IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.76 Selection and implementation of suitable filter
rules
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
Establishing and updating filter rules for a firewall is not a simple matter. The
administrator must have an in-depth knowledge of the protocols used and be
trained accordingly.
When establishing the filter rules, the following points should be observed:
- The rules should be formulated in such a way that all accesses which are
not explicitly allowed are forbidden.
- If user-specific authentication is required, it must be clarified which users
are in the inner network, which services they may use and which
authentication processes are to be used.
- All computers in the inner network must be taken into consideration.
- It must be determined which services are to be available at what times. If
an organisation has fixed working times and employees are only present
between 7 am and 7 pm, for example, no connection should be established
outside the usual working times.
The filter rules should be summarised in a table, with one axis representing the
destination computer addresses, and the other axis the source computer
addresses. The entries contain the permissible port numbers, the top one being
the source port, the lower the destination port. Packet filters can check the
packets immediately after receipt or before rerouting them. Here, filtering
should be performed for the packets entering the packet filter. Furthermore,
the packet filter should be configured in such a way that only the addresses of
the computers connected to the interface are permitted as the sender address.
Addresses connected with other interfaces are not permitted. This reduces the
threat of IP spoofing attacks.
Example:
The following table contains filter rules for the internal interface of a packet
filter between an internal network and a screened sub-net i.e. a sub-network
located between the internal and the external network and which monitors the
connections between them (see Fig. 1 in S 2.77 Secure Configuration of Other
Components).
The entries contain the permissible connections, the upper entry being the
source port, the lower being the destination port.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000