IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
said that fewer are required. Furthermore, administration and implementation
costs are normally also lower, because security services do not have to be
implemented in a wide variety of applications. In this way even "exotic"
applications – which do not have their own security functionality – can
exchange data securely.
In many cases it is a good idea to use a combination of cryptographic services
on different layers. The form that this will take depends on the specific
security requirements and the conditions of use, such as costs, performance
and the extent to which the relevant components are available. Other crucial
factors include the assumed threads which the implemented security services
are intended to counteract, and the underlying system architecture.
Security terminals security coupling elements
Security systems can take the form of a terminal device or part of a terminal
device, or of a coupling element or part of a coupling element. Coupling
elements may be active network components, for example, such as routers or
gateways.
In contrast with terminal devices, security coupling elements usually have two
network interfaces, which are coupled to a layer that is typical for that system
via a crypto module (hardware or software). One interface is connected to the
"secure" network (e.g. an in-house network), while the other interface is
connected to the network considered "insecure" (e.g. a public network).
Security terminals have the advantage that the security mechanisms can be
closely adapted to the requirements of the application. Typical security
terminals include crypto telephones, crypto fax machines or
hardware/software-based security solutions for PCs. Security terminals
generally provide solutions for individual workstations. In some cases these
solutions support only one service. The boundaries are fluid, however (such as
in the case of telephony via an Internet PC, or a crypto telephone with a data
input). In terminal devices, as opposed to coupling elements, the choice of
security layer is not restricted, because terminals are generally complete – in
other words they have 7 layers.
Security coupling elements are often designed with sufficient performance
capability to be able to provide security for large work units, up to and
including entire properties. The manufacturers of these systems try to support
as many services and higher-level protocols as possible, so as to enable them
to be put to universal use. The fact that they are largely independent of the
operating systems on the terminals also contributes to the universal
applicability of coupling elements. It is of course also possible to protect
individual terminals with security coupling elements. The performance
capability of the equipment, however, often results in higher costs. Coupling
elements are by definition incomplete OSI systems. Consequently the
implementation of security services is also limited to the layers where the
coupling element is located.
There are also mixed forms in use. This relies on the precondition that security
terminals and security coupling elements must be dovetailed with each other,
particularly with regard to the security mechanisms and security parameters
that they use (such as cryptographic keys).
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000