{"id":3605,"date":"2020-01-23T12:31:44","date_gmt":"2020-01-23T12:31:44","guid":{"rendered":"https:\/\/nissa.gov.ly\/%d8%b3%d9%8a%d8%a7%d8%b3%d8%a9-%d8%ad%d9%85%d8%a7%d9%8a%d8%a9-%d8%a7%d9%84%d8%b4%d8%a8%d9%83%d8%a7%d8%aa\/"},"modified":"2020-04-19T20:40:17","modified_gmt":"2020-04-19T20:40:17","slug":"network-security-policies","status":"publish","type":"page","link":"https:\/\/nissa.gov.ly\/en\/main-services\/network-security-policies\/","title":{"rendered":"Network Security Policy"},"content":{"rendered":"
\n

\"\"<\/p>\n

You can National Information Security & Safety Authority policies as pdf by clicking on this link<\/h6>\n

download<\/span><\/a><\/p>\n<\/div>\n

Router and Switch Security Policy<\/b><\/h3>\n
    \n
  • \n

    Introduction<\/h4>\n
    \n

    Routers and smart switches provide important security functions within a network. Configured correctly, they are one of several hardware and software devices available that help manage and protect a private network from a public one. The Router and Switch Security Policy defines configuration requirements to meet security standards, change management requirements, and operational requirements.<\/span><\/p>\n<\/div>\n<\/li>\n

  • \n

    Purpose<\/h4>\n
    \n

    This document designed to protect the equipment and data of the <\/span>(organization)<\/b> and its business partners or any data the <\/span>(organization)<\/b> is in custody of by defining the minimum configuration standards for all routers and switches connecting to the organizational network.<\/span><\/p>\n<\/div>\n<\/li>\n

  • \n

    Scope<\/h4>\n
    \n

    All employees, contractors, consultants, temporary and other workers who use network devices such as Router and\/or switch must adhere to this policy. All routers and switches connected to networks are affected.<\/span><\/p>\n<\/div>\n<\/li>\n

  • \n

    Policy<\/h4>\n
    \n

    Every router\/switch must meet the following configuration standards<\/span>:\u00a0<\/span><\/p>\n

      \n
    1. No local user accounts are configured on the router or switch. Routers and switches must use a dedicated AAA server (e.g. TACACS+) for all user authentication.<\/span><\/li>\n
    2. The enable secret must be used instead of enable password.<\/span><\/li>\n
    3. The enable secret on the router or switch must be kept in a secure encrypted form.\u00a0<\/span><\/li>\n
    4. The following services or features must be disabled: <\/span><\/li>\n<\/ol>\n
        \n
      • IP directed broadcasts (Enable IP directed broadcast when you want to perform remote management or administration services such as backups on hosts in a subnet that does not have a direct connection to the Internet).<\/span><\/li>\n
      • Incoming packets at the router\/switch sourced with invalid addresses such as RFC1918 addresses.<\/span><\/li>\n
      • TCP small services\u00a0<\/span><\/li>\n
      • UDP small services\u00a0<\/span><\/li>\n
      • All web services running on router<\/span><\/li>\n
      • Auto-configuration.<\/span><\/li>\n
      • Layer 2 device discovery protocol (e.g. CDP and LLDP) and other discovery protocols.<\/span><\/li>\n<\/ul>\n

        5. Routers and switches and\/or interfaces should disallow the following: <\/span>
        <\/span><\/p>\n

          \n
        • Proxy-ARP.<\/span><\/li>\n
        • ICMP unreachable messages.\u00a0<\/span><\/li>\n
        • Fast switching and autonomous switching.\u00a0<\/span><\/li>\n
        • Multicast route caching.<\/span><\/li>\n
        • Maintenance Operation Protocol (MOP).<\/span><\/li>\n<\/ul>\n

          6. The following services must be configured:<\/span>
          <\/span><\/p>\n

            \n
          • Password-encryption<\/span><\/li>\n
          • Time syncing (NTP). All network clocks should be synced to a common time source.<\/span><\/li>\n<\/ul>\n

            7. All routing updates shall be done using secure routing updates.<\/span><\/p>\n

            8. Use (<\/span>organization<\/b>) standardized SNMP community strings.\u00a0 Default strings, such as public or private must be removed.\u00a0 SNMP must be configured to use the most secure version of the protocol allowed for by the combination of the device and management systems.<\/span><\/p>\n

            9. Access control lists must be used to limit the source and type of traffic that can terminate on the device itself.<\/span><\/p>\n

            10. Each router must have a Login banners that useful to inform potential users that use of the login is only for authorized users. the following statement presented for all forms of login whether remote or local:\u00a0<\/span><\/p>\n

