chrisbst48/IT-Grundschutz-Compendium_2022_EN huggingface dataset:
NET.3.3.A3 Secure Installation of VPN End Devices (B)
If an appliance that requires maintenance is used, this MUST be subject to a valid maintenance contract. It MUST be ensured that VPN components are only installed by qualified personnel. The installation of VPN components and any deviations from the planning specifications at hand SHOULD be documented. The functions and the selected security mechanisms of a VPN MUST be checked before it is put into operation.
NET.3.3.A4 Secure Configuration of a VPN (B)
Secure configurations MUST be established for all VPN components. This SHOULD be documented in a suitable manner. The administrator in charge MUST check regularly that these configurations are still secure and adapt them to all the IT systems at hand (if applicable).
NET.3.3.A5 Blocking Unneeded VPN Accounts (B)
It MUST be checked regularly that only authorised IT systems and users can access a given VPN. VPN access that is no longer required MUST be disabled promptly. VPN access MUST be limited to the usage time required.
NET.3.3.A6 Analysis of VPN Requirements (S)
A requirements analysis SHOULD be performed to determine the usage scenarios for a given VPN and use them as a basis for deriving the specifications that the corresponding hardware and software components will need to fulfil. The requirements analysis SHOULD take into consideration the following: • Business processes and specialised tasks • Access routes • Identification and authentication procedures • Users and user authorisations • Responsibilities • Reporting channels
NET.3.3.A7 Planning the Technical VPN Implementation (S)
In addition to the general planning required (see NET.3.3.A1 Planning the Use of VPNs), the technical aspects of a VPN SHOULD be planned carefully. Encryption methods, VPN end points, permitted access protocols, services, and resources SHOULD be specified for the VPN. Furthermore, the sub-networks that can be accessed via VPN SHOULD be defined. (See NET.1.1 Network Architecture and Design.)
NET.3.3.A8 Drawing Up a Security Policy for VPN Usage (S)
A security policy SHOULD be created for VPN usage. All the relevant employees SHOULD be made aware of this policy. The security safeguards described in the security policy SHOULD be explained through related training. If VPN access is set up for an employee, they SHOULD be issued an information sheet detailing the most important VPN security mechanisms. All VPN users SHOULD be obligated to comply with the security policy.
NET.3.3.A9 Selection of Suitable VPN Products (S)
When selecting VPN products, an organisation SHOULD consider its requirements regarding the networking of different locations and the connections of mobile employees and teleworkers.
NET.4.1 Telecommunications Systems
Target Object: IT system / Order: R2
NET.4.1.A1 Requirements Analysis and Planning for Telecommunications Systems [IT Operation Department] (B)
Prior to the procurement or expansion of a PBX system, a requirements analysis MUST be carried out. This analysis MUST determine the functions the PBX system should offer. In addition to the features of the PBX system, the number of required connections and ports MUST also be determined. Possible expandability and basic security functions MUST also be considered during planning. In addition, support and maintenance contracts for the PBX system MUST be taken into account as required. Based on the requirements determined, the use of the PBX system MUST then be planned and documented. The requirements identified and the plans devised MUST be coordinated with the corresponding persons responsible for IT.
NET.4.1.A10 Documentation and Revision of the Telecommunications System Configuration [IT Operation Department] (S)
The configurations of PBX systems SHOULD be suitably documented and updated. Such configurations MUST be evaluated at regular intervals. The results of the evaluation SHOULD at least be presented to the Chief Information Security Officer, the Process Owner, and other specifically appointed persons.
NET.4.1.A11 Decommissioning Telecommunications Systems and Devices [IT Operation Department] (S)
The disposal of PBX systems and connected PBX devices SHOULD be considered in an organisation's general security policy. All the data stored on PBX systems or devices SHOULD be securely erased before disposal.
NET.4.1.A12 Backup of Configuration Files (S)
The configuration and application data of PBX systems SHOULD be backed up during their initial setup and then on a regular basis, particularly after modifications. Whether the backups of PBX systems can actually be used as a basis for system recovery SHOULD be regularly checked and documented. A backup concept SHOULD be drawn up for PBX systems and coordinated with an organisation's general data protection concepts for servers and network components.
