Networks and Communication

Introduction

To carry out their business operations and processes, most of today's organisations require data networks that make it possible to exchange information and data, implement shared applications, and engage in various other activities. Along with conventional end devices, these networks are connected to the networks of partner organisations and to the wider Internet. They are also incorporating more and more mobile devices and elements associated with the Internet of Things (IoT). Moreover, cloud services and services for unified communications and collaboration (UCC) are increasingly being used via data networks. The resulting benefits are undisputed. However, all these end devices and services present greater risks, as well. It is therefore important that organisations protect their own networks with secure network architecture. Building a local area network (LAN) or a wide area network (WAN) with a secure architecture requires planning. In addition, external networks that can only be trusted to a limited extent (such as customer networks or the Internet itself) must be suitably integrated.

To ensure a high level of security, additional security-relevant aspects have to be considered. Examples include the secure separation of different clients and device groups at the network level and the control of their communications through a firewall. Another important security element, especially for clients, is network access control.

Objective

The objective of this module is to establish information security as an integral component of network architecture and design.

Scoping and Modelling

Module NET.1.1 Network Architecture and Design must be applied to the entire network of a given organisation, including all its sub-networks.

The module contains basic specifications which have to be considered and met when planning, designing, and operating new networks. Requirements for the secure operation of the relevant network components, including security components such as firewalls, are not covered in this module. They are addressed in the module group NET.3 Network Components.

This module focuses on cable-based networks and data communication. However, general requirements for architecture and design, such as the necessity to physically separate network segments with zones, must be observed and met for all network technologies.

Additional specific requirements for network areas such as wireless LAN (WLAN) or storage area networks (SAN) are addressed in the module layer NET.2 Radio Networks and in module SYS.1.8 Storage Solutions. The subjects of Voice over IP (VoIP) and the underlying security infrastructure are not discussed in this module; they are addressed in module NET.4.2 VoIP.

Specific security requirements for virtual private clouds and hybrid clouds are also not the focus of this module.

Network management is considered within the scope of zoning and segmentation, while all other subjects of network management are addressed in module NET.1.2 Network Management.

Useful Resources

The BSI has published the following additional documents associated with networks:

• Secure connection of local networks to the Internet (ISi-LANA)
• “Technische Leitlinie für organisationsinterne Telekommunikationssysteme mit erhöhtem Schutzbedarf” [Technical Guideline for Internal Telecommunications Systems with Increased Protection Requirements] BSI-TL-02103, version 2.0

The International Organization for Standardization (ISO) provides guidelines for securing networks in the standard ISO/IEC 27033, “Information Technology – Security Techniques – Network Security – Part 1: Overview and Concepts to Part 3: Reference Networking Scenarios

• Threats, Design Techniques, and Control Issues”.

Introduction

Reliable network management is a basic requirement for operating state-of-the-art networks in a secure and efficient manner. To that end, network management must fully integrate all the network components at hand. Appropriate safeguards must also be implemented to protect network management communication and infrastructure.

Network management includes many important functions, such as network monitoring, component configuration, event handling, and logging. Another important function is reporting, which may be designed as a common platform for network and IT systems. Alternatively, it may be implemented in a dedicated manner as a uniform platform or as part of individual network management components.

Network management infrastructure consists of central management systems (such as an SNMP server), administration devices with software for management access, and decentralised management agents. It also includes dedicated management tools such as probes or specific measurement devices, and management protocols such as SNMP or SSH. Management interfaces such as dedicated Ethernet ports or console ports are also part of a network management infrastructure.

Objective

The objective of this module is to establish information security as an integral part of network management.

Scoping and Modelling

Module NET.1.2 Network Management must be applied to each network management system (a management system and the IT system to be managed) that is used in the information domain under consideration. The IT systems to be managed are usually individual clients, servers, or active network components (network coupling elements).

This module considers the necessary components and conceptual tasks involved in network management. System management requirements for networked clients and servers are not described here.

This module describes how network management can be structured and secured and how the related communication can be protected. However, details regarding the protection of network components, particularly their management interfaces, are covered by the module groups NET.2 and NET.3.

The logging addressed in this module should be integrated into a comprehensive logging and archiving concept (see OPS.1.1.5 Logging and OPS.1.2.2 Archiving).

