IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- Availability of information from the external network in the internal
network requiring protection (the availability of this information is
secondary to the protection of the local computers and information,
however),
- Protection against attacks based on IP spoofing or which abuse the source
routing option, the ICMP protocol, or routing protocol,
- Protection against attacks as a result of the leaking of new software
weakness relevant to security. (As it must be considered that the number of
potential attackers using an Internet connection is very high, as is their
expertise, this security objective is of particular importance).
Based on the security objectives, a security policy must be drawn up which
stipulates the tasks of, and requirements placed on, the firewall. This security
policy must be included in the IT security strategy of the organisation and thus
agreed with the IT management.
The firewall security policy is put into effect by the implementation of the
firewall, the selection of suitable hardware components, such as packet filters
and application gateways, and the careful implementation of filter rules.
Note:
Packet filters are IT systems with special software which filter the
information of the lower layers of the OSI model and pass on or intercept
packets in accordance with special regulations (see S 2.74 Selection of a
Suitable Packet Filter).
An application gateway is a computer which filters the information of the
application layer and permits or forbids connections in accordance with
special regulations (see S 2.75 Selection of a Suitable Application
Gateway). Whilst packet filters work on layer 3 and 4 of the OSI model,
gateways work on layer 7 and are thus considerably more complex. An
application gateway is generally implemented on an IT system which is
used solely for this purpose and whose command set is reduced to a
minimum.
In order for a firewall to offer effective protection of a network against
external attacks, several fundamental factors must be fulfilled:
- All communication between the two networks must be carried out via the
firewall. To achieve this, it must be ensured that the firewall is the only
connection between the two networks. Provisions must be taken so that no
other external connections bypassing the firewall are permitted (see also S
2.77 Secure Configuration of Other Components).
- A firewall must only be used as a protective connection to the internal
network. Only the services required for this purpose must be available on
the firewall, therefore, and no other services must be offered, such as
remote log-in.
- Administrative access to the firewall must only be possible via a secure
route, e.g. via a secure console, an encrypted connection or a separate
network. For the establishment of a secure console, see S 1.32
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000