3.13.6
3.13.6
Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
-
5.7.3.1 The organization shall have a firewall placed between two perimeters that controls the amount and kinds of traffic that may pass between the two.
5.7.3.2 The organization should consider implementing a DNS firewall for outbound DNS requests to the Internet.
5.7.3.3 The organization shall activate any software firewalls included on devices within their networks or document the alternative measures in place instead of these firewalls.
5.7.3.4 The organization shall require encrypted connectivity to all corporate IT resources and require VPN connectivity with multi-factor authentication for all remote access into corporate networks.
5.7.3.5 The organization shall use secure Wi-Fi, at a minimum WPA2-AES, preferably WPA2-Enterprise or WPA3-Enterprise, following password requirements in section 5.5.
5.7.3.6 The organization should segment their networks to ensure networks provided to the public/customers are separated (and/or isolated) from the corporate networks.
5.7.3.7 The organization shall ensure the implementation of DMARC on all organization email services.
5.7.3.8 The organization shall ensure email filtering is implemented.