Network management data must be considered in backup concepts. The requirements for this are included in module CON.3 Backup Concept.

Useful Resources

The International Organization for Standardization (ISO) provides guidelines for securing networks in the standard ISO/IEC 27033, “Information Technology – Security Techniques – Network Security – Part 1: Overview and Concepts to Part 3: Reference Networking Scenarios

• Threats, Design Techniques, and Control Issues”.

The BSI has published the document “Secure Connection of Local Networks to the Internet (ISi-LANA)” on the topic of network management.

Introduction

Wireless LANs (WLANs) can be used to create wireless local networks or extend existing wired networks. To this day, almost all the WLAN components available on the market have been based on the IEEE 802.11 standard and its additions. The manufacturer consortium Wi-Fi Alliance plays an important role in this regard as the creator of the industry-agreed “Wi-Fi” standard based on IEEE 802.11. The Wi-Fi Alliance uses the Wi-Fi quality label to confirm that a device has passed certain interoperability and conformity tests.

Within organisations, WLANs can be used to work flexibly with mobile devices and enable them to access internal networks. For this purpose, network access is established within a given organisation via access points. Because they can usually be installed quickly and easily, WLANs are also used to establish temporary networks—for example, at trade fairs or smaller events. Furthermore, network access may be offered in public spaces such as airports or train stations through hotspots. This enables mobile users to connect to the Internet or to their organisation's network. Communication then generally takes place between a central access point and the WLAN component of the end device used.

Objective

This module systematically demonstrates how WLANs can be established and operated securely in an organisation.

Scoping and Modelling

Module NET.2.1 WLAN Operation must be applied to all communication networks that are established and operated according to the standard series IEEE 802.11 and its extensions.

The module includes basic specifications that must be considered and met when establishing and operating WLANs in organisations. Requirements for the secure use of WLANs are not part of this module. The secure use of WLANs is addressed in module NET.2.2 WLAN Usage.

WLANs may be operated in two different modes depending on the needs of the operator in question and the hardware equipment available. In ad-hoc mode, two or more WLAN clients communicate directly with each other. WLANs in ad-hoc mode can set up and configure themselves independently (i.e. without a fixed infrastructure), allowing them to establish a fully meshed parallel network infrastructure. This makes ad-hoc mode unsuitable in an environment that needs to be protected; it is therefore not considered further in this module. In the majority of cases, WLANs are operated in infrastructure mode—that is, the communication of WLAN clients and the connection to wire-bound LAN segments take place via access points.

If corresponding services (e.g. RADIUS) are used for WLAN authentication, the corresponding IT systems on which the services are operated must be secured separately. The modules of the SYS.1 layer, such as SYS.1.1 General Server, can be used for this purpose.

In principle, any WLAN operations that have been established should be taken into account when implementing the modules NET.1.1 Network Architecture and Design, NET.1.2 Network Management, and DER.2.1 Security Incident Handling.

Useful Resources

The BSI has published the following additional documents related to WLAN:

• BSI Standard for Internet Security (ISi series): Secure Connection of Local Networks to the Internet (ISi-LANA)

The National Institute of Standards and Technology (NIST) has published the following additional documents on WLAN:

• NIST Special Publication 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs)
• NIST Special Publication 800-97, Establishing Wireless Robust Security Networks: A Guide to IEEE 802.11

Introduction

Wireless LANs (WLANs) can be used to create wireless local networks or extend existing wired networks. To this day, almost all the WLAN components available on the market have been based on the IEEE 802.11 standard and its additions. The manufacturer consortium Wi-Fi Alliance plays an important role in this regard as the creator of the industry-agreed “Wi-Fi” standard based on IEEE 802.11. The Wi-Fi Alliance uses the Wi-Fi quality label to confirm that a device has passed certain interoperability and conformity tests.

WLANs provide extra convenience and mobility. However, wireless communication also poses an additional risk to the security of information. That is why it is important that both IT operation departments and users be aware of possible risks that may occur if WLANs are used improperly. Users must have the knowledge required to correctly understand and apply security safeguards. In particular, they must know what is expected of them in terms of information security and how they should respond in certain situations when using WLANs.

