Security

The primary concern here is to establish the teams, tools, and procedures to be in place and utilized in the event of a security advisory from an equipment vendor, or when an actual attack takes place.

The following questions can be used when assessing security issues with providers:

• Internet traffic (non-VPN) If Internet traffic rides across the same infrastructure as shared MPLS VPN traffic, please detail the architecture used to carry general Internet traffic. For instance, is the Internet traffic in its own VPN? Are the routes in the default VRF?

• Management access Please detail how management access to the network infrastructure is controlled, for engineer troubleshooting access as well as Operation Systems Support (OSS) system access.

• Security team Who are the security contacts within your organization, what attack-tracing tools does that group use, and what will happen if our or your network is the object of a denial of service (DoS) attack?