ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 7.3: Secure networks and connections: segmentation, documented design, access controls and perimeter defences, wireless, VPN, encrypted transfers, API security and hardened internet-facing services

What does 7.3 require?

Systems are placed in network segments by criticality and data sensitivity with stricter controls for high-criticality segments, network architecture is reviewed regularly for gaps, and network design including external interconnections is documented. Network access controls enforce policies for users and endpoints in every segment and are kept current; firewalls, intrusion prevention and detection sit at perimeters, physical or cloud-based; connectivity options are evaluated against data sensitivity, speed, resilience and cost; air-gapped systems are updated only through secured, malware-free media or controlled dynamic segmentation. Wireless hardware carries recognised security certification, wireless networks and connecting devices are securely configured, guest wireless is separated from the corporate network, and wireless intrusion detection and prevention scans for rogue access points. VPNs are securely configured with end-to-end encryption and authenticated users and devices, respecting local VPN law. All data transmission points use secure protocols with end-to-end encryption, with hardware encryption considered between sites, and unused or insecure services such as telnet and plain FTP are disabled. APIs are assessed for benefit and risk before use; external APIs and their publishers receive due diligence including security characteristics; published APIs are developed under the system development framework with security design such as key management, authentication, time limits and encryption suited to trusted or open use; API documentation is current and states security expectations; no undocumented APIs exist; API access is logged with rate limiting and attack protection and abusers' access is revoked promptly; and retired APIs are decoupled safely with notice to dependents. Internet-facing systems use secure transmission such as TLS and certificate pinning with time-limited stateful sessions and re-authentication, web application firewalls, protection against web parameter pollution with no sensitive data in URLs, HTTP data or cookies, measures such as MFA, CAPTCHA, honeypot fields and image identification against automated tooling, monitoring for resource surges with anti-DoS and anti-DDoS measures ready and scalable mitigation providers assessed before engagement; online and mobile services are delivered through official channels on institution-controlled, well-managed domains with DNSSEC and TLS certificates; mobile applications follow the development framework and are tamper resistant or restrict transactions when a device is compromised; and email authentication (SPF, DKIM, DMARC) protects domains from spoofing.