IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.77 Secure configuration of other components
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: IT Security Management, Administrators
In addition to the installation and operation of the firewall, other components
for the communication between the protected and the external network must
be correctly configured. These include, for example, information servers for
the provision of information to internal or external users, mail servers and
DNS servers.
When configuring the components, a distinction should be made as to whether
these are to be set up in the protected network, in the screened sub-net or on
the external side of the firewall. To allow a clear distinction to be made, the
area between the inner packet filter and the application gateway is referred to
as internal screened sub-net, the area between the application gateway and the
external packet filter is referred to as external screened sub-net.
External Accesses
Other external accesses to the network requiring protection, e.g. with telnet via
a modem pool, should be treated as accesses from the insecure network. This
can be achieved, for example, by installing a terminal server with connected
modems on the external side of the firewall so that access to the internal
computer can only be carried out via Telnet. If virtual private networks
(VPNs) are in use, it might be advisable to provide the required access via an
additional interface on the application gateway.
Clear regulations must be made so that no external accesses can be created
bypassing the firewall. These regulations must be made known to all
employees. It must be ensured that both the IT Security Management and the
firewall Administrator are informed of relevant plans in good time in order to
guarantee inclusion in the IT security concept and the firewall security policy.
net to be
protected
internal
mail server
packet filter packet filter
internal
info server
internal
DNS server
centrally managed
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Dual-homed
Application
Gateway
external
mail server
external
info server
external
DNS server
Figure 1: Screened sub-net with dual-homed gateway.
insecure
network