            “UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS PROHIBITED.<\/span><\/p>\n

            You must have explicit permission to access or configure this device. All activities performed on this device may be logged, and violations of this policy may result in disciplinary action in accordance with regulation in force. There is no right to privacy on this device. Use of this system shall constitute consent to monitoring.”<\/span><\/p>\n

            \u00a0<\/p>\n

            11. Telnet may never be used across any network to manage a router, unless there is a secure tunnel protecting the entire communication path. SSH version 2 is the preferred management protocol.<\/span><\/p>\n

            12. Routers and switches should be placed in a location where physical access is limited to authorized persons only.<\/span><\/p>\n

            13. The switch should disable a port or group of ports if new or unregistered MAC addresses appear on a port if the feature is available.<\/span><\/p>\n

            14. The\u00a0 switch\u00a0 should generate\u00a0 an SNMP trap if the\u00a0 link drops and is re-established\u00a0 if the feature is available<\/span><\/p>\n

            15. Dynamic routing protocols must use authentication in routing updates sent to neighbors.\u00a0 (<\/span>Password hashing for the authentication string must be enabled when supported<\/i><\/b>).<\/span><\/p>\n

            16. The (<\/span>organization<\/b>) router configuration standard will define the category of sensitive routing and switching devices, and require additional services or configuration on sensitive devices including:<\/span><\/p>\n

              \n
            • IP access list accounting<\/span><\/li>\n
            • Device logging<\/span><\/li>\n
            • Incoming packets at the router sourced with invalid addresses, such as RFC1918 addresses, or those that could be used to spoof network traffic shall be dropped.<\/span><\/li>\n<\/ul>\n

              17. Network configurations and changes must be documented regularly to understand its structure. Network documentation should include:\u00a0<\/span><\/p>\n

                \n
              • \u00a0Network diagram\u00a0<\/span><\/li>\n
              • \u00a0System configurations\u00a0<\/span><\/li>\n
              • \u00a0Firewall rule set\u00a0<\/span><\/li>\n
              • \u00a0IP Addresses<\/span><\/li>\n
              • Access Control Lists<\/span><\/li>\n<\/ul>\n
                  \n
                • \u00a0<\/li>\n<\/ul>\n<\/div>\n<\/li>\n<\/ul>\n

                  Wireless Communication Policy<\/b><\/h2>\n
                    \n
                  • \n

                    Introduction<\/h3>\n
                    \n

                    With the mass explosion of Smart Phones and Tablets, pervasive wireless connectivity is almost a given at any organization. Insecure wireless configuration can provide an easy open door for malicious threat actors.\u00a0<\/span><\/p>\n

                    A Wireless Communication Policy is necessary for computer security since there is demand for wireless equipment in every (<\/span>organization<\/b>) today. The Wireless Communication Policy may specify that no wireless equipment should be used but this would not be very good since that may cause some departments or individuals to violate the policy. It is best to set conditions and specify equipment that is approved for wireless use in order to minimize security risk associated with wireless.<\/span><\/p>\n<\/div>\n<\/li>\n

                  • \n

                    Purpose<\/h3>\n
                    \n

                    The purpose of this policy is to secure and protect the information assets owned by <\/span>(Organization)<\/b>. <\/span>(Organization)<\/b> grants access to these resources as a privilege and must manage them responsibly to maintain the confidentiality, integrity, and availability of all information assets.<\/span><\/p>\n

                    This policy specifies the conditions that wireless infrastructure devices must satisfy to connect to <\/span>(Organization)<\/b> network. Only <\/span>those<\/b> wireless infrastructure devices that meet the standards <\/span>specified in<\/b>\u00a0this policy, or that granted an exception by the Information Security Department are approved for connectivity to a <\/span>(Organization)<\/b> network.<\/span><\/p>\n<\/div>\n<\/li>\n

                  • \n

                    Scope<\/h3>\n
                    \n

                    This policy applies to all wireless infrastructure devices that connect to a <\/span>(Organization)<\/b> network or reside on a <\/span>(Organization)<\/b> site that provide wireless connectivity to endpoint devices including, but not limited to, laptops, desktops, cellular phones, and tablets. This includes any form of wireless communication device capable of transmitting packet data .Therefore, all employees, contractors, consultants, temporary and other workers at <\/span>(Organization)<\/b>, including all personnel affiliated with third parties that maintain a wireless infrastructure device on behalf of <\/span>(Organization)<\/b> must adhere to this policy.<\/span><\/p>\n<\/div>\n<\/li>\n

