40 Information Security rules, principles and advices:

40 Information Security rules, principles and advices:
Rule 1 - Have an accurate map of IT installations and keep it updated.
Rule 2 - Keep an exhaustive inventory of privileged accounts and ensure this is updated.
Rule 3 - Create and apply procedures for the arrival and departure of users (personnel, interns, etc.).
Rule 4 - Limit the number of Internet access points for the company to those that are strictly necessary.
Rule 5 - Prohibit the connection of personal devices to the organisation's information system.
Rule 6 - Know how all software components are updated and keep up-to-date on the vulnerabilities of these components and their required updates.
Rule 7 - Define and strictly apply an update policy.
Rule 8 - Identify each individual accessing the system by name.
Rule 9 - Set rules for the choice and size of passwords.
Rule 10 - Set in place technical methods to enable authentication rules to be followed.
Rule 11 - Do not store passwords in plain sight in files on information systems.
Rule 12 - Systematically renew default authentication settings (password, certificates) on devices (network switches, routers, servers, printers).
Rule 13 - Opt, where possible, for strong, smart card authentication.
Rule 14 - Implement a uniform level of security across the entire IT stock.
Rule 15 - Technically prevent the connection of portable media except where strictly necessary; deactivate the execution of the autorun functions from these types of media.
Rule 16 - Use an IT stock management tool that enables the deployment of security policies and updates to machines.
Rule 17 - Manage portable machines with a security policy that is at least as stringent as for fixed machines.
Rule 18 - Wherever possible, prohibit remote connections to client machines.
Rule 19 - Encrypt sensitive data, especially on mobile machines and media that may get lost.
Rule 20 - Frequently audit (or have audited) the configuration of the central directory (Active Directory in Windows environments or LDAP directory for example)
Rule 21 - Set in place compartmentalised networks. For machines or servers containing information that is of strategic importance to the company, create a subnetwork protected by a specific interconnection gateway.
Rule 22 - Avoid the use of wireless (Wifi) infrastructures. If the use of these technologies cannot be avoided, compartmentalise the Wifi access network from the rest of the information system.
Rule 23 - Systematically use secure applications and protocols.
Rule 24 - Secure InteSrnet interconnection gateways.
Rule 25 - Ensure that there are no machines on the network with an administration interface that is accessible via the Internet.
Rule 26 - Clearly define the objectives of system and network monitoring.
Rule 27 - Define event log analysis methods.
Rule 28 - Prohibit all access to the Internet from administration accounts.
Rule 29 - Use a dedicated network for the administration of machines or at least a network that is logically separated from the user network.
Rule 30 - Do not grant administration privileges to users. Make no exceptions.
Rule 31 - Only authorise remote access to the company network, even for network administration, from company machines that use strong authentication mechanisms and protect the integrity and confidentiality of traffic using robust means.
Rule 32 - Robust control mechanisms for premises access must imperatively be used.
Rule 33 - Keys to access the premises and alarm codes must be scrupulously protected.
Rule 34 - Do not leave access sockets to the internal network accessible in locations that are open to the public.
Rule 35 - Define rules for the use of printers and photocopiers.
Rule 36 - Develop a plan for IT recovery and continuity of activity, even if only in outline, that is regularly updated, setting out how to safeguard the company's essential data.
Rule 37 - Implement an alert and reaction chain that all parties involved are familiar with.
Rule 38 - Never simply deal with the infection of a machine without attempting to establish how the malware came to be installed on that machine, whether it has spread elsewhere on the network and what data has been accessed.
Rule 39 - Make users aware of the basic IT rules.
Rule 40 - Periodically carry out a security audit (at least annually). Each audit must be accompanied by an action plan, the implementation of which should be monitored at the highest level.