Back

30(a) Security Policy: Summary of the security policy for the proposed registry

gTLDFull Legal NameE-mail suffixDetail
.sncfSociété Nationale des Chemins de fer Francais S N C Fsncf.FrView
Table of Contents

1 - Background
2 - Organization of security
2.1 - The place of Security in AFNIC’s processes:
2.2 - Security Coordination
2.3 - Assignment of responsibilities
2.3.1 - Organizational chain of responsibility
2.3.2 - Relations with the authorities and groups of specialists
2.4 - Independent security review
2.5 - Relations with third parties
2.5.1 - Risk Management
2.5.2 - Security of sensitive areas
2.5.3 - Sensitive external sites
2.5.4 - Security assurances for domain name registrants
3 - Registry Asset Management
3.1 - Responsibilities for Registry assets
3.1.1 - Inventory of assets
3.1.2 - Qualification of support assets
3.1.3 - Ownership of assets
3.1.4 - Good and fair use of assets
3.2 - Guidelines for the classification of information
4 - Security related to human resources
4.1 - Roles and Responsibilities
4.2 - Background checks conducted on security personnel
5 - Physical and environmental security
5.1 - Secure areas
5.2 - Hardware security
6 - Operations Management and Telecommunications
6.1 - Procedures and responsibilities related to operations
6.2 - Scheduling and acceptance testing of the system
6.3 - Protection against malicious and mobile code
6.4 - Back-up
6.5 - Security management of network services
6.6 - Monitoring operation of the System
7 - Access Control
7.1 - Business requirements for access control
7.2 - Control of network access
7.3 - Control of access to operating systems
8 - Acquisition, development and maintenance of information systems
8.1 - Cryptographic measures
8.2 - Management of technical vulnerabilities
9 - Managing incidents related to information security
9.1 - Managing improvement and incidents related to information security
10 - IT Disaster Recovery Plan
11 - Integrating audits of the information system


------------------------
1 - Background

The security policy is designed to ensure proper management of the risks that may significantly impact the services provided, the contexts in which they are implemented, and the key personnel involved in operating the Registry. It also defines security level for the scalability ⁄ responsiveness to security incidents, the Registry Data integrity and the confidentiality of personal data of domain name owners.

The Information Security Policy is reviewed at least once a year.


------------------------
2 - Organization of security

------------------------
2.1 - The place of Security in AFNIC’s processes:

AFNIC has set up a Quality Management System (QMS) following the European Framework for QUality Management (EFQM) excellence model. It describes AFNIC’s activities as a series of business processes. Security Process called “ENSURE SECURITY AND BUSINESS CONTINUITY” is one of the cross-business-processes supporting process. It is designed to be compliant with the ISO 27001 norm.
Ensuring security and business continuity mainly consists in defining and controlling how to :
* Supervise the governance of security,
* Apply security measures into the concerned operational fields,
* Manage the risks that could negatively impact the Registries operations.

The implementation of the AFNICʹs ISMS (Information Security Management System) is performed in the framework of the Security process with a view to obtaining ISO 27001 certification by 2014.

------------------------
2.2 - Security Coordination

The overall responsibility for security rests with the CEO. He is assisted in this role by the AFNIC Security Manager (ASM).

Strategic supervision is ensured in a concerted manner by the AFNIC Security Council (ASC) chaired by the AFNIC CEO. The purpose of the ASC is to assist and ensure that the conditions are conducive to attaining the security objectives that fall within the scope of the current strategy.

The ASC further supports the development of security practices at AFNIC through the supporting of operation business functions in implementing security policies, business continuity plans, and staff awareness activities. In carrying out its assignment, the ASC may refer at any time to the Executive Management for advice or a decision on the security of AFNIC and TLD.

------------------------
2.3 - Assignment of responsibilities

------------------------
2.3.1 - Organizational chain of responsibility

The application of security measures to the SRS, DNS, Whois, and other Information Systems is the responsibility of the CTO (head of the Information Systems Division).
The implementation of security measures for staff and premises is the responsibility of the CFO.
The implementation of security measures with respect to legal obligations and registry policies is the responsibility of the Registryʹs Legal Affairs and Policies Director.
The application of security measures relating to damage to the Registryʹs image is the responsibility of the Marketing and Innovation Director.
All the collaborators must be aware of their responsibility concerning the security of resources and information they are accessing, manipulating, publishing.

