chrisbst48/IT-Grundschutz-Compendium_2022_EN huggingface dataset:
ISMS.1.A6 Establishment of a Suitable Organisational Structure for Information Security [Top Management] (B)
An organisation MUST have a suitable higher-level organisational structure for information security. For this purpose, roles MUST be defined that will take on specific tasks to achieve the security objectives at hand. Qualified persons MUST also be appointed with sufficient resources to take on these roles. The tasks, roles, responsibilities, and competencies in security management MUST be defined and assigned in a transparent manner. Effective deputising rules MUST be in place for all the important functions within an information security organisation.
Communication channels MUST be planned, described, set up, and publicised. For all tasks and roles, it MUST be specified who will inform whom, who must be informed of which actions, and what information is to be provided.
It MUST be checked at regular intervals whether the organisational structure for information security is still adequate or needs to be adapted to new framework conditions.
ISMS.1.A7 Definition of Security Safeguards (B)
As part of the security process, detailed and adequate security safeguards MUST be defined for all aspects of information processing. All security safeguards SHOULD be documented systematically in security concepts. The security safeguards SHOULD be updated regularly.
ISMS.1.A8 Integration of Employees into the Security Process [Supervisor] (B)
All of an organisation's employees MUST be integrated into its security process. For this purpose, they MUST be informed about the background and the hazards relevant to them. They MUST know and implement security safeguards that affect their workplace. All employees MUST be enabled to make active contributions to security. Employees SHOULD therefore be involved at an early stage in planning security safeguards or devising organisational regulations. When introducing security policies and security tools, employees MUST be adequately informed about how these should be used. Employees MUST be made aware of the consequences of breaching security rules.
ISMS.1.A9 Integrating Information Security into Organisation-Wide Procedures and Processes [Top Management] (B)
Information security MUST be integrated into all business processes and specialised tasks. In so doing, it MUST be ensured that all necessary security aspects are not only taken into account in new processes and projects, but also in ongoing activities. The Chief Information Security Officer MUST be adequately involved in making security-relevant decisions. Moreover, information security SHOULD be coordinated with other areas of an organisation that deal with security and risk management.
NET.1.1 Network Architecture and Design
Target Object: Network / Order: R2
NET.1.1.A1 Security Policy for the Network [IT Operation Department] (B)
Based on an organisation's general security policy, a specific policy SHOULD be drawn up for its network. It MUST comprehensibly describe requirements and specifications on how to design and construct networks securely. The policy MUST include definitions of the following: • The cases in which zones have to be segmented and user groups or clients have to be separated logically, or even physically • Which communication relationships and which network and application protocols are permitted in each case • How the data traffic for administration and monitoring is to be separated in the network • What type of internal communication (WAN, wireless networks) is allowed across locations and what encryption is required on WAN, LAN, or radio links • What type of cross-location communication is permitted All the employees responsible for network design MUST be familiar with the policy. It MUST form the basis of their work. If the policy is changed or there are deviations from the requirements specified, this MUST be documented and agreed with the CISO in charge. The correct implementation of the policy MUST be regularly reviewed. The results MUST be documented in an appropriate manner.
NET.1.1.A10 DMZ Segmentation for Access from the Internet (B)
An organisation's firewall structure MUST be complemented by an external DMZ for all services and applications that can be accessed from the Internet. A concept for DMZ segmentation SHOULD be drawn up that implements the corresponding security policy and requirements specification in a transparent manner. Depending on the security level of the IT systems at hand, the DMZ segments MUST be divided further. An external DMZ MUST be connected to the external packet filter.
NET.1.1.A11 Protection of Communications Entering the Internal Network from the Internet (B)
IP-based access to an internal network MUST run through a secure communication channel. Access MUST be restricted to trusted IT systems and users (see NET.3.3 VPN). VPN gateways of this kind SHOULD be placed in an external DMZ. It SHOULD be ensured that adequately hardened VPN gateways can be accessed directly from the Internet. Access attempts to an internal network that are authenticated via a VPN gateway MUST at least pass through an internal firewall. IT systems MUST NOT access an internal network via the Internet or an external DMZ. It SHOULD be ensured that any exceptions to this requirement are covered in the relevant application- and system-specific modules.
NET.1.1.A12 Protection of Outgoing Internal Communication to the Internet (B)
Outgoing communication from an internal network to the Internet MUST be decoupled through a security proxy. This decoupling MUST take place outside of the internal network. If a P-A-P structure is in use, the outgoing communication SHOULD always be decoupled by the security proxies of the P-A-P structure.
