IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
via a router and public communication networks are to be equipped with
layer-2 encryption components. The router has to evaluate the addresses of
layer 3 in order to forward the LAN packets via the public network. However,
as all layer-3 data is hidden as a result of layer-2 encryption, evaluation of the
layer-3 addresses cannot be successfully carried out. Data transmission is
prevented because of this. To remedy this situation, the encryption
components must be used for layer 3 (upper sublayer) or higher.
Example 2: In future, a large proportion of a certain institution’s
correspondence is to be sent electronically using X.400 (layer 7). In order to
safeguard data integrity, the institution plans to use layer-4 crypto components
in the terminal devices (in this case PCs). For security purposes, cryptographic
checksums are assigned to the data packets at the sender on layer 4; these are
then checked by the associated layer-4 crypto component belonging to the
receiver. Only packets with correct checksums are to be delivered. However,
if some MTAs (Message Transfer Agents, i.e. the intermediaries for electronic
messages on layer 7) are not equipped with interoperable crypto components,
the MTAs with no crypto component cannot generate valid checksums. This
means that subsequent MTAs or terminal devices with a crypto component
have to discard the data, in accordance with the specification.
However, even if all of the MTAs that are used are equipped with
interoperable crypto components and security parameters in the same way as
the terminal devices, data integrity is not assured. Although it is possible to
safeguard the data transmission section by section, corruption of the data
within the MTAs can occur without being noticed. Furthermore (depending on
the protocol) individual layer-4 data packets could be lost, which would result
in gaps in the message as a whole – and it is the integrity and completeness of
this that is actually supposed to be protected. One remedy is to protect the
integrity of the data on layer 7.
As the examples illustrate, it is essential to investigate precisely the nature of
the network topology and to determine which network areas have to be
secured, and how, so that an appropriate solution can be found with the
desired (security) features.
Section-by-section security end-to-end security
Users of communication systems often expect security services to be provided
seamlessly throughout the system (end-to-end security), in other words from
the input of information (data, speech, images, text) at terminal A through to
output of the information at a remote terminal B. If there is no guarantee of
continuous security service, there are other systems - apart from the terminal
equipment - on which the information is present in an insecure form. For
example, if there is no end-to-end encryption to safeguard the confidentiality
of a communications relationship between two parties, the data is available in
unencrypted form in at least one other network element. These network
elements must be located, and secured by additional safeguards. Staff who
have access to insecure network elements, in particular (such as
administrators) must be accordingly trustworthy. In this case security services
are not provided seamlessly but section by section. Care must be taken that all
relevant sections are appropriately secured.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000