Objective

This module is designed to show how WLANs can be used in a secure manner.

Scoping and Modelling

Module NET.2.2 WLAN Usage must be applied to all IT systems (WLAN clients) that use WLANs.

The module includes basic specifications to be considered and fulfilled when using WLANs in order to be able to counteract the specific threats. Requirements for the secure operation of WLANs are not included in this module; they are described in module NET.2.1 WLAN Operation. Moreover, the present module does not deal with general aspects of clients. These aspects are covered in module SYS2.1 General Client and in the operating-system-specific modules of the SYS layer IT Systems. Module NET.2.2 WLAN Usage should always be taken into account when implementing the modules ORP.3 Awareness and Training in Information Security and DER.2.1 Security Incident Handling.

Useful Resources

The BSI has published the following additional documents related to WLAN:

• BSI Standard for Internet Security (ISi series): Secure Connection of Local Networks to the Internet (ISi-LANA)
• The National Institute of Standards and Technology (NIST) has published the following additional documents on WLAN:

NIST Special Publication 800-153, Guidelines for Securing Wireless Local Area o Networks (WLANs)

NIST Special Publication 800-97, Establishing Wireless Robust Security Networks: A o Guide to IEEE 802.11

Introduction

Routers and switches form the backbone of today’s data networks. The failure of one or more of these devices can bring an entire IT infrastructure to a halt, which is why they require special protection.

Routers work on OSI layer 3 (the network layer) and transport data packets based on the destination IP addresses in IP headers. Routers are able to connect networks with different topologies. They are used to segment local networks or connect local networks via wide area networks. A router identifies a suitable connection between the source system or network and the destination system or network. In most cases, this is performed by forwarding data packets to the next router.

The first switches worked on OSI layer 2, but switches with different functions are now available. Manufacturers usually give their devices designations that indicate the OSI layer they support. This has resulted in the terms "layer 2", "layer 3", and "layer 4 switch", whereby layer 3 and layer 4 switches are actually already routers in functional terms. While the functions of switches and routers were originally different, they are now frequently combined in one device.

Objective

This module describes how routers and switches can be used securely.

Scoping and Modelling

Module NET.3.1 Routers and Switches must be applied to each router and switch used in the information domain under consideration.

A wide selection of different routers and switches from different manufacturers are available on the market. This module does not describe any specific requirements for certain products. It is designed to be as manufacturer-agnostic as possible.

Due to the amalgamation of the functions of routers and switches, the majority of its requirements are applicable to both routers and switches. In most instances, this module does not differentiate between these device types.

Today, nearly all the operating systems of servers and clients also offer a routing feature. This module does not mention any requirements for enabled routing features in server and client operating systems.

In addition, aspects of infrastructural security such as suitable installation, power supplies, or cabling are not covered in this module. Security requirements on these topics can be found in the respective modules of the INF Infrastructure layer.

This module does not describe any requirements for securing virtual routers and switches. The firewall features that routers and switches may offer are not addressed either. Module NET.3.2 Firewall must be implemented in this regard. Some aspects of network design and management are also important for using routers and switches and will be mentioned within the framework of the corresponding requirements. Additional information for establishing, designing, and managing a network can be found in the modules NET.1.1 Network Architecture and Design and NET.1.2 Network Management.

In principle, routers and switches should also be considered when implementing the modules ORP.4 Identity and Access Management, OPS.1.1.3 Patch and Change Management, CON.3 Backup Concept, and OPS.1.1.2 Proper IT Administration.

Useful Resources

The BSI has published further information on the security of routers and switches in the BSI Standards for Internet Security (ISi series).

The Institute of Electrical and Electronics Engineers (IEEE) has published the standards IEEE 802.1Q, “IEEE Standard for Local and Metropolitan Area Networks – Bridges and Bridged Networks”, and IEEE 802.1AE, “IEEE Standard for Local and Metropolitan Area Networks: Media Access Control (MAC) Security”.

RFC 6165, “Extensions to IS-IS for Layer-2 Systems”, and RFC 7348, “Virtual Extensible Local Area Network (VXLAN): A Framework for Overlaying Virtualized Layer-2 Networks over Layer-3 Networks”, provide further information on routers and switches.