                  • \n

                    Policy<\/h3>\n
                    \n

                    All wireless infrastructure devices that reside at a <\/span>(Organization)<\/b> site and connect to a (Organization) network, or provide access to information classified as <\/span>(Organization)<\/b> Confidential, or above must:\u00a0<\/span><\/p>\n

                      \n
                    • Abide by the standards specified in the Wireless Communication Standard.\u00a0<\/span><\/li>\n
                    • Use <\/span>(Organization)<\/b> approved authentication protocols and infrastructure.<\/span><\/li>\n
                    • Use <\/span>(Organization)<\/b> approved encryption protocols.<\/span><\/li>\n
                    • Maintain a hardware address (MAC address) that can be registered and tracked.\u00a0<\/span><\/li>\n<\/ul>\n

                      To stop the possible abuse of wireless network:<\/span><\/p>\n

                        \n
                      • There should be proper user authentication ensured along with the appropriate replacement of WEP and anomaly tracking mechanism on wireless LAN.\u00a0<\/span><\/li>\n
                      • At the same time, there is the following list of suspicious events on wireless LAN which should always consider for intrusion detection as;<\/span><\/li>\n<\/ul>\n
                          \n
                        • Beacon frames from unsolicited access point<\/span><\/li>\n
                        • Flood of unauthenticated frames (MITM attack)<\/span><\/li>\n
                        • Frames with duplicated MAC address.<\/span><\/li>\n
                        • Randomly changing MAC address<\/span><\/li>\n<\/ul>\n

                          Wireless encryption protocols\u00a0<\/span><\/p>\n

                            \n
                          • WAP2 (Wi-Fi Protected Access version 2) is preferred as a wireless encryption protocol instead of WEP (Wired Equivalent Privacy) and WAP (Wi-Fi Protected Access\u00a0), because WAP2 It offered a much stronger security algorithm and advanced level encryption with message authenticity and integrity validation while WEP\u00a0and\u00a0WPA\u00a0protocols are considered vulnerable.<\/span><\/li>\n<\/ul>\n

                            Network configurations and changes must be documented regularly to understand its structure. Network documentation should include:\u00a0<\/span><\/p>\n

                              \n
                            • Network diagram\u00a0<\/span><\/li>\n
                            • System configurations\u00a0<\/span><\/li>\n
                            • \u00a0Firewall rule set\u00a0<\/span><\/li>\n
                            • \u00a0IP Addresses<\/span><\/li>\n
                            • Access Control Lists<\/span><\/li>\n<\/ul>\n<\/div>\n<\/li>\n<\/ul>\n

                              Virtual Private Network (VPN) Policy<\/b><\/h2>\n
                                \n
                              • \n

                                Introduction<\/h3>\n
                                \n

                                A Virtual Private Network (VPN) is a secured private network connection that provide a convenient way to access internal network resources remotely over the public network (Internet). VPN offers secure access by providing a means to protect data while it travels over an untrusted network. <\/span><\/p>\n<\/div>\n<\/li>\n

                              • \n

                                Purpose<\/h3>\n
                                \n

                                The purpose of this policy is to provide guidelines for Remote Access IPsec or L2TP Virtual Private Network (VPN) connections to the <\/span>(Organization)<\/b> corporate network.\u00a0 <\/span><\/p>\n<\/div>\n<\/li>\n

                              • \n

                                Scope<\/h3>\n
                                \n

                                This policy applies to all <\/span>(Organization)<\/b> employees, contractors, consultants, temporaries, and other workers including all personnel affiliated with third parties utilizing VPNs to access the <\/span>(Organization)<\/b> network. This policy applies to implementations of VPN that are directed through an IPsec Concentrator. <\/span><\/p>\n<\/div>\n<\/li>\n

