Defining standard templates for secure configurations

Critical
High
Normal
Low

Organization must be able to monitor that devices, data systems and networks are maintained in accordance with the defined configurations (including security features) both during the implementation phase and throughout their entire life cycle.

For this, the organization has defined standard templates for secure configurations of devices, data systems and networks. When specifying standard templates, the following are taken into account:

  • publicly available guidelines (e.g. templates from suppliers and independent security organizations)
  • the level of protection required for different assets
  • fulfilling related information security requirements
  • feasibility and applicability of the configurations to the organization's operations

Standard templates should be checked regularly and updated when significant new threats or vulnerabilities need to be responded to or new software or hardware versions are released.

The following points should be taken into account when defining standard templates:

  • the number of root-level rights is minimized
  • unnecessary access rights are disabled
  • unnecessary functions and services are deactivated
  • access to powerful utilities and important settings is strictly controlled
  • the clocks are synchronized
  • the supplier's default passwords are changed immediately and the security-related settings are checked
  • timeout functions are used if necessary (e.g. automatic logout)
  • license requirements are met
Connected other frameworks and requirements:
8.9: Configuration management
ISO 27001
1.3 (MIL1): Manage IT and OT Asset Configuration
C2M2
9.3 (MIL2): Implement IT and OT Asset Security as an Element of the Cybersecurity Architecture
C2M2

The principle of least functionality in systems

Critical
High
Normal
Low

The organization utilizes the principle of least functionality in deploying and configuring systems. Systems must not have rights to anything that is not needed to accomplish what they are intended for.

Connected other frameworks and requirements:
PR.PT-3: Principle of least functionality
NIST CSF
9.3 (MIL2): Implement IT and OT Asset Security as an Element of the Cybersecurity Architecture
C2M2

Access rights are managed by the principle of the least privilege

Critical
High
Normal
Low

Access to the organisation's systems is granted and managed according to principle of least privilege. No further access will be granted to the user when necessary.

The permissions will be checked and the need will also be reduced if the user has the rights user needed to perform the tasks but no longer needs them.


Connected other frameworks and requirements:
PR.AC-4: Access permissions and authorizations
NIST CSF
9.3 (MIL2): Implement IT and OT Asset Security as an Element of the Cybersecurity Architecture
C2M2

Prohibition of unencrypted portable storage devices

Critical
High
Normal
Low

Portable storage devices may include e.g. optical disks, DVDs/Blurays, flash cards, USB sticks / thumb drives, SSDs and other external hard drives. 

Portable storage devices and physical media that do not allow encryption of data should not be used unless it is unavoidable. 

Any use of unencrypted storage media and devices should be clearly documented.

Connected other frameworks and requirements:
A.11.5: Use of unencrypted portable storage media and devices
ISO 27018
9.3 (MIL2): Implement IT and OT Asset Security as an Element of the Cybersecurity Architecture
C2M2

Software firewall on endpoint devices

Critical
High
Normal
Low

All endpoint devices in the organization should be protected by a properly configured software firewall that monitors traffic, accepts compliant traffic, and monitors users.

A firewall protects against malware and attacks that come from inside or outside your organization's network.

Connected other frameworks and requirements:
9.3 (MIL1): Implement IT and OT Asset Security as an Element of the Cybersecurity Architecture
C2M2
9.3 (MIL2): Implement IT and OT Asset Security as an Element of the Cybersecurity Architecture
C2M2

Endpoint security management system

Critical
High
Normal
Low

Endpoint security management system can be used to demand the desired security criteria from the devices before they are allowed to connect to the network resources. Devices can be laptops, smartphones, tablets or industry-specific hardware.

Criteria for the use of network resources may include e.g. approved operating system, VPN and antivirus systems, and the timeliness of these updates.

Connected other frameworks and requirements:
6.2.1: Mobile device policy
ISO 27001
13.1.1: Network controls
ISO 27001
PR.PT-4: Communications and control networks
NIST CSF
8.1: User endpoint devices
ISO 27001
9.3 (MIL1): Implement IT and OT Asset Security as an Element of the Cybersecurity Architecture
C2M2
No items found.