------------------------
2.3.2 - Relations with the authorities and groups of specialists

AFNIC has an agreement with the French National Agency for the Security of Information Systems (ANSSI). Against this background, the two structures cooperate on security issues that may affect AFNIC services related to its Internet business and risk management in this area.
They cooperate within the framework of two programs on the resilience of the Internet in France :
* Cooperation between the operators of vitals infrastructures in order to improve their capacity to respond to major crises affecting several operators at the same time: the Internet critical services (IP Routing and DNS) are now included in the nomenclature;
* Cooperation to assess the resilience of the French .fr TLD and more generally all the TLDs operated by AFNIC for use by the public.

------------------------
2.4 - Independent security review

Security audits must be conducted by independent organizations twice a year on global and ⁄ or specific issues related to security.

------------------------
2.5 - Relations with third parties

------------------------
2.5.1 - Risk Management

Risk studies are conducted using the EBIOS methodology (Expression of Business needs and Identification of Security Objectives, in French). This method was designed in 1995 by the French National Agency for Information Security. It is currently used to identify the worst-case scenarios that could affect registry activity. That leads Afnic to design and apply mitigation measures to enhance the protection against these worst-case scenarios.

The control of the effectiveness and efficiency of mitigation measures is performed by the AFNIC’s Security Council all along the year.

------------------------
2.5.2 - Security of sensitive areas

All sensitive areas are under control. That means that access must be controlled and could be restricted to authorized personnel only.
Co-contractors may be requested to sign a confidentiality agreement if required by the sensitivity of information and data they need to know and⁄or use. They only have access to critical technical facilities if accompanied, and never work on production systems.

------------------------
2.5.3 - Sensitive external sites

All security must be applied to protect AFNIC’s resources on external sites. That can be made by private zones and access control to them managed by AFNIC itself.

------------------------
2.5.4 - Security assurances for domain name registrants

The Registry guarantees the following for registrants :
* The continuous availability of operations on its portfolio of domain names, in accordance with the SLA on the SRS
* The continuous availability of information related to the domain, on condition that the registrant uses the services provided to carry out the operations in question,
* The confidentiality of the registrantsʹ personal data (except where other special conditions apply related to the policy of the registry)
* The confidentiality of non-public data relating to the domain and ⁄ or its portfolio of domain names,
* The confidentiality of the transactions with the Registryʹs system,
* The integrity of the information related to its domain name,and published in the WHOIS and the DNS.


------------------------
3 - Registry Asset Management

The security of the registryʹs assets is ensured by the staff assigned to the registryʹs production operations and management activities.
Considering the network connectivity provided by third party, AFNIC’s property begins at the service delivery point.

------------------------
3.1 - Responsibilities for Registry assets

------------------------
3.1.1 - Inventory of assets

Assets used in the run of critical services are identified, qualified, and managed under the guidance of the present policy. Assets considered are staff, infrastructure, software, connectivity, data and providers.

------------------------
3.1.2 - Qualification of support assets

The assets contributing to the Services are classified in 3 main categories :
* Computer Systems and Telecommunications : Hardware and Software; Communications Channels; Outsourced Services;
* Organizations : Staff; Corporate departments;
* Physical locations for business : Offices; Hosting Datacenters;

------------------------
3.1.3 - Ownership of assets

Registry data belong to the Registry owner. They are subject to the rules of the contract with ICANN, plus the applicable legal and ⁄ or legislative rules depending on the context in which the registry is implemented

------------------------
3.1.4 - Good and fair use of assets

All the registry operations and services must be used by third party in accordance with the contractual rules defined by the owner and the operator of the TLD.

------------------------
3.2 - Guidelines for the classification of information

The data used or produced in the context of the Registry are classified in the 3 following categories :

= Critical information = : it can⁄must be accessed⁄showed only by accredited persons. Disclosure or alteration may result in significant damage but repairable.

