8-8-8564 Recovery Incident Response (IR) Post Mortem Checklist: After responding to a security incident or service outage, Service Providers and Network Operators should follow processes similar to those outlined in Appendix X to capture lessons learned and prevent future events. Cyber Security Critical X X X X X X X X X 8-8-8762 Recover from DoS Attack: Network Operators and Service Providers should work together to identify, filter, and isolate the originating points of Denial of Service (DoS) attacks when detected, and reroute legitimate traffic in order to restore normal service. Cyber Security Critical X X X X X X X X X
8-7-0425 Software Management: Network Operators and Service Providers should maintain software version deployment records, as appropriate. Network Reliability and Interoperability Highly Important X X X X X X X X X X X X X 8-7-0428 Software & Hardware Vulnerability Tracking: Service Providers should monitor software and hardware vulnerability reports and take the recommended action(s) to address problems, where appropriate. These reports and recommendations are typically provided by equipment suppliers and CERTs (Computer Emergency Response Teams). Network Reliability and Interoperability Highly Important X X X X X X X 8-7-0430 Software Configurations: Equipment Suppliers should be able to recreate supported software from source and, where feasible, software obtained from third parties. Network Reliability and Interoperability Highly Important X X
8-7-0498 Network Operators and Property Managers should consider alternative measures for cooling network equipment facilities (e.g., powering HVAC on generator, deploying mobile HVAC units) in the event of a power outage. Network Reliability and Interoperability Highly Important X X X X X X X X X X X X X 8-7-0504 Network Operators and Service Providers, in order to facilitate asset management and increase the likelihood of having usable spares in emergency restorations, should consider maintaining "hot spares" (circuit packs electronically plugged in and interfacing with any element management system, as opposed to being stored in a cabinet) for mission critical elements. Network Reliability and Interoperability Highly Important X X X X X X X X X X X 8-7-0513 Network Operators and Service Providers should maintain a "24 hours by 7 days" contact list of other providers and operators for service restoration of inter-connected networks. Where appropriate, this information should be shared with Public Safety Service and Support providers. Network Reliability and Interoperability Highly Important X X X X X X X X X 8-7-0530 Network Operators, Service Providers and Equipment Suppliers should participate in interoperability testing (including services), as appropriate, to maintain reliability across connected networks. Network Reliability and Interoperability Highly Important X X X X X X X X X X X X X
8-7-0532 Diversity Audit: Network Operators should periodically audit the physical and logical diversity called for by network design and take appropriate measures as needed. Network Reliability and Interoperability Highly Important X X X X X X X X X 8-7-0541 Network Operators, Service Providers and Equipment Suppliers should store multiple software versions for critical network elements and be able to fallback to an earlier version. Network Reliability and Interoperability Highly Important X X X X X X X X X X X X X 8-7-0547 Network Operators and Service Providers should place critical network databases (e.g., directory server, feature server, Service Control Point (SCP)) in a secure environment across distributed locations to provide service assurance (e.g., maintainability, connectivity, security, reliability) consistent with other critical network elements. Network Reliability and Interoperability Highly Important X X X X X X X
8-6-5194 Equipment Suppliers should design electronic hardware to minimize susceptibility to electrostatic discharge. Physical Security Highly Important X X X X X X X X X X X X X 8-6-5231 Network Operators, Service Providers, Equipment Suppliers and Property Managers should develop documentation for the restoration of power for areas of critical infrastructure including such things as contact information, escalation procedures, restoration steps and alternate means of communication. This documentation should be maintained both on-site and at centralized control centers. Physical Security Highly Important X X X X X X X X X X X 8-6-5248 Network Operators, Service Providers and Equipment Suppliers should perform risk assessment on significant network changes, both temporary and permanent, resulting from restoration efforts. Physical Security Highly Important X X X X X X X X X X X X X
8-6-5264 Satellite Operators should maintain an alternate recovery facility that would duplicate operations and Tracking, Telemetry, Control and Monitoring (TTC&M). The alternate recovery facility should be geographically diverse from the primary facility, maintained and tested on a regular schedule to ensure readiness and timely response. Physical Security Highly Important X X 8-7-5123 Network Operators should maintain and control access to accurate location information of critical network facilities in order to identify physical locations hosting critical infrastructure assets. Physical Security Highly Important X X X X X X X X X X X 8-7-5138 Network Operators should plan for the possibility that impacted network nodes cannot be accessed by company personnel for an extended period of time and define the corporate response for restoration of service. Physical Security Highly Important X X X X X X X X X 8-7-5139 Network Operators, Service Providers and Equipment Suppliers should consider establishing procedures for managing personnel who perform functions at disaster area sites. Physical Security Highly Important X X X X X X X
proprietary threat and vulnerability information (under NDA) that may precede public release of similar data. 8-8-8075 Identity Administration: Network Operators and Service Providers should have procedures for verifying identity of users to IT department and IT personnel to users (secret PINs, callback procedures, etc.). Cyber Security Important X X X X X X X X 8-8-8100 Training for Security Staff: Service Providers, Network Operators, and Equipment Suppliers should establish security training programs and requirements for ensuring security staff knowledge and compliance. This training could include professional certifications in cyber security. Cyber Security Important X X X X X X 8-8-8101 Document and Verify All Security Operational Procedures: Service Providers and Network Operators should ensure that all security operational procedures, system processes, and security controls are documented, and that documentation is up to date and accessible by appropriate staff. Perform gap analysis/audit of security operational procedures as often as security policy requires relative to the asset being protected. Using results of analysis or audit, determine which procedures, processes, or controls need to be updated and documented. Cyber Security Important X X X X X X X X X X
8-8-8134 Security of Devices Beyond Scope of Control: Service Providers should carefully consider possible impacts on their networks from changes in the configuration or authentication information on devices beyond the service demarcation point, and thus beyond their physical or logical scope of control. Service Providers should consider network filters or network authentication to protect against malicious traffic or theft of service caused by such insecure devices. Cyber Security Important X X X X X X X X X X 8-8-8136 Protect Network/Management Infrastructure from Unexpected File System Changes: Service Providers and Network Operators should deploy tools to detect unexpected changes to file systems on Network Elements and Management Infrastructure systems where feasible and establish procedures for reacting to changes. Use techniques such as cryptographic hashes. Security Important X X X X X X X X X X X 8-8-8508 Post-Mortem Review of Security Architecture after Recovery: Immediately following incident recovery, Service Providers and Network Operators should re-evaluate the adequacy of existing security architecture and implement revisions as needed. Ensure any changes are adequately documented to reflect the current configuration. Review existing processes for establishing and maintaining security architectures update as necessary to maintain currency. Cyber Security Important X X X X X X X X X