  

## 8.21 Security of network services

| Control type | Information security properties           | Cybersecurity concepts | Operational capabilities     | Security domains |
| ------------ | ----------------------------------------- | ---------------------- | ---------------------------- | ---------------- |
| #Preventive  | #Confidentiality #Integrity #Availability | #Protect               | #System_and_network_security | #Protection      |

**Control**
Security mechanisms, service levels and service requirements of network services should be identified, implemented and monitored.

**Purpose**
To ensure security in the use of network services.

**Guidance**
The security measures necessary for particular services, such as security features, service levels and service requirements, should be identified and implemented (by internal or external network service providers). The organization should ensure that network service providers implement these measures.

The ability of the network service provider to manage agreed services in a secure way should be determined and regularly monitored. The right to audit should be agreed between the organization and the provider. The organization should also consider third-party attestations provided by service providers to demonstrate they maintain appropriate security measures.

Rules on the use of networks and network services should be formulated and implemented to cover:

a\) the networks and network services which are allowed to be accessed;

b\) authentication requirements for accessing various network services;

c\) authorization procedures for determining who is allowed to access which networks and networked services;

d\) network management and technological controls and procedures to protect access to network connections and network services;

e\) the means used to access networks and network services \[e.g. use of virtual private network (VPN) or wireless network\];

f\) time, location and other attributes of the user at the time of the access;

g\) monitoring of the use of network services.

The following security features of network services should be considered:

a\) technology applied for security of network services, such as authentication, encryption and network connection controls;

b\) technical parameters required for secured connection with the network services in accordance with the security and network connection rules;

c\) caching (e.g. in a content delivery network) and its parameters that allow users to choose the use of caching in accordance with performance, availability and confidentiality requirements;

d\) procedures for the network service usage to restrict access to network services or applications, where necessary.

**Other information**
Network services include the provision of connections, private network services and managed network security solutions such as firewalls and intrusion detection systems. These services can range from simple unmanaged bandwidth to complex value-added offerings.

More guidance on a framework for access management is given in ISO/IEC 29146.