Introduction

A firewall is a system consisting of hardware and software components that is used to securely connect IP-based data networks. It uses a firewall structure to restrict the information flow that is technically feasible to communications that are previously defined as secure in a corresponding policy. In this context, "secure" means that only the access or data streams desired between different networks are allowed.

In many cases, securing network gateways no longer involves an individual component; a whole range of IT systems takes on different tasks (e.g. filtering packets exclusively or strictly disconnecting network connections with the help of proxy features). The term "application level gateway" (ALG), which is used in this module, refers to a firewall component that controls data streams on the basis of security proxies.

A firewall is installed at the gateway between networks with differing levels of trustworthiness. Internet and intranet connections are not the only example of networks with different levels of trustworthiness. Two internal networks in the same organisation can also have different protection requirements. For example, an office communication network usually requires less protection than the network of a human resources department, where particularly sensitive personal data is transferred.

Objective

The objective of this module is to facilitate the secure use of a firewall or a firewall structure with the help of the requirements described in order to ensure secure connections between networks with different protection needs.

Not in scope and modelling

Module NET.3.2 Firewall must be applied to each firewall in the information domain under consideration.

A typical application case involves the protection of an external connection, such as at the interface between an internal network and the Internet or in situations involving links to networks of business partners. However, this module must also be applied when two internal networks with different protection needs within an organisation are linked (for example, when separating an office communication network from the network of a development department if particularly confidential data is processed there).

The present module builds upon module NET.1.1 Network Architecture and Design and includes specific requirements to be observed and complied with when procuring, establishing, configuring and operating network-based firewalls.

In order to secure networks, additional network components are typically required, such as routers and switches. The related requirements are not covered in this module, but can be found in NET.3.1 Routers and Switches. If a firewall assumes the tasks of a router or switch, the requirements included in module NET.3.1 Routers and Switches also apply to the firewall.

Furthermore, products such as next-generation firewalls (NGFW) or unified threat management (UTM) firewalls that also include functional extensions (e.g. VPN, intrusion detection and intrusion prevention systems (IDS/IPS), virus scanners, or spam filters) are not addressed. Security aspects of these functional extensions are not part of this module; they are addressed in the modules NET.3.3 VPN and OPS1.1.4 Protection Against Malware, for example.

Application detection and filtering are not addressed either. These are common features of next-generation firewalls and IDS/IPS. Since these products involve different implementations, it is advisable to consider them individually depending on the use scenario at hand. This module does not address the individual protection options for server services that are offered externally, such as through a reverse proxy or for web services with the help of a web application firewall (WAF). Furthermore, aspects of infrastructural security (e.g. appropriate installation or power supplies) are not discussed in this module; they can be found in the respective modules of the INF Infrastructure layer.

Directory services should always be included as part of the modules ORP.4 Identity and Access Management, OPS.1.1.3 Patch and Change Management, and OPS.1.1.2 Proper IT Administration.

Useful Resources

The BSI has published the following additional documents related to firewalls:

• “Technische Leitlinie für organisationsinterne Telekommunikationssysteme mit erhöhtem Schutzbedarf” [Technical Guideline for Internal Telecommunications Systems with Increased Protection Requirements] BSI-TL-02103, version 2.0
• “Cryptographic Mechanisms: Recommendations and Key Lengths: Use of Transport Layer Security (TLS)”, version: 2020-1, BSI TR-02102-2
• Secure connection of local networks to the Internet (ISi-LANA)

The National Institute of Standards and Technology (NIST) provides recommendations for using firewalls in NIST Special Publication 800-41, “Guidelines on Firewalls and Firewall Policy”.

Introduction

With the help of virtual private networks (VPNs), sensitive data can be transmitted through untrustworthy networks like the Internet. A VPN is a virtual network that is operated within another network, but logically separated from this network. A VPN only uses the network as a transport medium; it is independent of the structure and design of the network used. VPNs can use cryptographic procedures to protect the integrity and confidentiality of data. VPNs also enable the secure authentication of communication partners when several networks or IT systems are connected to each other via leased lines or public networks.

Objective

This module defines requirements for the secure and systematic planning, implementation, and operation of a VPN.

