3.2.4—Multi-Layer Defence Controls
>Control Description
FRFIs should implement and maintain multiple layers of cyber security controls and defend against cyber security threats at every stage of the attack life cycle (e.g., from reconnaissance and initial access to executing on objectives). FRFIs should also ensure resilience against current and emerging cyber threats by maintaining defence controls and tools. This includes ensuring continuous operational effectiveness of controls by minimizing false positives. Where feasible, FRFIs should:
Protect networks, including external-facing services, from threats by minimizing its attack surface;
Define authorized logical network zones and apply controls to segregate and limit, or block access and traffic to and from network zones;
Leverage a combination of allow/deny lists, including file integrity checks (e.g., file hash/signature) and indicators of compromise, in addition to advanced behaviour-based protection capabilities that are continuously updated; and
Apply defence controls and capabilities for intrusion prevention and detection on its network perimeter in addition to controls for data loss, malware and viruses.
>Cross-Framework Mappings
Ask AI
Configure your API key to use AI features.