5.7.3.4
Establish Basic Perimeter Defenses
Encrypted and VPN Connectivity with MFA
Establish Basic Perimeter Defenses – Encrypted and VPN Connectivity with MFA – The organization shall require encrypted connectivity to all corporate IT resources and require VPN connectivity with multi-factor authentication for all remote access into corporate networks.
-
6.7 Remote Working: Implement security measures to protect information accessed, processed, or stored outside the organization’s premises when personnel work remotely.
8.3 Information Access Restriction: Limit access to information and associated assets according to the established topic-specific access control policy.
8.12 Data Leakage Prevention: Apply data leakage prevention measures to systems, networks, and other devices handling sensitive information.
8.16 Monitoring Activities: Monitor networks, systems, and applications for unusual behavior and take appropriate actions to assess potential information security incidents.
8.20 Network Security: Secure, manage, and control networks and network devices to safeguard information in systems and applications.
8.21 Security of Network Services: Identify, implement, and monitor security mechanisms, service levels, and service requirements for network services.
-
3.1.12 Monitor and control remote access sessions.
3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
3.1.14 Route remote access via managed access control points.
3.1.17 Protect wireless access using authentication and encryption.
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.7.5 Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
3.13.7 Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
-
3.1.12 Monitor and control remote access sessions.
3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
3.1.14 Route remote access via managed access control points.
3.1.17 Protect wireless access using authentication and encryption.
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.7.5 Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
3.13.7 Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.