NET.4.1.A13 Acquisition of Telecommunications Systems (S)
The results of requirements analysis and planning SHOULD be factored into the procurement of PBX systems. When procuring a PBX system, the need for both digital and analogue subscriber connections SHOULD be considered. Furthermore, existing communication systems and components SHOULD be taken into account in the procurement process.
NET.4.1.A14 Contingency Planning for Telecommunication Systems (S)
A contingency plan SHOULD be drawn up for PBX systems. This SHOULD be integrated in an organisation's contingency concept. Regular emergency drills SHOULD be carried out for PBX systems.
NET.4.1.A15 Emergency Calls in the Event of a Telecommunications System Failure (S)
It SHOULD be ensured that emergency calls can be made from a given organisation even in the event of a PBX system failure. The emergency call facilities SHOULD be accessible and sufficiently close to all rooms.
NET.4.1.A16 Securing End Devices in Openly Accessible Rooms (S)
The range of functions of end devices set up in openly accessible rooms SHOULD be restricted. If this is not possible, end devices SHOULD be protected against unauthorised access in a suitable manner.
NET.4.1.A17 Maintenance of Telecommunications Systems (S)
Devices for maintaining and configuring PBX systems SHOULD be secured with passwords or PINs.
NET.4.1.A18 Increased Access Protection (H)
A PBX system SHOULD be located in a separate and suitably secured room. Site and system access to PBX systems SHOULD be restricted to a specific group of people. External staff SHOULD ONLY be able to access PBX systems with supervision.
NET.4.1.A19 Redundant Connections (H)
PBX system connections SHOULD be redundant. An additional PSTN connection SHOULD be available for IP-based PBX systems.
NET.4.1.A2 Selection of Telecommunications Service Providers [IT Operation Department] (B)
In order to be able to make calls to persons who are not connected to a given organisation's own PBX system, a PBX service provider MUST be contracted. The requirements for the PBX system, the relevant security policy, and contractual and financial aspects MUST be taken into account. All services agreed MUST be specified clearly and concisely in writing.
NET.4.1.A5 Logging for Telecommunications Systems (B)
Suitable data MUST be recorded for PBX systems and evaluated as required. Additionally, all evaluation procedures, data transmissions, data access, and system-related interventions that involve program modifications MUST be logged. All administration work on PBX systems MUST also be logged. The logged information SHOULD be checked regularly.
NET.4.1.A6 Creating a Security Policy for Telecommunications Systems [IT Operation Department] (S)
Organisations SHOULD create a specific security policy for their PBX systems based on their general security policies. PBX security policies SHOULD include basic statements about confidentiality, availability, and integrity. All persons and groups involved in the procurement, design, implementation, and operation of PBX systems SHOULD be familiar with the security policy for PBX systems and use it as the basis for their work. The central security requirements for a given PBX system and the security level to be achieved SHOULD be included in the respective organisation's general security policy.
NET.4.1.A7 Suitable Installation of the Telecommunications System (S)
A PBX system SHOULD be located in a suitable room. The interfaces on the PBX, especially those that are unused, SHOULD be suitably protected.
NET.4.1.A8 Limitation and Blocking of Unnecessary or Security-Critical Features (S)
The scope of available features SHOULD be limited to the necessary minimum. Only the features needed SHOULD be activated. The features not required or deemed critical due to their potential for misuse SHOULD be disabled on the central system to the greatest extent possible. Additional protective safeguards SHOULD be implemented for the confidential data stored on or retrievable from the end devices in use.
NET.4.1.A9 Training on the Secure Use of Telecommunications Systems [Supervisor] (S)
Users of PBX systems SHOULD be instructed in the correct use of related services and devices. Users of PBX systems SHOULD be provided with all the required documents regarding the operation of corresponding end devices. Any anomalies and abnormal behaviour of PBX systems SHOULD be reported to the relevant person in charge.
NET.4.2 VoIP
Target Object: IT system / Order: R2
NET.4.2.A1 Planning the Use of VoIP (B)
The conditions required for the use of VoIP MUST be specified. Among other things, it MUST be decided whether to switch completely or partially to VoIP. Special requirements for the availability of VoIP or the confidentiality and integrity of telephone calls or signalling information SHOULD be determined in advance. Suitable signalling and media transport protocols MUST be selected prior to use. It SHOULD be decided whether and how VoIP infrastructure should be connected to public (data) networks. The capacities and design of existing data networks SHOULD be taken into account during planning.