                              • \n

                                Policy<\/h3>\n
                                \n
                                  \n
                                1. It is the responsibility of employees with VPN privileges to ensure that unauthorized users are not allowed access to <\/span>(Organization)<\/b> internal networks through their VPN connection.\u00a0<\/span><\/li>\n
                                2. VPN use is to be controlled using either a one-time password authentication such as a token device or a public\/private key system with a strong passphrase.\u00a0<\/span><\/li>\n
                                3. When actively connected to the corporate network, VPNs will force all traffic to and from the PC used by the remote user over the VPN tunnel: all other traffic will be dropped.\u00a0<\/span><\/li>\n
                                4. Dual (split) tunneling is NOT permitted; only one network connection is allowed.\u00a0 [<\/span>Dual (split) tunneling allows two simultaneous, active connections to a secure network (via VPN) and a non-secure network, without having to disconnect the VPN connection. This security vulnerability allows a direct connection from the non-secured Internet to the VPN secured network.<\/span><\/i>]<\/span><\/li>\n
                                5. VPN gateways will be set up and managed by <\/span>(Organization)<\/b> network operational groups.\u00a0<\/span><\/li>\n
                                6. All computers connected to <\/span>(Organization)<\/b> internal networks via VPN or any other technology must use the most up-to-date anti-virus software that is the corporate standard (provide URL to this software); this includes <\/span>personal computers.\u00a0<\/span><\/li>\n
                                7. VPN users will be automatically disconnected from <\/span>(Organization)<\/b>‘s network after thirty minutes of inactivity. The user must then logon again to reconnect to the network. <\/span>(Pings or other artificial network processes are not to be used to keep the connection open.)\u00a0<\/span><\/i><\/li>\n
                                8. The VPN concentrator must be limited to an absolute connection time of 24 hours.\u00a0<\/span><\/li>\n
                                9. Users of computers that are not <\/span>(Organization)<\/b>-owned equipment must configure the equipment to comply with <\/span>(Organization)<\/b>‘s VPN and Network policies.\u00a0<\/span><\/li>\n
                                10. By using VPN technology with personal equipment, users must understand that their machines are a de facto extension of <\/span>(Organization)<\/b>‘s network, and as such are subject to the same rules and regulations that apply to <\/span>(Organization)<\/b>-owned equipment.<\/span><\/li>\n
                                11. Network configurations and changes must be documented regularly to understand its structure. Network documentation should include:\u00a0<\/span><\/li>\n<\/ol>\n
                                    \n
                                  • \n
                                      \n
                                    • \u00a0Network diagram\u00a0<\/span><\/li>\n
                                    • \u00a0System configurations\u00a0<\/span><\/li>\n
                                    • \u00a0Firewall rule set\u00a0<\/span><\/li>\n
                                    • \u00a0IP Addresses<\/span><\/li>\n
                                    • Access Control Lists<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n<\/li>\n<\/ul>\n

                                      Firewall Policy<\/b><\/h2>\n
                                        \n
                                      • \n

                                        Introduction<\/h3>\n
                                        \n

                                        When a user connects to an insecure, open network, such as the Internet, he opens a large doorway for potential attacks. One of the best ways to defense against exploitation from the insecure network is to employ firewalls at the connection point end, as it is a necessity to safeguard the<\/span> (Organization)<\/b>\u2019s private networks and communication facilities. <\/span><\/p>\n<\/div>\n<\/li>\n

                                      • \n

                                        Purpose<\/h3>\n
                                        \n

                                        Firewalls are defined as security systems that control and restrict network connectivity and network services. Firewalls establish a control point where access controls may be enforced. This document seeks to assist <\/span>(Organization)<\/b> in understanding the capabilities of firewall technologies and firewall policies.<\/span><\/p>\n<\/div>\n<\/li>\n

                                      • \n

                                        Scope<\/h3>\n
                                        \n

                                        This policy defines the essential rules regarding the management and maintenance of firewalls, and it applies to all firewalls owned, rented, leased, or otherwise controlled by <\/span>(Organization)<\/b>.<\/span><\/p>\n<\/div>\n<\/li>\n

