IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
data between the subnets. In addition, the filters must be configured by default
such that communications are initially restricted to the greatest possible extent
and only enabled subsequently for individual services as the requirements for
them arise. If necessary, IP-specific filtering should be considered here.
router
t f f FTP d t transfer of FTP data
Figure 3: Example of segmentation into subnetworks on layer 3 by a router
Data and network integrity
As a rule, the integrity of data up to layer 3 is ensured by the network access
protocol in use, whilst additional measures are required to ensure network
integrity, i.e. concordance between the actual network environment and the
planned physical, as well as logical, segmentation. These measures must
prevent the establishment of unauthorised or incorrect communications links,
as well as unauthorised system access which would impair the integrity of the
network.
Consequently, network integrity is essentially ensured by
- Preventing, or at least detecting, direct modifications to network
components (replacement of components or installation of new,
unauthorised components). This is termed hardware-based security.
- Preventing, or at least detecting, changes to the configuration of network
components (routing protocols, port-switching matrices or VLAN
allocations). This is termed software-based security.
For this, it is necessary to restrict physical access to the network components
to a sufficient extent (e.g. by implementing infrastructure-specific measures
for the distributor room, cabling etc.) and conceive the network management
system so as to prevent unauthorised access to the network components via the
network.
The use of network components alone does not serve to enhance protection of
the integrity of data on layer 3 (e.g. application data), although it does hinder
selective attacks on data integrity. For this purpose, network components can
be used which prevent data packets from being tapped and manipulated. Such
components comprise, for example, bridges / switches and routers which can
be used to separate a network into segments or subnetworks between which
data communications are to be controlled, restricted or configured. A mapping
of logical relationships to a physical configuration plays a key role,
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
no transfer of
FTP data possible