NET.1.1.A13 Network Planning (B)
Every network implementation MUST be planned in a suitable, comprehensive, and transparent manner. In this context, the security policy and the requirements specification in question MUST be observed. In addition, the following aspects MUST be considered at minimum in the planning in accordance with the needs at hand: • The connection to the Internet and, if available, the local network and extranet • The topology of the overall network and network areas (i.e. zones and network segments) • The capacity and redundancy of the network and security components, transmission routes, and external connections • The protocols to be used and their general configuration and addressing (in particular, IPv4/IPv6 sub-networks of terminal device groups) • Administration and monitoring (see NET.1.2 Network Management) Network plans MUST be regularly reviewed.
NET.1.1.A14 Implementation of Network Planning (B)
Planned networks MUST be implemented properly. This MUST be verified during the approval process.
NET.1.1.A15 Regular Gap Analysis (B)
Regular checks MUST be conducted to ensure that a given network corresponds to the target condition. At minimum, the extent to which it complies with the relevant security policy and requirements specification MUST be checked. The extent to which the implemented network structure corresponds to the current network plans MUST also be checked. To this end, responsible persons and test criteria or specifications MUST be defined.
NET.1.1.A16 Specification of Network Architecture (S)
Based on the security policy and the requirements specification at hand, an architecture for a network's zones (including the internal network, DMZ, and external connections) SHOULD be developed and consistently maintained. In this context, all the relevant architectural elements of the respective organisation SHOULD be taken into account based on its specific situation. The following, however, are necessary at minimum: • The architecture of the internal network, including specifications on how network virtualisation technologies, layer 2 and layer 3 communication, and redundancy procedures are to be used • The network architecture for external connections, including firewall architectures, DMZ and extranet design, and specifications for site coupling • Specifications of the network locations where security components such as firewalls or IDS/IPS should be placed and the security functions they should provide • Specifications for the network connections of the different IT systems at hand • The network architecture in virtualisation hosts, with a particular focus on network virtualisation overlays (NVOs) and the architecture in vertically integrated systems (ViS) • Specification of the basic architecture elements for a private cloud, as well as protection of the connections to virtual private clouds, hybrid clouds, and public clouds • Architecture for secure administration and monitoring of IT infrastructure
NET.1.1.A17 Specification of Network Design (S)
Based on the network architecture in question, the network design for the zones (including the internal network, the DMZ, and external connections) SHOULD be developed and consistently maintained. To this end, the relevant architectural elements SHOULD be considered in detail, including the following points at minimum: • Admissible forms of network components, including virtualised network components • Specifications on how WAN and wireless connections should be protected • The connection of end devices to switching components, connections between network elements, and the use of communication protocols • Redundancy mechanisms for all network elements • An address concept for IPv4 and IPv6, as well as associated routing and switching concepts • Virtualised networks in virtualisation hosts, including NVOs • The structure, connection, and protection of private clouds and the secure connection of virtual private clouds, hybrid clouds, and public clouds • Specifications regarding network design for the secure administration and monitoring of IT infrastructure
NET.1.1.A18 P-A-P Structure for the Internet Connection (S)
An organisation’s network SHOULD be connected to the Internet via a firewall with a P-A-P structure (see NET.1.1.A4 Network Separation into Zones). A proxy-based application layer gateway (ALG) MUST be implemented between the two firewall levels. The ALG MUST be connected via its own transfer network (dual-homed) to both the external packet filter and the internal packet filter. The transfer network MUST NOT be occupied with tasks other than those performed for the ALG. If no ALG is used, appropriate security proxies MUST be implemented. The security proxies MUST be connected via a separate transfer network (dual-homed). The transfer network MUST NOT be occupied with tasks other than those performed for the security proxies. Whether mutual attacks are possible via the security proxies MUST be checked. If this is the case, the transfer network MUST be appropriately segmented. All data traffic MUST be decoupled via the ALG or the corresponding security proxies. A transport network that connects both firewall stages with each other MUST NOT be configured. In addition, the internal firewall MUST reduce the exposure of the ALG or the security proxies to internal attackers or IT systems in the internal network. Authenticated and trusted network access attempts from the VPN gateway to the internal network SHOULD NOT pass through the ALG or the security proxies of the P-A-P structure.
NET.1.1.A19 Separation of Infrastructure Services (S)
Servers providing basic services for IT infrastructure SHOULD be positioned in a dedicated network segment. Communication with them SHOULD be controlled by a stateful packet filter (firewall).
NET.1.1.A2 Documentation of the Network [IT Operation Department] (B)
Complete documentation of the network MUST be produced. It MUST include a network plan. The documentation MUST be consistently maintained. This documentation MUST contain the initial survey of the actual situation (including network performance) and all changes made to the network. The logical structure of the network MUST also be documented—in particular, the assignment of sub-networks and the zoning and segmentation of the network.