                                      • \n
                                        \n
                                          \n
                                        1. Review the rulesets to ensure that they follow the order as follows:<\/span><\/li>\n<\/ol>\n
                                            \n
                                          • \n
                                              \n
                                            • anti-spoofing filters (blocked private addresses, internal addresses appearing from the outside)<\/span><\/li>\n
                                            • User permit rules (e.g. allow HTTP to public webserver)<\/span><\/li>\n
                                            • Management permit rules (e.g. SNMP traps to network management server)<\/span><\/li>\n
                                            • Deny and Alert (alert systems administrator about traffic that is suspicious)<\/span><\/li>\n
                                            • Deny and log (log remaining traffic for analysis)<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                \n
                                              1. \u00a0Application based firewall:<\/span><\/li>\n<\/ol>\n
                                                  \n
                                                • \n
                                                    \n
                                                  • In the case of dedicated server access, an <\/span>application proxy firewall<\/b> must be placed between the remote user and dedicated server to hide the identity of the server.<\/span><\/li>\n
                                                  • Ensure that the administrators monitor any attempts to violate the security policy using the audit logs generated by the application level firewall.<\/span><\/li>\n
                                                  • Ensure that there is a process to update the application level firewall\u2019s vulnerabilities checked to the most current vulnerabilities.<\/span><\/li>\n
                                                  • Ensure that there is a process to update the software with the latest attack signatures.<\/span><\/li>\n
                                                  • In the event of the signatures being downloaded from the vendors\u2019 site, ensure that it is a trusted site.<\/span><\/li>\n
                                                  • In the event of the signature being e-mailed to the systems administrator, ensure that digital signatures are used to verify the vendor and that the information transmitted has not been modified en-route.<\/span><\/li>\n
                                                  • The following commands should be blocked for SMTP at the application level firewall:<\/span>\n
                                                      \n
                                                    • EXPN (expand)<\/span><\/li>\n
                                                    • VRFY (verify)<\/span><\/li>\n
                                                    • DEBUG<\/span><\/li>\n
                                                    • WIZARD<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                        \n
                                                      • \n
                                                          \n
                                                        • The following command should be blocked for FTP:<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                            \n
                                                          • \n
                                                              \n
                                                            • \n
                                                                \n
                                                              • PUT<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                                  \n
                                                                • \n
                                                                    \n
                                                                  • Review the denied URL\u2019s and ensure that they are appropriate for e.g. any URL\u2019s to hacker sites should be blocked.\u00a0<\/span><\/li>\n
                                                                  • Ensure that only authorized users are authenticated by the application level firewall.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                                      \n
                                                                    1. Stateful inspection<\/span><\/li>\n<\/ol>\n
                                                                        \n
                                                                      • \n
                                                                          \n
                                                                        • Review the state tables to ensure that appropriate rules are set up in terms of source and destination IP\u2019s, source and destination ports and timeouts.<\/span><\/li>\n
                                                                        • Ensure that the timeouts are appropriate so as not to give the hacker too much time to launch a successful attack.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

                                                                          For URL\u2019s<\/span><\/p>\n

                                                                            \n
                                                                          • \n
                                                                              \n
                                                                            • If a URL filtering server is used, ensure that it is appropriately defined in the firewall software. (If the filtering server is external to the (<\/span>Organization<\/b>) ensure that it is a trusted source).<\/span><\/li>\n
                                                                            • If filtering on MAC addresses is allowed, review the filters to ensure that it is restricted to the appropriate MAC\u2019s at (<\/span>Organization<\/b>).<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                                                \n
                                                                              1. Logging<\/span><\/li>\n<\/ol>\n
                                                                                  \n
                                                                                • \n
                                                                                    \n
                                                                                  • Ensure that logging is enabled and that the logs are reviewed to identify any potential patterns that could indicate an attack.<\/span><\/li>\n
                                                                                  • Network Firewall administration logs (administrative activities) and event logs (traffic activity) should:<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                                                      \n
                                                                                    • \n
                                                                                        \n
                                                                                      • Be written to alternate storage (not on the same device)\u00a0<\/span><\/li>\n
                                                                                      • Be reviewed at least daily, with logs retained for ninety (90) days.\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                                                          \n
                                                                                        1. Patches and updates<\/span><\/li>\n<\/ol>\n
                                                                                            \n
                                                                                          • \n
                                                                                              \n
                                                                                            • Ensure that the latest patches and updates relating to your firewall product is tested and installed.<\/span><\/li>\n
                                                                                            • If patches and updates are automatically downloaded from the vendors\u2019 websites, ensure that the update is received from a trusted site.<\/span><\/li>\n
                                                                                            • In the event that patches and updates are e-mailed to the systems administrator ensure that digital signatures are used to verify the vendor and ensure that the information has not been modified en-route.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                                                                \n
                                                                                              1. Vulnerability assessments\/ Testing<\/span><\/li>\n<\/ol>\n
                                                                                                  \n
                                                                                                • \n
                                                                                                    \n
                                                                                                  • Ascertain if there is a procedure to test for open ports using (NMAP) and whether unnecessary ports are closed.<\/span><\/li>\n
                                                                                                  • Ensure that there is a procedure to test the rulesets when established or changed so as not to create a denial of service on the (<\/span>organization<\/b>) or allow any weaknesses to continue undetected.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                                                                      \n
                                                                                                    1. \n
                                                                                                        \n
                                                                                                      1. Compliance with security policy<\/span><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n
                                                                                                          \n
                                                                                                        • \n
                                                                                                            \n
                                                                                                          • Ensure that the ruleset complies with the (<\/span>organization<\/b>) security policy.<\/span><\/li>\n
                                                                                                          • \u00a0Ensure that the following spoofed, private (RFC 1918) and illegal addresses are blocked:<\/span><\/li>\n<\/ul>\n<\/li>\n
                                                                                                          • Private (RFC 1918) addresses<\/b><\/li>\n<\/ul>\n

