IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.39 Secure use of protocols and services
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: IT Security Management, Administrators
The following short descriptions of the protocols and services most commonly
used on the Internet explain what information is carried by these protocols and
what is therefore eligible for filtering by a firewall. It also describes other
points which should be borne in mind when using the various protocols and
services.
With a TCP/IP communication, a connection is normally established by a
client process from a random port with a port number > 1023 to a server
process with a port number < 1024 (well known port). The ports with numbers
< 1024 are also known as privileged ports, because they may only be used by
processes with root privileges. However, the restriction that ports < 1024 may
only be used by processes with root privileges, is only a convention and it may
be circumvented. No security strategy, therefore, may assume that the IT
systems really do protect their privileged ports in this way. Even if FTP is
used, for instance, to access ports 20 or 21, this cannot be regarded as a secure
connection.
IP
The Internet Protocol (IP) is a connectionless protocol. An IP header includes
two 32 bit addresses (IP numbers) for the target and source of the computers
communicating with each other.
As the IP numbers are not protected by cryptographic procedures, they may
only be used for authentication in very specific topographies, i.e. only when it
is certain that the addresses cannot be changed. For example, packets coming
from outside but whose source address is an address from the network to be
protected, may not be admitted by the firewall.
ARP
The Address Resolution Protocol (ARP) is used to find the correct 48 bit
hardware or Ethernet address for a 32 bit IP address. If it cannot find the
corresponding entry in the computer’s internal table, an ARP broadcast packet
is sent with the unknown IP number. The computer with this IP number then
returns an ARP response packet with its hardware address. As the ARP
response packets are not tamper-proof, they can only be used in very specific
topographies (see above).
ICMP
The Internet Control Message Protocol (ICMP) is a transport layer protocol
whose purpose is to transport error- and diagnostic information for the IP
protocol. It is initiated and processed internally by IP, TCP or UDP and may
be applied at user level by the command ping.
If a computer or network is not accessible, a message such as Destination
Unreachable is generated, and this can be misused to interrupt all connections
between the participating computers.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000