NET.1.1.A20 Allocation of Dedicated Sub-Networks for IPv4/IPv6 End Device Groups (S)
Different IPv4/IPv6 end devices SHOULD be allocated to dedicated sub-networks according to the protocol used (IPv4/IPv6 or IPv4/IPv6 DualStack).
NET.1.1.A21 Separation of the Management Area (S)
Out-of-band management SHOULD be used comprehensively to manage infrastructure. In this context, all the end devices required to manage IT infrastructure SHOULD be positioned in dedicated network segments. The communication with these end devices SHOULD be controlled by a stateful packet filter. The communication from and to these management network segments SHOULD be restricted to the necessary management protocols with defined communication end points. The management area SHOULD include at least the network segments below. Depending on the security policy and the requirements specification at hand, these SHOULD be further subdivided into the following: • Network segment(s) for IT systems that are responsible for the authentication and authorisation of administrative communication • Network segment(s) for the administration of IT systems • Network segment(s) for monitoring • Network segment(s) containing the central logging system, including the syslog server and SIEM server • Network segment(s) for IT systems that are required for basic services of the management area • Network segment(s) for the management interfaces of the IT systems to be administered The different management interfaces of the IT systems at hand MUST be separated according to their purpose and their network position via a stateful packet filter. In addition, the following IT systems (management interfaces) SHOULD be separated via dedicated firewalls: • IT systems that can be accessed from the Internet • IT systems in the internal network • Security components located between the IT systems accessible from the Internet and the internal network It MUST be ensured that the segmentation cannot be circumvented by management communication. The possibility of bypassing segments MUST be prevented.
NET.1.1.A22 Specification of the Segmentation Concept (S)
Based on the specifications of the network architecture and network design at hand, a comprehensive segmentation concept SHOULD be created for the respective internal network. This segmentation concept SHOULD include any existing virtualised networks in virtualisation hosts. The segmentation concept SHOULD be planned, implemented, followed, and consistently maintained. The concept SHOULD comprise at least the following aspects, assuming they are planned in the target environment: • Network segments to be created initially, as well as specifications on how new network segments are to be created and how end devices should be positioned in the network segments • Specification for the segmentation of development and test systems (staging) • Network access control for network segments with clients • Connection of network areas that are connected to the network segments via wireless technologies or a dedicated line • Connection of the virtualisation hosts and virtual machines on the hosts to the network segments • Data centre automation • Specifications on how end devices that supply several network segments, such as load balancers and storage and backup solutions, are to be incorporated Depending on the security policy and the requirements specification at hand, a concept SHOULD be developed that describes how each network segment is to be implemented in networking terms. In addition, the security functions that must be provided by the coupling elements between the network segments (e.g. a firewall as a stateful packet filter or IDS/IPS) SHOULD be defined.
NET.1.1.A23 Separation of Network Segments (S)
IT systems with different protection needs SHOULD be placed in different network segments. If this is not possible, IT systems SHOULD be protected according to the highest protection needs present in their network segment. In addition, network segments SHOULD be further divided depending on their size and the requirements of the segmentation concept in question. It MUST be ensured that it is not possible to bypass network segments, much less zones. If the virtual LANs (VLANs) on a switch belong to different organisations, they SHOULD be physically separated. Alternatively, data SHOULD be encrypted to protect the transmitted information from unauthorised access.
NET.1.1.A24 Secure Logical Separation using VLAN (S)
If VLANs are used, they MUST NOT create a connection between a given internal network and a zone before the ALG or the security proxies. In general, it MUST be ensured that VLANs cannot be overwhelmed.
NET.1.1.A25 Detailed and Implementation Planning of Network Architecture and Design (S)
Detailed and implementation planning for network architecture and design SHOULD be carried out, documented, reviewed, and consistently maintained.
NET.1.1.A26 Specification of Operating Processes for the Network (S)
Operating processes SHOULD be created, adapted as required, and documented. In particular, the impact of zoning and segmentation concepts on IT operations SHOULD be considered.
NET.1.1.A27 Integration of Network Architecture into Contingency Planning [IT Operation Department] (S)
The impact that network architecture and concepts derived from it have on contingency planning SHOULD be analysed initially and at regular intervals in a transparent way.
NET.1.1.A28 High-Availability Network and Security Components (H)
The central areas of an internal network and the security components in place SHOULD be designed for high availability. To this end, the components SHOULD be designed redundantly and realised with high internal availability.
NET.1.1.A29 Implementing Network Connections for High Availability (H)
Network connections (e.g. Internet and WAN connections) SHOULD be designed with full redundancy. Depending on the availability requirements at hand, redundant connections to one or more providers SHOULD be implemented with different technology and performance. Redundant routes SHOULD also be implemented as needed both within and outside of an organisation's purview. To this end, possible single points of failure (SPoF) and disruptive environmental conditions SHOULD be considered.