= Reserved information = : Information is limited to persons, entities or authorized partners. Disclosure or alteration may result in significant harm.

= Internal Information = : Information is available to staff of AFNIC and authorized partners. Disclosure or alteration may perturb the normal functioning of the company, without lasting consequence.


------------------------
4 - Security related to human resources

------------------------
4.1 - Roles and Responsibilities

There are 2 categories of staff :

* Technical staff : These personnel have access to resources according to defined rights.
* Administrators in charge of administering production resources. They can access all the production resources and data.
* Technicians in charge of the operation, maintenance and monitoring of the production system. They have limited rights of access to production resources. They can access certain resources on request and when accompanied by an administrator.
* Experts in charge of the design and development of production resources. They only have access to the production resources on request and when accompanied by a technician and ⁄ or an administrator.
* Non-technical staff :
* Administrative staff and managers (excluding production).

------------------------
4.2 - Background checks conducted on security personnel

French law applies to all staff. The contract they sign with their employer contains sufficient provisions in terms of professionalism and ethics for the activity involving the TLD. Same rules are applicable a Data Center level.


------------------------
5 - Physical and environmental security

------------------------
5.1 - Secure areas

AFNIC production sites are secured at the means of access to them. The DATA CENTER sites must meet the standards of industrial and environmental security compatible with the constraints implied by their activity. The layout of the premises must be such that access is restricted only to authorized personnel at entry points selected and controlled by AFNIC.

------------------------
5.2 - Hardware security

The Data centers that host AFNIC services ensure at least Tier 3 levels of resilience.


------------------------
6 - Operations Management and Telecommunications

AFNIC controls the operation of all the resources used to deliver essential services with the exception, of course, of outsourced services such as certain DNS servers.
AFNIC operates dark fiber connections between its sites. The terminals are owned by AFNIC. They are operated by AFNIC personnel.

------------------------
6.1 - Procedures and responsibilities related to operations

Operating procedures are documented and kept up to date on the intranet of the IT team.
Access to the applications, servers and databases must be defined and kept up to date for each staff member.
Access privileges are defined in order to respect the security rules associated with the classification of information.
Operations related to DNSSEC are subject to even more stringent security regulations and require respecting the DPS procedure.

------------------------
6.2 - Scheduling and acceptance testing of the system

The test, pre-production and production phases must be clearly specified. Any production launch must be announced to the registrars at least 2 month before it applies.

------------------------
6.3 - Protection against malicious and mobile code

All the entry points to the production servers are filtered by the firewall, which applies the filtering policy common to all the procedures, whether they involve a human operator or an automated process.

Each development must apply security rules and recommendations on the development of application.
The Web access must be protected against the most common (Script kiddies, SQL injection …)

------------------------
6.4 - Back-up

Registry data are stored and secured using the real-time replication mechanisms of the production Database Management System (production DBMS).
In addition, a physical backup of the entire database must be performed at the same time as the back-up of the other components of the SRS.
To be compliant with the ICANN requirements, a data escrow deposit must be performed every day between 0:00 am end 12:00pm

------------------------
6.5 - Security management of network services

A strict partitioning into zones must be implemented in order to avoid interconnections between the external production, administration and backup networks.

Any internal and external attempts to access production servers must pass through a Firewall. They are recorded in a log file for later analysis. The detection of malicious code based on a regularly updated list must be performed at this level.

An intrusion detections system must be installed and running between firewall and production servers.

------------------------
6.6 - Monitoring operation of the System

Automated monitoring must be implemented. It must cover the hardware, software systems and production applications.
Any failure must be subject to a specific alert sent to the staff:
* on duty during office hours;
* on standby outside office hours;


------------------------
7 - Access Control

------------------------
7.1 - Business requirements for access control

Access to the information system requires prior identification and authentication. The use of shared or anonymous accounts must be avoided. Mechanisms to limit the services, data, and privileges to which the users have access based on their role at AFNIC and the Registry must be implemented wherever possible.