NET.4.2.A11 Secure Handling of VoIP End Devices [User] (S)
Users of VoIP end devices SHOULD be aware of the basic VoIP threats and security safeguards. In addition, they SHOULD select suitable passwords to secure voicemails.
NET.4.2.A12 Secure Decommissioning of VoIP Components (S)
When VoIP components are decommissioned or replaced, all security-relevant information SHOULD be deleted from the devices. After data is deleted, it SHOULD be verified that the data was deleted successfully. Confidential information SHOULD also be deleted from backup media. All labels, especially on end devices, SHOULD be removed before disposal. Safeguards for deleting security-related information which are compatible with the applicable conditions of contracts and guarantees SHOULD be clarified in advance with manufacturers, retailers, or service providers.
NET.4.2.A13 Firewall Requirements When Using VoIP (S)
Organisations SHOULD check whether their firewalls can be adapted for the use of VoIP. If this is not the case, an additional firewall SHOULD be purchased and installed.
NET.4.2.A14 Encryption of Signalling (H)
The integrity and confidentiality of signalling information SHOULD be ensured by appropriate cryptographic procedures. Along with the actual payloads, authentication data SHOULD also be continuously encrypted. Access to VoIP gateways SHOULD be restricted to the greatest possible extent with the help of VoIP addresses and H.323 identities. Additional end-to-end security mechanisms SHOULD be used for media transport and signalling. The way in which signalling is protected SHOULD be documented.
NET.4.2.A15 Secure Media Transport Using SRTP (H)
For transmissions using the Real-Time Transport Protocol (RTP), media data and information for controlling such data SHOULD be appropriately protected. The user data SHOULD be protected by the use of Secure Real-Time Transport Protocol (SRTP) and Secure Real-Time Control Protocol (SRTCP). The security-relevant options for implementing the protocols SHOULD be documented.
NET.4.2.A16 Network Separation for Data and VoIP (H)
VoIP networks SHOULD be separated from data networks in a suitable manner. The way in which devices that need to access VoIP and data networks are to be dealt with SHOULD be regulated. VoIP end devices in a VoIP network SHOULD ONLY be able to establish the intended VoIP connections to other IT systems.
NET.4.2.A3 Secure Administration and Configuration of VoIP End Devices (B)
End device functions that are not required MUST be disabled. The corresponding configuration settings MUST NOT be changed without authorisation. All end-device security functions SHOULD be tested prior to productive use. The security mechanisms and parameters used SHOULD be documented.
NET.4.2.A4 Restricting Accessibility via VoIP (B)
A decision MUST be taken as to how external callers will be able to access VoIP architecture. IT systems from insecure networks MUST be prevented from establishing direct data connections to an organisation's VoIP components. If all incoming and outgoing connections are to be handled via a central IT system, it SHOULD be ensured that all signalling and voice information between the public and private data networks in question is only exchanged via this authorised IT system.
NET.4.2.A5 Secure Configuration of VoIP Middleware (B)
VoIP components MUST be configured to satisfy the protection needs at hand in a suitable manner. The default configurations of VoIP middleware MUST be adapted before it is put into productive operation. All installation and configuration steps SHOULD be documented such that the installation and configuration can be understood and repeated by a qualified third party based on the documentation. All the services of VoIP middleware that are not required MUST be disabled.
NET.4.2.A7 Drawing up a Security Policy for VoIP (S)
The central security requirements for VoIP and the security level to be achieved SHOULD be included in an organisation-wide security policy. This security policy SHOULD detail all the general security-related requirements of the organisation in question. In addition, the policy SHOULD regulate the requirements for the operation and use of VoIP components. The different VoIP functions, such as voicemail, SHOULD be considered in this regard. The VoIP security policy SHOULD be available and known by all the persons and groups involved.
