A.8.20
Networks security
Technological controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control ensures that networks and network devices are securely managed and controlled so that information passing over the network and the systems/services it supports are protected from threats such as unauthorized access, eavesdropping, tampering, and denial of service. Because networks include both connections between internal systems and paths to external parties, areas of differing trust levels must be separated, traffic across perimeters and segments must be controlled, and the confidentiality/integrity of data in transit must be assured. Network activity must also be continuously logged and monitored so that anomalies can be detected and responded to.
Key checkpoints
- Are network diagrams/asset inventories kept current, and are areas (DMZ, internal network, management network, and so on) separated according to trust level?
- Are access control policies across perimeters and segments defined on a least-privilege basis and reflected in firewalls/ACLs?
- Are security configuration baselines for network devices (changing default passwords, disabling unnecessary services/ports, restricting management access) established and applied?
- Are encryption and authentication applied to remote access, wireless, and external connection segments?
- Is network traffic logged/monitored, and is there an operating capability to detect and alert on anomalies?
- Are devices joining the network identified/authenticated so that unapproved devices cannot connect, and are weak protocols such as Telnet disabled?
Implementation guidance
- Separate the network into zones by trust level (public/DMZ, internal business network, management network, development network, and so on) and use firewalls/ACLs to block inter-zone traffic by default and permit only the required flows (default deny).
- Define network-device baselines for replacing default secrets, disabling unnecessary default accounts/services/ports, restricting management interfaces, and updating firmware. Distinguish a retained default account name from exposed default credentials.
- Use protected protocols such as SSH/HTTPS for remote management. Apply authentication and encryption appropriate to users, devices, and services on external/wireless/remote connections, with MFA for high-risk user access. Do not assume every link needs a VPN or interactive MFA.
- Collect logs from network devices and security systems centrally (log server/SIEM), and continuously monitor for signs of intrusion/misuse using threshold-based alerting and anomalous-traffic detection (IDS/IPS, NDR, and so on).
- Identify and authenticate devices joining the network (802.1X/NAC, and so on) to keep unapproved devices off, and disable weak protocols such as Telnet. Manage the security requirements and service levels to be agreed with network service providers under A.8.21.
- Apply the change management (A.8.32) procedure to network configuration changes, periodically review firewall policies/ACLs to remove unused or overly permissive rules, and keep network diagrams current.
Evidence
- Network diagrams and network asset/zone inventories
- Firewall/ACL policies and policy review (periodic re-review) records
- Network device security configuration standards and applied configuration records (snapshots/inspection results)
- Encryption and authentication configuration for remote/wireless/external access (VPN, multi-factor authentication, and so on)
- Log collection and monitoring/alerting configuration for network/security devices, and anomaly detection/response records
- Device authentication settings for network access (802.1X/NAC, and so on) and results of checks that weak protocols are disabled
Nonconformity examples
- Areas of differing trust level are not separated, so externally reachable systems and internal core systems coexist on the same network.
- The firewall policy contains overly permissive (any-any) rules with unclear purpose/justification and is not periodically reviewed.
- Network-device default passwords remain in use or unnecessary management services are exposed externally.
- Remote/wireless access segments lack encryption or strengthened authentication, creating a risk of eavesdropping/unauthorized access.
- Network device logs are not collected/monitored, so intrusion attempts or anomalous traffic cannot be detected.
- Devices joining the network are not identified or authenticated, so unapproved devices can connect to the internal network.