HKMA Cyber Resilience Assessment Framework (C-RAF) 3.2.B: 3.2 Infrastructure protection control: baseline level

Baseline control principles for infrastructure protection control (required of every AI (minimum for a low inherent risk)). Perimeter defence tools (border routers, firewalls) are used, with a firewall at each internet connection and between any DMZ and internal networks, and systems reachable from the internet or by external parties behind firewalls or equivalents; high-risk network ports are monitored continuously; wireless networks use strong encryption for authentication and transmission; firewall rule changes are reviewed before taking effect and the complete rule set is audited or verified at least annually (on a risk basis in 2.0); IDS or IPS detect or block attacks; technical controls stop unauthorised and rogue devices joining internal networks and block unregistered devices; external connections cannot be added or removed without authorisation; DNSSEC is deployed; system configurations follow industry standards and are enforced; unneeded ports, functions, protocols and services are prohibited; changes to configurations, including virtual machines and hypervisors, are controlled and monitored; programs that can override controls are restricted and authorised; users without administrative duties cannot install software; documented hardening standards cover operating systems and network devices, with all devices hardened to them; public-facing servers are checked routinely for integrity; sessions lock after inactivity and end on set conditions. 2.0 adds restricted administrative access to hypervisors and host operating systems, policies on virtual machine images and snapshots, and an inventory and risk-based controls for IoT devices (levels not stated in the held sources).