the desired data flow.
Restrict access to internal services from external locations. a) Allow only organisation-managed devices to access critical internal services. b) Access to internal services from unmanaged and personal devices should only be permitted following a criticality assessment of the service. For instance, one may need to be able to access email and time sheets. If so, one should consider measures to reduce risk, e.g. by offering less functionality, shorter search history, an additional layer of authentication etc.
Block all direct traffic between clients. Applications requiring peer-to-peer should instead use a server service. Alternatively, reduce direct traffic between clients to an absolute minimum based on what is needed for work purposes.
Isolate vulnerable and low-trust equipment, e.g.: a) Outdated applications and old servers with unsupported operating systems should be isolated (filtering criteria as described in 2.5.1.a and subject to strict access control) so that only one well secured server/proxy has direct access. b) Printers with poor security configuration and a lack of security updates.
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.