+NET.1.1.A4 Network Separation into Zones (B)

NET.1.1.A4 Network Separation into Zones (B)

The overall network at hand MUST be physically separated into at least the following three zones: internal network, demilitarised zone (DMZ), and external connections (including to the Internet and other untrusted networks). The transitions between the zones MUST be protected by a firewall. This method of control MUST follow the principle of local communication so that firewalls allow only authorised communications (whitelisting).

Untrusted networks (e.g. the Internet) and trusted networks (e.g. an intranet) MUST be separated by a two-stage firewall structure consisting of stateful packet filters (firewalls). In order to separate the Internet and external DMZ in the network, a stateful packet filter must be implemented at minimum.

In the two-stage firewall architecture, all incoming and outgoing data traffic MUST be controlled and filtered by the external packet filter or the internal packet filter.

A P-A-P structure consisting of a packet filter, an application layer gateway or security proxies, and a packet filter MUST always be implemented when required by the security policy or the requirements specification at hand.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.22 Manipulation of Information
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems