## 8.20 Networks security

  

| Control type           | Information security properties           | Cybersecurity concepts | Operational capabilities     | Security domains |
| ---------------------- | ----------------------------------------- | ---------------------- | ---------------------------- | ---------------- |
| #Preventive #Detective | #Confidentiality #Integrity #Availability | #Protect #Detect       | #System_and_network_security | #Protection      |

**Control**
Networks and network devices should be secured, managed and controlled to protect information in systems and applications.

**Purpose**
To protect information in networks and its supporting information processing facilities from compromise via the network.

**Guidance**
Controls should be implemented to ensure the security of information in networks and to protect connected services from unauthorized access. In particular, the following items should be considered:

a\) the type and classification level of information that the network can support;

b\) establishing responsibilities and procedures for the management of networking equipment and devices;

c\) maintaining up to date documentation including network diagrams and configuration files of devices (e.g. routers, switches);

d\) separating operational responsibility for networks from ICT system operations where appropriate (see [5.3](a-5.3-Segregation-of-duties.md));

e\) establishing controls to safeguard the confidentiality and integrity of data passing over public networks, third-party networks or over wireless networks and to protect the connected systems and applications (see >5.22>, >8.24>, >5.14and >6.6>). Additional controls can also be required to maintain the availability of the network services and computers connected to the network;

f\) appropriately logging and monitoring to enable recording and detection of actions that can affect, or are relevant to, information security (see >8.16and >8.15>);

g\) closely coordinating network management activities both to optimize the service to the organization and to ensure that controls are consistently applied across the information processing infrastructure;

h\) authenticating systems on the network;

i\) restricting and filtering systems connection to the network (e.g. using firewalls);

j\) detecting, restricting and authenticating the connection of equipment and devices to the network;

k\) hardening of network devices;

l\) segregating network administration channels from other network traffic;

m\) temporarily isolating critical subnetworks (e.g. with drawbridges) if the network is under attack;

n\) disabling vulnerable network protocols.

The organization should ensure that appropriate security controls are applied to the use of virtualized networks. Virtualized networks also cover software-defined networking (SDN, SD-WAN). Virtualized networks can be desirable from a security viewpoint, since they can permit logical separation of communication taking place over physical networks, particularly for systems and applications that are implemented using distributed computing.

**Other information**
Additional information on network security can be found in the ISO/IEC 27033 series. More information concerning virtualized networks can be found in ISO/IEC TS 23167.