IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.74 Selection of a suitable packet filter
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
Packet filters are routers or computers with special software which use the
information in layers three and four of the TCP/IP protocol family (IP, ICMP,
ARP, TCP and UDP) for filtering packets. Access and deny lists are used in
this regard.
In the event that a packet filter is required for a firewall, the following
demands should be made upon purchase:
- The filtering must be possible separately for each interface.
- It must be possible to filter incoming and outgoing packets separately.
- The filtering must be possible separately for individual computers or for
complete sub-networks according to source and destination address.
- The filtering must be possible separately according to source and
destination port.
- The order in which the filter rules are evaluated should not be
automatically changed by the packet filter.
- The order in which the filter rules are evaluated should be easily
recognised, i.e. sufficiently documented.
- The entry and control of filter rules must be simple and clear, e.g. by
symbolic service and protocol names.
- In case of TCP packets, it should be possible to determine whether an
existing connection is being used or a connection is being established, i.e.
to distinguish between packets with and without ACK.
- It must be possible to record IP numbers, service, time and date for each
packet. Selective logging for certain packets (e.g. only packets with a
specific source address) has also to be possible.
- It must be possible to send all logging information to an external host.
- Special, adjustable events must lead to an immediate warning (e.g.
repeated incorrect authentication attempts).
- If a router is used as a packet filter, it should be possible to use static
routing tables. In general, however, routers should not be used as packet
filters as they have a very wide range of functions so that the filter
attributes are often just offered as add-ons. This accordingly influences the
creation and testing of the related software.
- If a router is used as a packet filter, dynamic routing must be configured in
such a way that routing packets (e.g. RIP) which affect the network
requiring protection are only permitted on the interface connected to the
network requiring protection.
- It must be possible to reject packets with source routing information by
default.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000