IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
of aspects to be observed for correct operation of the various protocols and
services is provided in S 5.39 Secure Use of Protocols and Services. Using
this as a basis, filter rules must be drawn up (see S 2.76 Selection and
Implementation of Suitable Filter Rules).
In addition to the establishment and implementation of filter rules, the
following organisational regulations are required:
- Persons-in-charge should be appointed for the establishment,
implementation and testing of the filter rules. It must be clarified who is
authorised to alter filter rules, e.g. for testing new services.
- It must be determined which information is logged and who assesses these
protocols. All connections which were correctly established and those
which were denied must be logged. Logging must comply with the data
privacy regulations.
- The users must be informed in detail of their permissions, particularly with
regard to the extent of the data filtering.
- Attacks on the firewall should not only be successfully prevented, but also
detected at an early stage. Attacks can be detected by assessing the log
files. On the basis of predefined events, e.g. repeated entry of an incorrect
password on an application gateway, or attempts to establish forbidden
connections, the firewall should also be able to issue warnings or even
trigger actions.
- It should be clarified which actions are started in the event of an attack,
whether the attacker should be traced, for example, or whether the external
network connection should be cut off. As this can have a great effect on
operation of the network, persons-in-charge must be appointed who are
able to decide whether an attack is present and what action should be taken.
The tasks and authority for the persons and functions in question must be
clearly stipulated.
The following questions must be clarified when determining the security
policy:
- What damage can be caused to the network requiring protection if the
firewall is passed? As there is no such thing as absolute protection, it must
be decided whether the maximum possible damage is acceptable or
whether additional measures must be taken.
- What is the remaining risk when the firewall is operating correctly? This
may be vulnerabilities in the equipment and operating systems used.
- How quickly is an attack on the firewall detected?
- Which protocol information is still available after a successful attack?
- Are the users willing to accept the limitations caused by the firewall?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000