------------------------
7.2 - Control of network access

The internal network must be partitioned to isolate the different services and applications and limit the impact of incidents. In particular it is highly desirable to isolate services visible from the outside in a semi-open zone (DMZ). Similarly, access to the wireless network must be controlled and the network must be subject to appropriate encryption.

------------------------
7.3 - Control of access to operating systems

The production servers must be confined in secure facilities. Access must be restricted to authorized personnel only. The personnel in question are the members of the operating teams and their managers, IT personnel and those of the Security Manager.


------------------------
8 - Acquisition, development and maintenance of information systems

------------------------
8.1 - Cryptographic measures

Cryptographic measures must be implemented to secure the exchanges :
* between the workstations of technical staff and the access proxies to production servers;
* between the Registrars and the EPP server;
* between the DNS master servers and the resolution servers;
* to upload the records of the Escrow Agent.

------------------------
8.2 - Management of technical vulnerabilities

The technical configuration of hardware and software used must be subject to up to date documentation.
The changes in technical configurations must be constantly monitored and documented.
Security alerts involving updates and ⁄ or patches to production systems must be constantly monitored.
Application procedures must be documented and updated based on the recommendations of the designers of a component.


------------------------
9 - Managing incidents related to information security

------------------------
9.1 - Managing improvement and incidents related to information security

The crisis management procedure serves to mobilize at a sufficiently high echelon, all the appropriate levels of responsibility for taking decisions on the actions required to resolve the crisis and return to normal.
Each security incident must be analyzed under the cover of the Security Council and the recommendations, if any, are applied, checked and evaluated as required by the QMS.


------------------------
10 - IT Disaster Recovery Plan

The risk analysis must produce some inputs for the elaboration of a disaster recovery plan. That plan has to be established and regularly tested in order to maintain or recover Registry activity and make critical services available at the required SLA after an interruption or a crash of critical services of the Registry.


------------------------
11 - Integrating audits of the information system

Security audits are performed annually. They are launched on the initiative of the CTO or upon request from the ASC. They are carried out by independent bodies and relate to one or more of the essentials services of the Registry.

The ASC and the ASM control the implementation and the efficiency of these measures in the framework of S3 process (see section 2.1).
gTLDFull Legal NameE-mail suffixDetail
.LANCASTERLANCASTERlancaster.frView
Table of Contents

1 - Background
2 - Organization of security
2.1 - The place of Security in AFNIC’s processes:
2.2 - Security Coordination
2.3 - Assignment of responsibilities
2.3.1 - Organizational chain of responsibility
2.3.2 - Relations with the authorities and groups of specialists
2.4 - Independent security review
2.5 - Relations with third parties
2.5.1 - Risk Management
2.5.2 - Security of sensitive areas
2.5.3 - Sensitive external sites
2.5.4 - Security assurances for domain name registrants
3 - Registry Asset Management
3.1 - Responsibilities for Registry assets
3.1.1 - Inventory of assets
3.1.2 - Qualification of support assets
3.1.3 - Ownership of assets
3.1.4 - Good and fair use of assets
3.2 - Guidelines for the classification of information
4 - Security related to human resources
4.1 - Roles and Responsibilities
4.2 - Background checks conducted on security personnel
5 - Physical and environmental security
5.1 - Secure areas
5.2 - Hardware security
6 - Operations Management and Telecommunications
6.1 - Procedures and responsibilities related to operations
6.2 - Scheduling and acceptance testing of the system
6.3 - Protection against malicious and mobile code
6.4 - Back-up
6.5 - Security management of network services
6.6 - Monitoring operation of the System
7 - Access Control
7.1 - Business requirements for access control
7.2 - Control of network access
7.3 - Control of access to operating systems
8 - Acquisition, development and maintenance of information systems
8.1 - Cryptographic measures
8.2 - Management of technical vulnerabilities
9 - Managing incidents related to information security
9.1 - Managing improvement and incidents related to information security
10 - IT Disaster Recovery Plan
11 - Integrating audits of the information system


------------------------
1 - Background

The security policy is designed to ensure proper management of the risks that may significantly impact the services provided, the contexts in which they are implemented, and the key personnel involved in operating the Registry. It also defines security level for the scalability ⁄ responsiveness to security incidents, the Registry Data integrity and the confidentiality of personal data of domain name owners.

