Guidelines for networking

Each server should perform its own distinct function and not share a machine or operating environment with unrelated server roles. Keeping server functions separate means that if one server is compromised, overloaded or fails, the problem stays contained and does not automatically spread to other services. This control is about the design choice to host different roles (for example a web server, a database server and an email server) on separate servers rather than bundling them together.

Create network diagrams showing connections, critical servers, and security devices for proper documentation.

Ensure that network documentation is regularly created, updated, and kept available to support network management.

Ensure only approved devices can connect to the network, blocking unauthorised access.

Do not use VLANs to separate networks with different security levels.

VLANs must be managed from the most secure and trusted part of the network.

Network devices should have any unused physical ports turned off to prevent unauthorised access.

Ensure network devices do not use shared paths for VLANs from different security areas.

Security measures are in place to ensure that only authorised users can access network management systems.

Install systems at network gateways to monitor and protect against unauthorised access or threats from other networks.

Install and configure systems to detect and alert on unauthorised network traffic past the main firewall.

When sharing network details, only provide what's needed for others to fulfil their contracts.

Networks have separate zones based on the importance of servers, services, and data.

Restrict network traffic flow to ensure it only supports business needs.

Use network security devices that support IPv6 to protect networks using IPv6 or both IPv6 and IPv4.

During setup, change or remove default login details for network devices to enhance security.

Avoid using SNMP versions 1 and 2, as they are insecure for network management.

To enhance security, change default SNMP passwords and disable write access on network devices.

Network access uses 802.1X with certificate-based EAP-TLS so device and server prove identity to each other, and every other EAP method is switched off on both clients and authentication servers.

Every component of an 802.1X set-up (the client supplicant, the switch or access point acting as authenticator, and the authentication server) must be an evaluated product.

Devices and people joining a network through 802.1X must prove who they are with an X.509 certificate, not a password or shared key.

Every X.509 certificate an organisation issues must come from a certificate authority product or hardware security module that has passed formal security evaluation.

Keep X.509 certificates and their private keys locked down logically, physically and cryptographically, and make people prove who they are before their personal certificates can be used.

Ensure VLANs from different security domains use separate network interfaces to avoid cross-traffic.

IPv6 tunnelling on network devices should be disabled unless absolutely needed.

Configure your network security appliances to block IPv6 tunnelling traffic at every point where your network connects to the outside world.

Use DHCPv6 to manage and log IPv6 addresses centrally for enhanced network organisation.

Ensure RADIUS server communications are encrypted for increased security.

Servers should reduce interaction with each other to enhance security.

Do not use VLANs to separate internal networks from the public internet.

Ensure that an organisation's network is kept separate from its service providers' networks for better security.

Block connections from anonymous networks to keep the organisation's network secure.

Ensure outbound connections to anonymous networks are blocked for security.

Use available methods to keep user identities private when using EAP-TLS for wireless network authentication.

Ensure all data over networks is encrypted using approved methods.

A service that prevents access to harmful website addresses.

Network devices must be installed with trusted firmware before their first use to prevent security risks.

Ensure network devices are restarted every month to maintain optimal performance.

IT equipment management interfaces should not be accessible from the internet to enhance security.

Keep records of settings for important servers and network devices to ensure strong network security.

Ensure SMB version 1 is not active on network systems to enhance security.

Important events on internet-connected network devices are logged in a central location for security.

Logs activities from internal network devices to keep track of security-related events.

DNS lookups sent between your devices and DNS servers must be encrypted using cryptography approved by the Australian Signals Directorate (ASD).

Limit internet connection only to devices that need it to ensure security.

Put the admin interfaces of servers, switches, firewalls and other IT equipment on their own management network that is cut off from the general network and the internet.

Compare each network device's firmware and running configuration to an approved baseline after patching, when something looks wrong, and at least every month.

Strip network devices back to what they actually need: switch off or take out any component, service or feature that has no business purpose, so it cannot be attacked.

Discuss with cloud providers how to handle costs and actions for denial-of-service attacks to maintain service continuity.

Ensure online service domain security by locking registration and verifying details.

Critical online services are kept separate to reduce the risk of service disruption from attacks.

Online services are hosted using cloud service providers for improved service continuity.

Use CDNs to keep websites running smoothly and available when needed.

Avoid sharing web server IPs and limit access to them by CDNs and authorised networks for security.

Cloud services must be able to scale resources quickly to handle sudden increases in demand.

Online services should switch easily between zones to maintain availability.

Organisations monitor online services to ensure they can handle traffic and remain available at all times.

Where MACsec is used, turn on confidentiality (encryption) mode with an approved GCM-AES cipher suite, preferring the 256-bit options, so link traffic is encrypted rather than only integrity-checked.

Configure every MACsec link so its connectivity association expires and re-keys in under 24 hours (less than 86400 seconds), rather than persisting indefinitely.

Devices using EAP-TLS for MACsec Key Agreement (MKA) must re-authenticate with a fresh EAP-TLS exchange whenever they need a new Connectivity Association Key, rather than reusing an old session or key.

Configure MACsec links so each secure association is replaced in under four hours (14400 seconds), limiting how long any one set of session keys stays in use on the link.

MACsec links must not be allowed to fall back to a Pre-Shared Key for authentication when the primary method fails, so a weaker, static secret can never quietly take over.

Ensure public wireless networks are separate from organisation networks for security.

RF shielding is used to control the wireless signal range and keep it limited to an organisation's secure area.

All wireless devices must have Wi-Fi Alliance certification for security standards.

Ensure that administrative access to wireless routers cannot be done through wireless connections.

Change default wireless network names to enhance security.

Ensure non-public WiFi network names (SSIDs) don't reveal info about the organisation or location.

SSID broadcasting must be left enabled on wireless access points and not disabled, because hiding the network name gives no real security benefit.

Don't use fixed IP addresses for devices on wireless networks to enhance security.

Do not use MAC address filtering to control devices connecting to your wireless network.

Ensure that stored authentication data for networks isn't kept for more than a day.

Use WPA3-Enterprise 192-bit mode to secure information transferred over wireless networks.

Wireless networks should use different frequencies to avoid interference with each other.

Ensure wireless networks use the 802.11w standard to secure management frames from tampering.

Deploy many low-power wireless access points to cover an area instead of few high-power ones.

Ensure wireless access points are secured by updating default settings for enhanced protection.

802.11r is disabled unless secured by approved cryptographic protocol.