NET.4.2.A8 Encryption of VoIP (S)
A decision SHOULD be taken as to whether and which voice and signalling information should be encrypted. In general, all VoIP data packets leaving a secure LAN SHOULD be protected by suitable security mechanisms. Users SHOULD be informed about the use of VoIP encryption.
NET.4.2.A9 Selection of Suitable VoIP Components (S)
Before VoIP components are purchased, a requirements list SHOULD be created. The list of requirements SHOULD be used to evaluate the products available on the market. The requirements list SHOULD include all the characteristics necessary to achieve the desired security level. The manner in which the products available on the market can be evaluated according to the requirements list SHOULD be regulated.
NET.4.3 Fax Machines and Fax Servers
Target Object: IT system / Order: R2
NET.4.3.A1 Suitable Siting of a Fax Machine [Building Services] (B)
Fax machines MUST be installed in such a way that received faxes cannot be viewed or removed by unauthorised persons. Installation sites SHOULD also be selected to ensure that an adequate number of telephone communication lines or channels are available. An installation site MUST have a suitable network connection for the fax machine in question. Fax machines MUST NOT be used with network connections that were not intended for this purpose.
NET.4.3.A10 Control of Programmable Destination Addresses, Logs, and Distribution Lists (S)
Programmable speed-dial keys and saved destination addresses SHOULD be checked regularly to see if the desired numbers match the respective programmed numbers. Fax numbers that are no longer required SHOULD be deleted. Appropriate documentation SHOULD be created when a new entry is added or a recipient number is changed.
NET.4.3.A11 Preventing Fax Machine Overload [IT Operation Department] (H)
Sufficient communication lines or channels SHOULD be available. The expected fax volume SHOULD be estimated for a fax server. Components which are capable of handling this volume SHOULD be selected. Logs of fax servers SHOULD be checked regularly in order to prevent bottlenecks caused by overloads in good time. Fax data that is no longer required SHOULD be promptly deleted from fax servers.
NET.4.3.A12 Blocking Specific Recipient and Sender Fax Numbers (H)
Undesired fax addresses SHOULD be blocked. Alternatively, only specified numbers SHOULD be allowed. The appropriate approach SHOULD be determined for each individual situation.
NET.4.3.A13 Designating Authorised Fax Operators [User] (H)
Access to a fax machine SHOULD be restricted to a small number of employees. These employees SHOULD distribute incoming faxes to the recipients. The employees SHOULD be taught how to use the fax machine and how to implement the necessary security safeguards. Every authorised user SHOULD be informed about who may operate the fax machine and who is in charge of it.
NET.4.3.A14 Producing Copies of Incoming Fax Messages [User] (H)
Faxes printed on thermal paper that are needed for a longer period SHOULD be copied or scanned onto plain paper. It SHOULD be taken into account that the ink on thermal paper fades faster and becomes unreadable. Copies or scanned faxes SHOULD be archived appropriately.
NET.4.3.A15 Announcing and Acknowledging Fax Messages [User] (H)
Important faxes SHOULD be announced to the recipient before they are sent. The documents to be announced in advance SHOULD be specified. Employees who wish to send confidential fax documents SHOULD be instructed to have the recipient confirm full receipt. For important or unusual faxes, the recipient SHOULD have the sender confirm that the fax document came from them and has not been falsified. A suitable form of communication (telephone, for example) SHOULD be selected to announce or confirm fax documents.
NET.4.3.A2 Information for Employees on Using Fax Machines (B)
All employees MUST be made aware of the specifics of transmitting information by fax. They MUST also be informed that fax transmissions are only legally binding to a very limited extent. An instruction manual that is easy to understand MUST be available at every fax machine. Users SHOULD receive at least a brief tutorial on the fax client software used by a fax server. In addition, instructions on correct fax usage MUST be displayed.
NET.4.3.A3 Secure Operation of a Fax Server [IT Operation Department] (B)
Before a fax server is put into operation, a test phase SHOULD be carried out. The configuration parameters and all the changes made to the fax server's configuration SHOULD be documented. The archiving and deletion of fax data SHOULD be regulated. In addition, the functionality of the connection from the fax server to the corresponding PBX system or the public telephone network MUST be checked regularly. It MUST also be ensured that the fax server only offers fax services and is not used for any other purposes. All features and communication interface access points that are not required MUST be disabled.