                                                                                                            10.0.0.0 \u2013 10.255.255.255<\/span><\/p>\n

                                                                                                            172.16.0.0 \u2013 172.31.255.255<\/span><\/p>\n

                                                                                                            192.168.0.0 – 192.168.255.255<\/span><\/p>\n

                                                                                                              \n
                                                                                                            • Reserved addresses<\/b><\/li>\n<\/ul>\n

                                                                                                              240.0.0.0<\/span><\/p>\n

                                                                                                                \n
                                                                                                              • Illegal addresses<\/b>\n
                                                                                                                  \n
                                                                                                                • \n
                                                                                                                    \n
                                                                                                                  • <\/b>\n

                                                                                                                    0.0.0.0<\/span><\/p>\n

                                                                                                                      \n
                                                                                                                    • UDP echo<\/span><\/li>\n
                                                                                                                    • ICMP broadcast (RFC 2644)<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                                                                                        \n
                                                                                                                      1. Remote access<\/span><\/li>\n<\/ol>\n
                                                                                                                          \n
                                                                                                                        • If remote access is to be used, ensure that the SSH protocol (port 22) is used instead of Telnet.<\/span><\/li>\n<\/ul>\n
                                                                                                                            \n
                                                                                                                          1. \u00a0File Transfers<\/span><\/li>\n<\/ol>\n
                                                                                                                              \n
                                                                                                                            • If FTP is a requirement, ensure that the server, which supports FTP, is placed in a different subnet than the internal protected network.<\/span><\/li>\n<\/ul>\n
                                                                                                                                \n
                                                                                                                              1. Mail Traffic<\/span><\/li>\n<\/ol>\n
                                                                                                                                  \n
                                                                                                                                • Ascertain which protocol is used for mail and ensure that there is a rule to block incoming mail traffic except to internal mail.<\/span><\/li>\n<\/ul>\n
                                                                                                                                    \n
                                                                                                                                  1. Block Unwanted ICMP Traffic (ICMP 8, 11, 3)<\/span><\/li>\n<\/ol>\n
                                                                                                                                      \n
                                                                                                                                    • Ensure that there is a rule blocking ICMP echo requests and replies.<\/span><\/li>\n
                                                                                                                                    • Ensure that there is a rule blocking outgoing time exceeded and unreachable messages.<\/span><\/li>\n<\/ul>\n
                                                                                                                                        \n
                                                                                                                                      1. Critical servers<\/span><\/li>\n<\/ol>\n
                                                                                                                                          \n
                                                                                                                                        • Ensure that there is a deny rule for traffic destined to critical internal addresses from external sources. This rule is based on the organizational requirements, since some <\/span>(organizations)<\/b> may allow traffic via a web application to be routed via a DMZ.<\/span><\/li>\n<\/ul>\n
                                                                                                                                            \n
                                                                                                                                          1. Personal firewalls<\/span><\/li>\n<\/ol>\n
                                                                                                                                              \n
                                                                                                                                            • Ensure that laptop users are given appropriate training regarding the threats, types of elements blocked by the firewall and guidelines for operation of the personal firewall. This element is essential, since often times personal firewalls rely on user prompt to respond to attacks e.g. whether to accept\/deny a request from a specific address.<\/span><\/li>\n
                                                                                                                                            • Review the security settings of the personal firewall to ensure that it restricts access to specific ports, protects against known attacks, and that there is adequate logging and user alerts in the event of an intrusion.<\/span><\/li>\n
                                                                                                                                            • Ensure that there is a procedure to update the software for any new attacks that become known.<\/span><\/li>\n<\/ul>\n

                                                                                                                                              Alternatively, most tools provide the option of transferring automatic updates via the internet. In such instances ensure that updates are received from trusted sites.<\/span><\/p>\n

                                                                                                                                                \n
                                                                                                                                              1. Distributed firewalls<\/span><\/li>\n<\/ol>\n
                                                                                                                                                  \n
                                                                                                                                                • Ensure that the security policy is consistently distributed to all hosts especially when there are changes to the policy.<\/span><\/li>\n
                                                                                                                                                • Ensure that there are adequate controls to ensure the integrity of the policy during transfer, e.g. IPsec to encrypt the policy when in transfer.<\/span><\/li>\n
                                                                                                                                                • Ensure that there are adequate controls to authenticate the appropriate host.<\/span><\/li>\n<\/ul>\n

                                                                                                                                                  Again IPsec can be used for authentication with cryptographic certificates.<\/span><\/p>\n