The Information Security Policy is reviewed at least once a year.


------------------------
2 - Organization of security

------------------------
2.1 - The place of Security in AFNIC’s processes:

AFNIC has set up a Quality Management System (QMS) following the European Framework for QUality Management (EFQM) excellence model. It describes AFNIC’s activities as a series of business processes. Security Process called “ENSURE SECURITY AND BUSINESS CONTINUITY” is one of the cross-business-processes supporting process. It is designed to be compliant with the ISO 27001 norm.
Ensuring security and business continuity mainly consists in defining and controlling how to :
* Supervise the governance of security,
* Apply security measures into the concerned operational fields,
* Manage the risks that could negatively impact the Registries operations.

The implementation of the AFNICʹs ISMS (Information Security Management System) is performed in the framework of the Security process with a view to obtaining ISO 27001 certification by 2014.

------------------------
2.2 - Security Coordination

The overall responsibility for security rests with the CEO. He is assisted in this role by the AFNIC Security Manager (ASM).

Strategic supervision is ensured in a concerted manner by the AFNIC Security Council (ASC) chaired by the AFNIC CEO. The purpose of the ASC is to assist and ensure that the conditions are conducive to attaining the security objectives that fall within the scope of the current strategy.

The ASC further supports the development of security practices at AFNIC through the supporting of operation business functions in implementing security policies, business continuity plans, and staff awareness activities. In carrying out its assignment, the ASC may refer at any time to the Executive Management for advice or a decision on the security of AFNIC and TLD.

------------------------
2.3 - Assignment of responsibilities

------------------------
2.3.1 - Organizational chain of responsibility

The application of security measures to the SRS, DNS, Whois, and other Information Systems is the responsibility of the CTO (head of the Information Systems Division).
The implementation of security measures for staff and premises is the responsibility of the CFO.
The implementation of security measures with respect to legal obligations and registry policies is the responsibility of the Registryʹs Legal Affairs and Policies Director.
The application of security measures relating to damage to the Registryʹs image is the responsibility of the Marketing and Innovation Director.
All the collaborators must be aware of their responsibility concerning the security of resources and information they are accessing, manipulating, publishing.

------------------------
2.3.2 - Relations with the authorities and groups of specialists

AFNIC has an agreement with the French National Agency for the Security of Information Systems (ANSSI). Against this background, the two structures cooperate on security issues that may affect AFNIC services related to its Internet business and risk management in this area.
They cooperate within the framework of two programs on the resilience of the Internet in France :
* Cooperation between the operators of vitals infrastructures in order to improve their capacity to respond to major crises affecting several operators at the same time: the Internet critical services (IP Routing and DNS) are now included in the nomenclature;
* Cooperation to assess the resilience of the French .fr TLD and more generally all the TLDs operated by AFNIC for use by the public.

------------------------
2.4 - Independent security review

Security audits must be conducted by independent organizations twice a year on global and ⁄ or specific issues related to security.

------------------------
2.5 - Relations with third parties

------------------------
2.5.1 - Risk Management

Risk studies are conducted using the EBIOS methodology (Expression of Business needs and Identification of Security Objectives, in French). This method was designed in 1995 by the French National Agency for Information Security. It is currently used to identify the worst-case scenarios that could affect registry activity. That leads Afnic to design and apply mitigation measures to enhance the protection against these worst-case scenarios.

The control of the effectiveness and efficiency of mitigation measures is performed by the AFNIC’s Security Council all along the year.

------------------------
2.5.2 - Security of sensitive areas

All sensitive areas are under control. That means that access must be controlled and could be restricted to authorized personnel only.
Co-contractors may be requested to sign a confidentiality agreement if required by the sensitivity of information and data they need to know and⁄or use. They only have access to critical technical facilities if accompanied, and never work on production systems.

------------------------
2.5.3 - Sensitive external sites

All security must be applied to protect AFNIC’s resources on external sites. That can be made by private zones and access control to them managed by AFNIC itself.

