Network integrity

Network segregation is used to divide networks into smaller parts (called subnetworks or segments). The main purpose is to achieve least privilege principles by limiting the access e.g. a user or any particular device can have.

When offering cloud services, the organisation should implement network access segregation to:

• Strongly separate tenants in multi-tenant environments
• Strongly separate provider’s own internal administration environment and customers cloud computing environment

Organisation should be able to help the customer to verify the segregation implementation.

Owners have been assigned to various network devices, who are responsible for ensuring that the information processed on the networks and related services are protected from unauthorized access. Where appropriate, liability for network equipment must be separated from other related responsibilities.

Isolate technical environments where the consequences can be very damaging.

An appropriate log is generated from the use of the network to enable the detection of actions relevant to cyber security.

The normal state of network traffic (traffic volumes, protocols, and connections) is known. In order to detect anomalies, there is a procedure for detecting events that are different from the normal state of network traffic (for example, anomalous connections or their attempts).

An owner is defined for an organization's networks. The owner is responsible for planning the structure of the network and documenting it.

Separate network areas are used in network design as needed. Domain areas can be defined by e.g.:

• trust level (eg public, workstations, server)
• organizational units (eg HR, financial management)
• or by some combination (for example, a server domain that is connected to multiple organizational units)

Separation can be implemented either with physically separate networks or with logically separate networks.