                                                                                                                                                    \n
                                                                                                                                                  1. Continued availability of Firewalls<\/span><\/li>\n<\/ol>\n
                                                                                                                                                      \n
                                                                                                                                                    • Ensure that there is a hot standby for the primary firewall<\/span><\/li>\n<\/ul>\n
                                                                                                                                                        \n
                                                                                                                                                      1. Network configurations and changes must be documented regularly to understand its structure. Network documentation should include:\u00a0<\/span><\/li>\n<\/ol>\n
                                                                                                                                                          \n
                                                                                                                                                        • \u00a0Network diagram\u00a0<\/span><\/li>\n
                                                                                                                                                        • \u00a0System configurations\u00a0<\/span><\/li>\n
                                                                                                                                                        • \u00a0Firewall rule set\u00a0<\/span><\/li>\n
                                                                                                                                                        • \u00a0IP Addresses<\/span><\/li>\n
                                                                                                                                                        • Access Control Lists<\/span><\/li>\n<\/ul>\n<\/div>\n<\/li>\n<\/ul>\n
                                                                                                                                                          \n

                                                                                                                                                          \n<\/div>\n

                                                                                                                                                          <\/p>\n","protected":false},"excerpt":{"rendered":"

                                                                                                                                                          You can National Information Security & Safety Authority policies as pdf by clicking on this link download Router and Switch Security Policy Introduction Routers and smart switches provide important security functions within a network. Configured correctly, they are one of several hardware and software devices available that help manage and protect a private network from […]<\/p>\n","protected":false},"author":1,"featured_media":3574,"parent":3668,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-3605","page","type-page","status-publish","has-post-thumbnail","hentry"],"acf":[],"yoast_head":"\nNetwork Security Policy - \u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nissa.gov.ly\/en\/main-services\/network-security-policies\/\" \/>\n<meta property=\"og:locale\" content=\"ar_AR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Network Security Policy - \u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a\" \/>\n<meta property=\"og:description\" content=\"You can National Information Security & Safety Authority policies as pdf by clicking on this link download Router and Switch Security Policy Introduction Routers and smart switches provide important security functions within a network. Configured correctly, they are one of several hardware and software devices available that help manage and protect a private network from […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nissa.gov.ly\/en\/main-services\/network-security-policies\/\" \/>\n<meta property=\"og:site_name\" content=\"\u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a\" \/>\n<meta property=\"article:modified_time\" content=\"2020-04-19T20:40:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nissa.gov.ly\/gavedug\/placeholder.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1153\" \/>\n\t<meta property=\"og:image:height\" content=\"645\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631\" \/>\n\t<meta name=\"twitter:data1\" content=\"14 \u062f\u0642\u064a\u0642\u0629\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nissa.gov.ly\\\/en\\\/main-services\\\/network-security-policies\\\/\",\"url\":\"https:\\\/\\\/nissa.gov.ly\\\/en\\\/main-services\\\/network-security-policies\\\/\",\"name\":\"Network Security Policy - \u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nissa.gov.ly\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nissa.gov.ly\\\/en\\\/main-services\\\/network-security-policies\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nissa.gov.ly\\\/en\\\/main-services\\\/network-security-policies\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nissa.gov.ly\\\/wp-content\\\/uploads\\\/placeholder.png\",\"datePublished\":\"2020-01-23T12:31:44+00:00\",\"dateModified\":\"2020-04-19T20:40:17+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nissa.gov.ly\\\/en\\\/main-services\\\/network-security-policies\\\/#breadcrumb\"},\"inLanguage\":\"ar\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nissa.gov.ly\\\/en\\\/main-services\\\/network-security-policies\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"ar\",\"@id\":\"https:\\\/\\\/nissa.gov.ly\\\/en\\\/main-services\\\/network-security-policies\\\/#primaryimage\",\"url\":\"https:\\\/\\\/nissa.gov.ly\\\/wp-content\\\/uploads\\\/placeholder.png\",\"contentUrl\":\"https:\\\/\\\/nissa.gov.ly\\\/wp-content\\\/uploads\\\/placeholder.png\",\"width\":1153,\"height\":645},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nissa.gov.ly\\\/en\\\/main-services\\\/network-security-policies\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nissa.gov.ly\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Main