IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.69 Protection against active content
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: IT Security Management, Administrators
Until recently, firewalls were considered to provide absolute protection
against attacks on one's own network from the Internet. They ensured that no
connection could be set up into the internal network from the Internet, and that
internal users could access information on the Internet without difficulty. On
account of the ever more widespread distribution of active content on WWW
pages, however, this situation has changed. Information from the Internet is no
longer simply viewed, but instead in some cases external program code is also
executed during viewing. At present this means Java, ActiveX and JavaScript;
others could be added to this list in future. There are also elements known as
plug-ins which enable other programs to be started from the browser; in some
cases this is even done automatically from an HTML page. Depending on the
type of program involved, executing it may be associated with a certain
security risk.
From today's standpoint there are several conceivable approaches to protecting
an internal network against misuse by active content from the Internet. These
are explained in the following using the examples of Java, ActiveX and
JavaScript.
Prohibition of active content on the firewall
Even today it is still possible to have very good access to the Internet without
really needing active content. This is the safest and therefore recommended
method of accessing the Internet, because in that way the firewall can continue
to exercise principal control. In order to prevent the acceptance of active
content, it is necessary to have a proxy on the application gateway, which
examines HTML pages for active content. If the proxy finds any such content,
it must be filtered out of the page. There are a number of application gateways
that offer this functionality (see S 2.75 Selection of a suitable application
gateway).
It must be assumed, however, that this solution, although it is the safest, will
be less and less acceptable in the future, because the number of pages where
the active content contains the actual information is on the increase. If the
active content is filtered out, the internal user will no longer be able to access
the information.
Note: Active content may also be hidden in e-mails; these should therefore
also be examined for such content. As encrypted communications cannot be
checked for active content, SSL-based WWW access must not be allowed if
there is central filtering.
Prohibition of active content in the WWW browser
In a network with centrally administered workstations, it is conceivable to
restrict the rights of the individual users to the extent that they are no longer
able to change the security settings of their WWW browsers. These can then
be configured in such a way that active content will not be executed. It is thus
also possible to dispense with the filtering of active content on the application
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000