NET.4.3.A4 Drawing Up a Security Policy for Fax Use (S)
A security policy for fax use SHOULD be created before a corresponding device is used. It SHOULD detail the intended type of use. In addition, the way in which incoming and outgoing faxes are to be dealt with SHOULD be regulated. A regulation on the handling of undeliverable faxes SHOULD also be drawn up. The security policy for fax use SHOULD also contain information and instructions regarding contingency planning and fallback options for fax operations.
NET.4.3.A6 Procurement of Suitable Fax Machines and Servers [Procurement Department] (S)
A requirements list SHOULD be created before fax machines and fax servers are purchased. The systems or components under consideration SHOULD be assessed using this list. The requirements list for fax machines SHOULD also include security-relevant aspects such as the exchange of subscriber IDs, the output of transmission reports, error logging, and journal management. In addition, appropriate additional security functions SHOULD be considered based on the protection needs at hand. When selecting a fax server, the requirements to be met by the respective IT system—including the operating system, communications components, and application software—SHOULD be specified and taken into consideration. The option of integrating a fax server into an existing data network and groupware system SHOULD be considered if necessary.
NET.4.3.A7 Suitable Labelling of Outgoing Fax Transmissions [User] (S)
The sender and the desired recipient SHOULD be visible on all outgoing faxes. If this information cannot be obtained from the document sent, a standardised fax cover sheet SHOULD be used. In general, a fax cover sheet SHOULD include at least the name of the organisation of the sender, the name of the contact person, the date, the number of pages, and an indication of how urgent the fax is. It SHOULD also include the name and organisation of the recipient. The fax cover sheet SHOULD be adapted for every outgoing fax as necessary.
NET.4.3.A8 Appropriate Disposal of Consumable Fax Accessories and Spare Parts (S)
All fax consumables from which information on sent and received fax messages might be retrieved SHOULD be made unreadable before disposal or disposed of by a reliable specialised company. The same procedure SHOULD also be followed for replaced parts that contain information. Maintenance companies that check or repair fax machines SHOULD be required to handle them appropriately in this regard. Regular checks SHOULD be carried out to determine whether these guidelines are being followed.
NET.4.3.A9 Using Transmission and Reception Logs (S)
The transmission processes of incoming and outgoing faxes SHOULD be logged. The communication journals available on standard fax machines SHOULD be used for this purpose. If fax machines have logging functions, they SHOULD be activated. Logging SHOULD also be activated for fax servers. A decision SHOULD be taken regarding the information that should be logged. The communication journals and log files of fax machines SHOULD be regularly evaluated and archived. They SHOULD undergo random inspections for irregularities. Unauthorised persons SHOULD not be able to access these communication journals or logged information.
OPS.1.1.2 Proper IT Administration
Target Object: Information domain/generic aspects / Order: R1
OPS.1.1.2.A10 Further Education and Information (S)
Administrators SHOULD take part in training and further education measures. This SHOULD also consider technical developments that are not currently used, but may become important to a given organisation in the foreseeable future. Training activities SHOULD be supported by a training plan. This training plan SHOULD take into account the whole team in question so that all the necessary qualifications are covered by multiple members. Administrators SHOULD regularly obtain information regarding the security of the applications, IT systems, services, and protocols they support, especially in connection with current threats and security safeguards.
OPS.1.1.2.A11 Documentation of IT Administration Tasks (S)
System changes SHOULD be documented in an appropriate and transparent form. This documentation SHOULD include: • Which changes have been performed • When the changes were performed • Who performed the changes • The basis and reasons for the changes Security-relevant aspects SHOULD be explained and highlighted in a comprehensible way.
OPS.1.1.2.A12 Provisions for Maintenance and Repairs (S)
IT systems SHOULD be maintained at regular intervals. The security aspects to be observed during maintenance and repair work SHOULD be regulated. The persons responsible for the maintenance or repair of equipment SHOULD also be specified. The maintenance tasks carried out SHOULD be documented.
OPS.1.1.2.A14 Security Vetting of Administrators [Human Resources Department] (H)
In situations involving increased protection needs, administrators SHOULD be subject to additional security vetting.