services\",\"item\":\"https:\\\/\\\/nissa.gov.ly\\\/en\\\/main-services\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Network Security Policy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nissa.gov.ly\\\/#website\",\"url\":\"https:\\\/\\\/nissa.gov.ly\\\/\",\"name\":\"\u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/nissa.gov.ly\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nissa.gov.ly\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ar\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/nissa.gov.ly\\\/#organization\",\"name\":\"\u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a\",\"url\":\"https:\\\/\\\/nissa.gov.ly\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ar\",\"@id\":\"https:\\\/\\\/nissa.gov.ly\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/nissa.gov.ly\\\/wp-content\\\/uploads\\\/apple-touch-icon.png\",\"contentUrl\":\"https:\\\/\\\/nissa.gov.ly\\\/wp-content\\\/uploads\\\/apple-touch-icon.png\",\"width\":180,\"height\":180,\"caption\":\"\u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a\"},\"image\":{\"@id\":\"https:\\\/\\\/nissa.gov.ly\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Network Security Policy - \u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nissa.gov.ly\/en\/main-services\/network-security-policies\/","og_locale":"ar_AR","og_type":"article","og_title":"Network Security Policy - \u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a","og_description":"You can National Information Security & Safety Authority policies as pdf by clicking on this link download Router and Switch Security Policy Introduction Routers and smart switches provide important security functions within a network. Configured correctly, they are one of several hardware and software devices available that help manage and protect a private network from […]","og_url":"https:\/\/nissa.gov.ly\/en\/main-services\/network-security-policies\/","og_site_name":"\u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a","article_modified_time":"2020-04-19T20:40:17+00:00","og_image":[{"width":1153,"height":645,"url":"https:\/\/nissa.gov.ly\/gavedug\/placeholder.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631":"14 \u062f\u0642\u064a\u0642\u0629"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/nissa.gov.ly\/en\/main-services\/network-security-policies\/","url":"https:\/\/nissa.gov.ly\/en\/main-services\/network-security-policies\/","name":"Network Security Policy - \u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a","isPartOf":{"@id":"https:\/\/nissa.gov.ly\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nissa.gov.ly\/en\/main-services\/network-security-policies\/#primaryimage"},"image":{"@id":"https:\/\/nissa.gov.ly\/en\/main-services\/network-security-policies\/#primaryimage"},"thumbnailUrl":"https:\/\/nissa.gov.ly\/gavedug\/placeholder.png","datePublished":"2020-01-23T12:31:44+00:00","dateModified":"2020-04-19T20:40:17+00:00","breadcrumb":{"@id":"https:\/\/nissa.gov.ly\/en\/main-services\/network-security-policies\/#breadcrumb"},"inLanguage":"ar","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nissa.gov.ly\/en\/main-services\/network-security-policies\/"]}]},{"@type":"ImageObject","inLanguage":"ar","@id":"https:\/\/nissa.gov.ly\/en\/main-services\/network-security-policies\/#primaryimage","url":"https:\/\/nissa.gov.ly\/gavedug\/placeholder.png","contentUrl":"https:\/\/nissa.gov.ly\/gavedug\/placeholder.png","width":1153,"height":645},{"@type":"BreadcrumbList","@id":"https:\/\/nissa.gov.ly\/en\/main-services\/network-security-policies\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nissa.gov.ly\/"},{"@type":"ListItem","position":2,"name":"Main services","item":"https:\/\/nissa.gov.ly\/en\/main-services\/"},{"@type":"ListItem","position":3,"name":"Network Security Policy"}]},{"@type":"WebSite","@id":"https:\/\/nissa.gov.ly\/#website","url":"https:\/\/nissa.gov.ly\/","name":"\u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a","description":"","publisher":{"@id":"https:\/\/nissa.gov.ly\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nissa.gov.ly\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ar"},{"@type":"Organization","@id":"https:\/\/nissa.gov.ly\/#organization","name":"\u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a","url":"https:\/\/nissa.gov.ly\/","logo":{"@type":"ImageObject","inLanguage":"ar","@id":"https:\/\/nissa.gov.ly\/#\/schema\/logo\/image\/","url":"https:\/\/nissa.gov.ly\/gavedug\/apple-touch-icon.png","contentUrl":"https:\/\/nissa.gov.ly\/gavedug\/apple-touch-icon.png","width":180,"height":180,"caption":"\u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0623\u0645\u0646 \u0648\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0645\u0639\u0644\u0648\u0645\u0627\u062a"},"image":{"@id":"https:\/\/nissa.gov.ly\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/nissa.gov.ly\/batisur\/wp\/v2\/pages\/3605","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nissa.gov.ly\/batisur\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/nissa.gov.ly\/batisur\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/nissa.gov.ly\/batisur\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nissa.gov.ly\/batisur\/wp\/v2\/comments?post=3605"}],"version-history":[{"count":0,"href":"https:\/\/nissa.gov.ly\/batisur\/wp\/v2\/pages\/3605\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/nissa.gov.ly\/batisur\/wp\/v2\/pages\/3668"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nissa.gov.ly\/batisur\/wp\/v2\/media\/3574"}],"wp:attachment":[{"href":"https:\/\/nissa.gov.ly\/batisur\/wp\/v2\/media?parent=3605"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}