IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.68 Use of encryption procedures for network
communications
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
Communication networks transport data between IT systems. The data is
rarely transmitted via a dedicated communications line between the parties
communicating with each other. Instead, the data is routed via a number of
intermediate stations. Depending on the communication medium and the
technology used, the data can be intercepted by the intermediate stations
without authority, or also by third parties residing in the respective switching
network (for example when using the Ethernet protocol without point-to-point
networking). As the data being transmitted should not be tapped or modified
by unauthorised third parties, nor used by them for subsequent reloading into
the network (replay attacks), a suitable mechanism must be used to prevent
this happening. Encryption of the data with – if necessary – mutual
authentication of the communication partners can reduce this risk (depending
on the strength of the chosen encryption procedure and the security of the keys
used; see also Section 3.7 Crypto concept).
As a rule, applications communicate with each other in order to exchange
application-related information. Encryption of the data can then be carried out
at several levels:
- At the application level: the communicating applications each have to have
the relevant encryption and decryption mechanisms available to them.
- At the operating system level: encryption is performed by the local
operating system. All communication via the network is encrypted either
automatically or on request.
- At the network switching element level: encryption takes place between the
network switching elements (e.g. routers).
The individual mechanisms each have specific advantages and disadvantages.
Encryption at the application level has the advantage that encryption is fully
subject to the control of the respective application. One disadvantage is that
the only partner applications that can be considered for encrypted
communication are those that are equipped with the same encryption
mechanism. It is also possible to use authentication mechanisms between the
two partner applications.
In contrast with this, in the case of encryption at the operating system level
encryption takes place transparently for every application. Each application
can carry out encrypted communication with every other application, provided
the operating system on which the partner application is running has the
appropriate encryption mechanism. A drawback in this instance is that, with
regard to authentication, only the computers can be authenticated to each
other, not the respective partner applications.
Using encrypting network switching elements has the advantage that there do
not have to be any encryption mechanisms on the application or computer
side; in this case, too, encryption is transparent for the communication
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000