INTERNATIONAL ISO/IEC STANDARD 18028-1

IS0/IEC18028-1:2006(E)— the introduction of malicious code to an organization's systems, services and information, with resultantmodification, unavailability and destruction,— a DoS attack against an organization's services.13.2.8.3 Security ControlsRemote access requires that the central services secure themselves against unauthorized access. Likewise, itis expected that the remote systems themselves have protection against a number of security threats. Thecontrols that may be required include:— firewalls (including personal firewalls),— router ACLs,— encryption of Internet access links,— Calling Line Identifier,— strong authentication,— anti-virus software,— audit management.Further detail on security for remote access services is provided in ISO/IEC 18028-4.13.2.9 Virtual Private Networks13.2.9.1 BackgroundA VPN is a private network which is implemented by using the infrastructure of existing networks. From a userperspective a VPN behaves like a private network, and offers similar functionality and services. A VPN may beused in various situations, such as to:— implement remote access to an organization from mobile or off-site employees,— link different locations of an organization together, including redundant links to implement a fall-backinfrastructure,— set up connections to an organization's network for other organizations/business partners.In other words, VPNs allow two computers or networks to communicate securely over an insecure medium(for example, the Internet). This communication has traditionally been performed at great expense by usingleased lines with link encryptors. However with the advent of high-speed Internet links and suitable terminationequipment at each end, reliable and secure communications between sites can be established using VPNs.13.2.9.2 Security RisksThe key security risk with communications over an insecure network is that sensitive information may beaccessible to unauthorized parties, leading to unauthorized disclosure and/or modification. In addition to therisks typically associated with local and wide area networking (see Clauses 13.2.2.2 and 13.2.3.2respectively), the typical risks associated with VPNs include:— insecure implementation through:• an untested or defective cipher suite,• a weak shared secret that could be easily guessed,• poor network topology,• uncertainty about the security of the remote client,38 © ISO/IEC 2006 - All rights reserved