Subcontrol 12.1

[adammontville]

Maintain an up-to-date inventory of all of the organization's network boundaries.

Measures

M1 = # of boundary devices based on the product-under-test (PUT) (input).
M2 = # of boundary devices based on the ground truth using our algorithm.
M3 = Time network boundary discovered (input).
M4 = Time network boundary connected to the network.
M5 = Max time for discovery

Metrics

1) Discovery Coverage = M1 / M2

2) freshness(time to discover) = (M4 - M3) / M5

[adammontville]

What does it even mean to have an inventory of network boundaries? Does this include VLAN boundaries (are those even used anymore?), the boundaries between network segments? I found this in the v7.1 document: Setting up even a basic level of security segmentation across the network and protecting each segment with a proxy and a firewall will greatly reduce an intruder’s access to the other parts of the network. The language of the control also speaks to DMZs (i.e. boundaries between internal and external networks).

Interpretation: This sub-control is asking for an inventory of boundaries enforced by specific categories of network devices, which requires an inventory of the network devices and an inventory of the boundaries those devices implement.

I feel like UNCC's approach covers part of what we need, but not all of it - they seem to lack the inventory piece.

[wmunyan]

Basically this metric intends to compare what's supposed to be a boundary device, to what is actually discovered as a boundary device. It's that discovery that's the hard part.

Inputs:

• Network topology/diagram
• An inventory of expected boundary devices

Operations:

• Utilize a discovery tool or process to examine the network topology to collect the list of devices considered boundary devices.
• Considering a new device added to the network, collect the time to detect that device as a boundary device (M3)

Measures:

• M1 = The number of expected network boundary devices
• M2 = The number of discovered network boundary devices
• M3 = Discovery time

Metrics:

[adammontville]

Inputs:

• An inventory of expected boundary devices

Operations:

• Utilize a discovery tool or process to examine the network topology to collect the list of devices considered boundary devices.
• Complement of input 1 and operation 1 to get the list of non-inventoried boundary devices

Measures:

• M1 = The number of expected network boundary devices
• M2 = The number of discovered network boundary devices
• M3 = Number of non-inventoried boundary devices

Metrics:

• M3 / M1 - Ratio of non-inventoried boundary devices to expected boundary devices; if greater than zero, then the inventory is not current