IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.70 Developing a firewall concept
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: IT Security Management
The connection of existing sub-networks with global networks, such as the
Internet, leads to a new supply of information. At the same time, the
increasing amount of local networks leads to the situation where all
workstation computers have access to a wide variety of information.
This networking gives rise to new threats, however, as it is not only possible
for information to flow into the network requiring protection from outside, but
also in the other direction. Furthermore, the possibility of remote access, i.e. a
remote computer (e.g. through the Internet) can execute commands in the
local network, poses a threat to the integrity and availability of the local
computers and thus indirectly also to the confidentiality of the local data.
A sub-network requiring protection should thus only be connected to another
network if this is essential. This particularly applies to connections to the
Internet. It should be checked to what extent the network requiring protection
can be divided into parts which cannot be connected, which can be connected
and which can be connected with limitations. It should also be checked
whether a stand-alone system is not sufficient for the connection to the
Internet (see S 5.46 Installing stand-alone systems for Internet usage).
In order to guarantee the security of the network requiring protection, a
suitable firewall must be used. For the firewall to offer effective protection,
the following conditions must be fulfilled. The fire wall must be:
- based on a comprehensive security policy
- incorporated into the IT security concept of the organisation
- installed correctly and
- administered correctly.
The connection to an external network can only take place when it has been
checked that all risks can be handled by the firewall concept and the personnel
and organisational conditions.
There are several ways to implement a firewall. In order to determine which
firewall concept is most suitable for the intended uses, it must first be clarified
which security objectives are to be fulfilled by the firewall. Examples of
security objectives are:
- Protection of the internal network against unauthorised remote access,
- Protection of the firewall against attacks from the external network, but
also against manipulation from the internal network,
- Protection of the locally transmitted and stored data against attacks on their
confidentiality or integrity,
- Protection of local network components against attacks on their availability
(this particularly applies to information servers which provide information
from the internal area for general use),
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000