A large mobile telephony and data network operator has a data that houses network elements. These are
essentially large computers running on Linux. The perimeter of the data center is secured with firewalls and IPS
systems. What is the best security policy concerning this setup?

A.
Network elements must be hardened with user ids and strong passwords. Regular security tests and audits
should be performed.

B.
As long as the physical access to the network elements is restricted, there is no need for additional
measures.

C.
There is no need for specific security measures on the network elements as long as firewalls and IPSsystems exist.

D.
The operator knows that attacks and down time are inevitable and should have a backup site.