IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
provision should be made for monitoring and filtering the D-channel (see also
S 4.62 Use of a D-channel filter).
Circuit encrypters: The encryption of synchronous full-duplex permanent
connections must be seen as a special case, because in this case confidentiality
– even confidentiality of the traffic flow – can be guaranteed. If there is no
data pending transmission, filler data is encrypted, so that continuous "noise"
is always present on the line. The circuit encrypter represents an alternative to
installing protected circuits.
Security in packet-switched networks
In packet-switched networks it is necessary to distinguish between
connection-oriented and connectionless packet switching. In connectionoriented
packet switching, a virtual connection is set up during the connection
setup phase, as a result of which the data path through the packet network is
subsequently established. After the connection is set up, packets are routed
through the network along the same path on the basis of the assigned virtual
channel number. Transmit and/or receive addresses are no longer necessary
for this. One example is the X.25 network.
In the case of connectionless packet switching there are no connection setup
and cleardown phases. Packets are switched individually – among other things
furnished with a source address and destination address. This is typical of
LAN data traffic.
The choice of layer on which the security mechanisms take effect determines
which information components will be protected. The lower the chosen
security layer, the more comprehensive the protection of the information.
When the user data passes through the instances of layers 7 to 1 (transmitter),
additional control information is added to the data. If therefore it is important
to protect not only the user data but also the traffic flow, it makes sense to
choose a low OSI layer. On the other hand it is also the case that the lower the
chosen OSI layer, the fewer coupling elements (repeaters, bridges, switches,
routers, gateways) can be overcome transparently.
Coupling element Highest layer of
coupling element
Repeater 1
Bridge, layer-2 switch 2
Router, layer-3 switch, X.25 packet handler 3
Gateway 7
If it is intended that security services should take effect beyond coupling
elements, they must be implemented in a layer above the highest layer (or
sublayer) of the coupling elements. This ensures that the communication
equipment can forward the secured information unprocessed and
uninterpreted.
Examples and consequences of incorrect network configurations:
Example 1: In order to guarantee confidentiality, in particular in the sphere of
public communication networks, all terminal devices in two LANS coupled
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000