------------------------
2.5.4 - Security assurances for domain name registrants

The Registry guarantees the following for registrants :
* The continuous availability of operations on its portfolio of domain names, in accordance with the SLA on the SRS
* The continuous availability of information related to the domain, on condition that the registrant uses the services provided to carry out the operations in question,
* The confidentiality of the registrantsʹ personal data (except where other special conditions apply related to the policy of the registry)
* The confidentiality of non-public data relating to the domain and ⁄ or its portfolio of domain names,
* The confidentiality of the transactions with the Registryʹs system,
* The integrity of the information related to its domain name,and published in the WHOIS and the DNS.


------------------------
3 - Registry Asset Management

The security of the registryʹs assets is ensured by the staff assigned to the registryʹs production operations and management activities.
Considering the network connectivity provided by third party, AFNIC’s property begins at the service delivery point.

------------------------
3.1 - Responsibilities for Registry assets

------------------------
3.1.1 - Inventory of assets

Assets used in the run of critical services are identified, qualified, and managed under the guidance of the present policy. Assets considered are staff, infrastructure, software, connectivity, data and providers.

------------------------
3.1.2 - Qualification of support assets

The assets contributing to the Services are classified in 3 main categories :
* Computer Systems and Telecommunications : Hardware and Software; Communications Channels; Outsourced Services;
* Organizations : Staff; Corporate departments;
* Physical locations for business : Offices; Hosting Datacenters;

------------------------
3.1.3 - Ownership of assets

Registry data belong to the Registry owner. They are subject to the rules of the contract with ICANN, plus the applicable legal and ⁄ or legislative rules depending on the context in which the registry is implemented

------------------------
3.1.4 - Good and fair use of assets

All the registry operations and services must be used by third party in accordance with the contractual rules defined by the owner and the operator of the TLD.

------------------------
3.2 - Guidelines for the classification of information

The data used or produced in the context of the Registry are classified in the 3 following categories :

= Critical information = : it can⁄must be accessed⁄showed only by accredited persons. Disclosure or alteration may result in significant damage but repairable.

= Reserved information = : Information is limited to persons, entities or authorized partners. Disclosure or alteration may result in significant harm.

= Internal Information = : Information is available to staff of AFNIC and authorized partners. Disclosure or alteration may perturb the normal functioning of the company, without lasting consequence.


------------------------
4 - Security related to human resources

------------------------
4.1 - Roles and Responsibilities

There are 2 categories of staff :

* Technical staff : These personnel have access to resources according to defined rights.
* Administrators in charge of administering production resources. They can access all the production resources and data.
* Technicians in charge of the operation, maintenance and monitoring of the production system. They have limited rights of access to production resources. They can access certain resources on request and when accompanied by an administrator.
* Experts in charge of the design and development of production resources. They only have access to the production resources on request and when accompanied by a technician and ⁄ or an administrator.
* Non-technical staff :
* Administrative staff and managers (excluding production).

------------------------
4.2 - Background checks conducted on security personnel

French law applies to all staff. The contract they sign with their employer contains sufficient provisions in terms of professionalism and ethics for the activity involving the TLD. Same rules are applicable a Data Center level.


------------------------
5 - Physical and environmental security

------------------------
5.1 - Secure areas

AFNIC production sites are secured at the means of access to them. The DATA CENTER sites must meet the standards of industrial and environmental security compatible with the constraints implied by their activity. The layout of the premises must be such that access is restricted only to authorized personnel at entry points selected and controlled by AFNIC.

------------------------
5.2 - Hardware security

The Data centers that host AFNIC services ensure at least Tier 3 levels of resilience.


------------------------
6 - Operations Management and Telecommunications

AFNIC controls the operation of all the resources used to deliver essential services with the exception, of course, of outsourced services such as certain DNS servers.
AFNIC operates dark fiber connections between its sites. The terminals are owned by AFNIC. They are operated by AFNIC personnel.

------------------------
6.1 - Procedures and responsibilities related to operations

Operating procedures are documented and kept up to date on the intranet of the IT team.
Access to the applications, servers and databases must be defined and kept up to date for each staff member.
Access privileges are defined in order to respect the security rules associated with the classification of information.
Operations related to DNSSEC are subject to even more stringent security regulations and require respecting the DPS procedure.

