IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.71 Establishing a security policy for a firewall
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: IT Security Management
The first step in establishing a security policy is to determine which types of
communication with the external network are permitted. When selecting the
communication requirements, the following questions must be answered:
- Which information should the firewall allow out / in?
- Which information should the firewall conceal (e.g. the internal net
structure or the user names)?
- Which authentication procedures should be used within the network
requiring protection or for the firewall (e.g. one-time passwords or chip
cards)?
- Which access possibilites are needed (e.g. only via an Internet service
provider or also via a modem pool)?
- What data throughput is to be expected?
Selection of Services
The communication requirements are the basis for determining which services
are permitted in the network requiring protection and which must be
forbidden.
A distinction must be made between those services permitted for the users in
the network requiring protection and those permitted for external users.
If E-mail is to be received, for example, which is generally the minimum
requirement, the firewall must allow the SMTP protocol to pass through. If
files from external IT systems are to be collected, FTP must be available.
The security policy must clearly state for each service which services are
permitted for which user and/or computer and for which services
confidentiality and/or integrity must be guaranteed. Only services which are
absolutely necessary should be permitted. All other services must be
forbidden. This must be the basic principle: All services for which there are
no explicit rules must be forbidden.
It must be determined whether and which information should be filtered (e.g.
checking for computer viruses).
The security policy should be established in such a way that it can meet future
requirements, i.e. it should have a sufficient number of connection
possibilities. Any alteration at a later date must be strictly monitored and
particularly checked for side effects.
Provisions must be made for exceptions, particularly for new services and
short-notice alterations (e.g. for tests).
The filters must fulfil certain requirements: the filters using information from
the services of layers three and four of the OSI layer model (IP, ICMP, ARP,
TCP and UDP) and the filter using information from the services of the
application layer (e.g. Telnet, FTP, SMTP, DNS, NNTP, HTTP). An overview
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000