.png)
When managing infrastructure, businesses’ need to ensure that infrastructure device management controls are addressed and implemented.
It is incredibly important to define controls that manage, maintain, or improve normal business operations, such as active ports, services, protocols and firewalls. This also applies infrastructure associated with recovery environments.
Active Ports, Services and Protocols
These should be associated with the hardware assets contained in the asset inventory. Controlled, automated port scans should be performed on a regular basis for all information systems and devices to identify the ports that are presently in use. Ports, services, and protocols should be disabled if they are no longer needed for business purposes. Alerts should be delivered to appropriate personnel if unauthorized ports are detected on any information system or device during scanning activities. As always, these controls should be assigned to accountable personnel that have the appropriate knowledge to ensure that they are addressed and continue to operate effectively.
Firewalls
It helps to verify and validate the traffic that runs through the server if application firewalls, including web application firewalls, are placed in front of any critical servers. If any unauthorized traffic finds its way into your server, it should be identified, blocked and logged as soon as possible. Lastly, alerts should be forwarded to the incident response function of your organization if pre-defined thresholds are exceeded.
The Importance of Segmentation
Your enterprise network should be segmented into multiple, separate security trust zones that have defense-in-depth strategies in place because they help mitigate the risk of attacks. Segmentation can be implemented based on the classification level of the information stored on assets, or the business criticality of the assets. When looking to further your segmentation, segmentation will be based on the type or class of assets within each trust zone.
When strengthening the security of your business it is important that controls, like the ones listed above, are assigned to accountable and educated personnel to ensure that issues and protocol is addressed. This, along with the advice above will help you continue to operate effectively and ensure management controls are addressed and implemented. To lean more on how to best secure your organization, get my book: 100 Security Program Pitfalls and Prescriptions to Avoid Them (available on Amazon here). Or register for a demo of the ASCENT Security and Compliance Portal and get a free synopsis of the 100 Security Program Pitfalls eBook today.
See the ASCENT Security and Compliance Portal and get a free synopsis of the 100 Security Program Pitfalls eBook today.
At ASCENT, we deliver the industry’s leading Software-as-a-Services (SaaS) platform for comprehensive security and compliance management. Enabling organizations of all sizes to automate and maintain a complete security and compliance program, ASCENT aligns processes with leading industry frameworks to increase efficiency, eliminate work duplication, ensure vendor compliance and provide deep visibility into compliance risk. Based on 50 years of compliance experience, ASCENT lowers compliance costs and risk while protecting companies from security exposure.