------------------------
6.2 - Scheduling and acceptance testing of the system

The test, pre-production and production phases must be clearly specified. Any production launch must be announced to the registrars at least 2 month before it applies.

------------------------
6.3 - Protection against malicious and mobile code

All the entry points to the production servers are filtered by the firewall, which applies the filtering policy common to all the procedures, whether they involve a human operator or an automated process.

Each development must apply security rules and recommendations on the development of application.
The Web access must be protected against the most common (Script kiddies, SQL injection …)

------------------------
6.4 - Back-up

Registry data are stored and secured using the real-time replication mechanisms of the production Database Management System (production DBMS).
In addition, a physical backup of the entire database must be performed at the same time as the back-up of the other components of the SRS.
To be compliant with the ICANN requirements, a data escrow deposit must be performed every day between 0:00 am end 12:00pm

------------------------
6.5 - Security management of network services

A strict partitioning into zones must be implemented in order to avoid interconnections between the external production, administration and backup networks.

Any internal and external attempts to access production servers must pass through a Firewall. They are recorded in a log file for later analysis. The detection of malicious code based on a regularly updated list must be performed at this level.

An intrusion detections system must be installed and running between firewall and production servers.

------------------------
6.6 - Monitoring operation of the System

Automated monitoring must be implemented. It must cover the hardware, software systems and production applications.
Any failure must be subject to a specific alert sent to the staff:
* on duty during office hours;
* on standby outside office hours;


------------------------
7 - Access Control

------------------------
7.1 - Business requirements for access control

Access to the information system requires prior identification and authentication. The use of shared or anonymous accounts must be avoided. Mechanisms to limit the services, data, and privileges to which the users have access based on their role at AFNIC and the Registry must be implemented wherever possible.

------------------------
7.2 - Control of network access

The internal network must be partitioned to isolate the different services and applications and limit the impact of incidents. In particular it is highly desirable to isolate services visible from the outside in a semi-open zone (DMZ). Similarly, access to the wireless network must be controlled and the network must be subject to appropriate encryption.

------------------------
7.3 - Control of access to operating systems

The production servers must be confined in secure facilities. Access must be restricted to authorized personnel only. The personnel in question are the members of the operating teams and their managers, IT personnel and those of the Security Manager.


------------------------
8 - Acquisition, development and maintenance of information systems

------------------------
8.1 - Cryptographic measures

Cryptographic measures must be implemented to secure the exchanges :
* between the workstations of technical staff and the access proxies to production servers;
* between the Registrars and the EPP server;
* between the DNS master servers and the resolution servers;
* to upload the records of the Escrow Agent.

------------------------
8.2 - Management of technical vulnerabilities

The technical configuration of hardware and software used must be subject to up to date documentation.
The changes in technical configurations must be constantly monitored and documented.
Security alerts involving updates and ⁄ or patches to production systems must be constantly monitored.
Application procedures must be documented and updated based on the recommendations of the designers of a component.


------------------------
9 - Managing incidents related to information security

------------------------
9.1 - Managing improvement and incidents related to information security

The crisis management procedure serves to mobilize at a sufficiently high echelon, all the appropriate levels of responsibility for taking decisions on the actions required to resolve the crisis and return to normal.
Each security incident must be analyzed under the cover of the Security Council and the recommendations, if any, are applied, checked and evaluated as required by the QMS.


------------------------
10 - IT Disaster Recovery Plan

The risk analysis must produce some inputs for the elaboration of a disaster recovery plan. That plan has to be established and regularly tested in order to maintain or recover Registry activity and make critical services available at the required SLA after an interruption or a crash of critical services of the Registry.


------------------------
11 - Integrating audits of the information system

Security audits are performed annually. They are launched on the initiative of the CTO or upon request from the ASC. They are carried out by independent bodies and relate to one or more of the essentials services of the Registry.

The ASC and the ASM control the implementation and the efficiency of these measures in the framework of S3 process (see section 2.1).