NET.1.1.A3 Specification of Network Requirements (B)
A requirements specification MUST be created based on the security policy for the network in question. The specification MUST be consistently maintained. It MUST be possible to derive all the essential elements of network architecture and design from these requirements.
NET.1.1.A30 Protection Against Distributed Denial of Service (H)
In order to fend off DDoS attacks, the available bandwidth SHOULD be purposefully distributed over different communication partners and protocols by means of bandwidth management. In order to be able to thwart DDoS attacks with very high data rates, mitigation services SHOULD be purchased via larger Internet service providers (ISPs). Their use SHOULD be contractually regulated.
NET.1.1.A31 Physical Separation of Network Segments (H)
Depending on the security policy and requirements specification at hand, network segments SHOULD be physically separated by separate switches.
NET.1.1.A32 Physical Separation of Management Network Segments (H)
Depending on the security policy and requirements specification at hand, the network segments of a management area SHOULD be physically separated from each other.
NET.1.1.A33 Micro-Segmentation of the Network (H)
A network SHOULD be divided into small network segments with very similar requirement profiles and the same protection needs. This SHOULD be considered for DMZ segments in particular.
NET.1.1.A34 Use of Cryptographic Methods at the Network Level (H)
Network segments SHOULD already be realised at the network level in a given internal network, extranet, and DMZ by means of cryptographic techniques. To this end, VPN techniques or IEEE 802.1AE SHOULD be used. If communication within an internal network or DMZ takes place via transmission routes which are not sufficiently secure for increased protection needs, the communication SHOULD be adequately encrypted at the network level.
NET.1.1.A35 Use of Network-Based DLP (H)
Systems for data loss prevention (DLP) SHOULD be implemented at the network level.
NET.1.1.A36 Separation by Means of VLAN for Very High Protection Requirements (H)
In cases involving very high protection needs, VLANs SHOULD NOT be used.
NET.1.1.A4 Network Separation into Zones (B)
The overall network at hand MUST be physically separated into at least the following three zones: internal network, demilitarised zone (DMZ), and external connections (including to the Internet and other untrusted networks). The transitions between the zones MUST be protected by a firewall. This method of control MUST follow the principle of local communication so that firewalls allow only authorised communications (whitelisting). Untrusted networks (e.g. the Internet) and trusted networks (e.g. an intranet) MUST be separated by a two-stage firewall structure consisting of stateful packet filters (firewalls). To separate the Internet and the external DMZ in the network, a stateful packet filter must be used at minimum. In the two-stage firewall architecture, all incoming and outgoing data traffic MUST be controlled and filtered by the external packet filter or the internal packet filter. A P-A-P structure consisting of a packet filter, an application layer gateway or security proxies, and a packet filter MUST always be implemented when required by the security policy or the requirements specification at hand.
NET.1.1.A5 Client-Server Segmentation (B)
Clients and servers MUST be placed in different network segments. The communication between these network segments MUST be controlled by a stateful packet filter at minimum. It SHOULD be noted that possible exceptions which make it possible to position clients and servers in a shared network segment are covered in the respective application-specific and system-specific modules. For guest access and network areas where there is no internal control of end devices, dedicated network segments MUST be established.
NET.1.1.A6 End Device Segmentation in the Internal Network (B)
The end devices positioned in a given network segment MUST correspond to a similar security level.
NET.1.1.A7 Protection of Sensitive Information (B)
Sensitive information MUST be transmitted using protocols that are secure according to the state of the art in information security unless trusted dedicated network segments (e.g. within the management network) are used for communication. If it is not possible to use such protocols, appropriate encryption and authentication techniques according to the state of the art in information security MUST be implemented (see NET.3.3 VPN).
NET.1.1.A8 Basic Protection of Internet Access (B)
Internet traffic MUST be routed through a firewall structure (see NET.1.1.A4 Network Separation into Zones). Flows of data MUST be restricted to the required protocols and communication relationships by the firewall structure.
NET.1.1.A9 Basic Protection of Communication with Untrusted Networks (B)
Every network's level of trustworthiness MUST be defined. Networks that are not trusted MUST be treated like the Internet and secured accordingly.
NET.1.2 Network Management
Target Object: IT system / Order: R2
NET.1.2.A1 Network Management Planning (B)
Network management infrastructure MUST be planned appropriately. This SHOULD address all the items listed in the respective security policy and requirements specification for network management. The following aspects MUST be considered at minimum: • The network management areas to be separated • Possible ways to access the management servers at hand • Communication for management access • The protocols used (e.g. IPv4 and IPv6) • Requirements that management tools must fulfil • Interfaces for forwarding collected event or alarm messages • Logging (including the required interfaces to a centralised logging solution) • Reporting and interfaces to overarching solutions • Corresponding requirements to be fulfilled by the network components to be integrated