14 CHAPTER 2 About Industrial Networks to nuclear agencies or "licensees" in how to secure their facilities against cyber attack. These recommendations indicate that a licensee "shall protect digital compu- ter and communication systems and networks associated with safety, security, emer- gency preparedness, and any systems that support safety, security and emergency preparedness" 6 and that they shall protect the systems and networks that impact the integrity or confidentiality of data and/or software; deny access to systems, services, and/or data; and prevent any activity that might adversely impact the operation of systems, networks, and associated equipment. 7 To accomplish this, RG 5.71 makes recommendations in how to identify critical digital assets, as well as how to implement a defense in depth strategy to mitigate the adverse effects of a cyber attack against those critical assets, all to "ultimately ensure that the functions of protected assets are not adversely impacted due to cyber attacks." 8 Important components of RG 5.71 include 9 l l l l l l l l l l l Analyzing Digital Computer Systems and Networks (C.3.1) Identification of Critical Digital Assets (C.3.1.3) Defense-in-Depth Protective Strategies (C.3.2) Security Defensive Architecture (C.3.2.1) Establishing Security Controls (C.3.3) Technical Controls (C.3.3.10), including l Access Control (C.3.3.1.1) l Audit and Accountability (C.3.3.1.2) l System and Communications Protection (C.3.3.1.3) l Identification and Authentication (C.3.3.1.4) l System Hardening (C.3.3.1.5) Operational Controls (C3.3.2), including l Media Protection (C.3.3.2.1) l System and Information Integrity (C.3.3.2.3) l Incident Response (C.3.3.2.6) Continuous Monitoring and Assessment (C.4.1) Vulnerability Scans and Assessments (C.4.1.3) Change Control (C.4.2) Configuration Management (C.3.3.2.9 and C.4.2.1) In addition, Appendix B of RG 5.71 is exceptionally useful, as it provides in depth detail on recommended security technical controls, of which the following apply directly to network security: 10 l Access Controls (B.1), including Access Control Policy and Procedures (B.1.1) l Account Management (B.1.2) l Access Enforcement (B.1.3) l Information Flow Enforcement (B.1.4) l Separation of Functions (B.1.5) l