IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.13 Appropriate use of equipment for network
coupling
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Head of IT Section, Administrator
Devices used for network coupling such as routers, bridges or gateways not
only connect networks, but can also be used for the physical or logical
segmentation of networks. Availability can be enhanced by segmenting large
networks into sub-networks, as a failure then affects only a limited part of the
network and can be located more quickly. With an increasing number of
network stations, response times can become unacceptable, and the need may
arise to establish sub-networks for load balancing. Protection of sensitive
information may be another reason for segmentation of networks so as to
ensure that such information is not available throughout the network. For
protection against external perpetrators, it may be advisable to allow transfer
of packets only from a secure to a non-secure network; on the other hand, for
protection of confidential data it may be advisable to bar transfer of packets
from a secure to a non-secure network.
A segmentation or coupling of networks can be performed on various layers in
accordance with the OSI model. In this model, network coupling elements
comprise, for example, repeaters on the physical layer (layer 1), bridges on the
data link layer (layer 2), routers on the network layer (layer 3) and, in general,
gateways on the application layer (layer 7). The illustration below is intended
to provide a clearer understanding of the OSI model.
The OSI/ISO reference model
Connection with another network on a higher layer (from layer 3 onwards) of
the OSI model allows, for example, the data flow to be regulated in
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000