Scoping and Modelling

This module must be applied to every option that is available to access a given organisation's network via a VPN endpoint.

The module does not deal with the basics of secure networks and how to assemble them (see NET.1.1 Network Architecture and Design). Moreover, this module does not cover all the processes involved in operating a VPN. VPNs should always be included as part of the modules ORP.4 Identity and Access Management, OPS.1.1.3 Patch and Change Management, OPS.1.2.5 Remote Maintenance, OPS.1.1.2 Proper IT Administration, and CON.1 Crypto Concept.

Recommendations on how to configure the operating systems of VPN end points are not part of this module either. Corresponding requirements are included in the modules SYS.1.1 General Server and SYS.2.1 General Client, as well as in the relevant operating-system-specific modules of the IT-Grundschutz Compendium.

Useful Resources

The BSI has published the advanced document “Virtuelles Privates Netz (ISi-VPN): BSI-Leitlinie zur Internet Sicherheit (ISi-L)” [Virtual Private Network (ISi-VPN): BSI Guideline on Internet Security (ISi-L)” on the topic of VPNs.

The International Organization for Standardization (ISO) provides guidelines for the use of VPNs in the standard ISO/IEC 27033-5:2013, “Information Technology – Security Techniques

• Network Security – Part 5: Securing Communications Across Networks Using Virtual Private

Networks (VPNs)”.

The National Institute of Standards and Technology (NIST) provides general guidelines for the use of VPNs in Special Publication 800-77, “Guide to IPsec VPNs”.

Introduction

Using a telecommunication system (also known as a PBX system), an organisation’s telephones can be connected internally and to an external public telephone network. Due to the increasing integration of IT and telecommunications, PBX systems can be both analogue and IP-based. Hybrid systems, meanwhile, combine a classic telecommunications solution with a VoIP system. With a hybrid system, conventional digital or analogue telephony and VoIP can be used simultaneously.

Along with voice telephony, additional services may be used depending on the end devices connected. For example, PBX systems can be used to transmit data, texts, graphics, and moving images. The information can be forwarded in an analogue or digital manner using wired or wireless transmission media. Depending on the connection and the data networks used, a wide variety of PBX systems can be used in an organisation.

Objective

This module examines the threats and requirements that apply specifically to PBX systems and the corresponding parts of hybrid systems. The aim of the module is to protect the information that is transmitted via PBX systems, as well as the systems themselves from external intervention and manipulation.

Scoping and Modelling

Module NET.4.1 Telecommunications Systems must be applied to every telecommunication system.

This module deals with the hazards and requirements that are specific to PBX systems and the corresponding parts of a hybrid system. Topics that go beyond the scope of PBX systems—such as hazards and requirements for individual VoIP implementations, as well as externally provided services—are covered in the specific corresponding modules of the IT-Grundschutz Compendium.

The security aspects of VoIP components and voice transmission via VoIP are described in more detail in module NET.4.2 VoIP.

PBX systems should also be considered as a matter of principle when implementing the modules ORP.4 Identity and Access Management, OPS.1.2.5 Remote Maintenance, CON.3 Backup Concept, and OPS.1.1.5 Logging.

Useful resources

As part of its technical guideline series, the BSI has published “BSI-TL-02013 für organisationsinterne Telekommunikationssysteme mit erhöhtem Schutzbedarf” [BSI-TL-02013, Technical Guideline for Internal Telecommunications Systems with Increased Protection Requirements].

Introduction

Voice over IP (VoIP) refers to telephony over data networks, in particular over the Internet. Special signalling protocols are used to transmit signalling information, such as when making a call. The actual payload, such as voice or video data, is transmitted with the aid of a media transport protocol. Both protocols are required to establish and maintain a multimedia connection. Some procedures use only one protocol for signalling and transporting media.

Objective

This module examines the security aspects of VoIP end devices and switching units (middleware). The functionality of the components described here is the same as for the telecommunication components described in module NET 4.1 Telecommunication Systems.

Scoping and Modelling

Module NET.4.2 VoIP must be applied to all communication networks that use VoIP. Since VoIP operates over a data network, the requirements of the modules NET.1.1 Network Architecture and Design or NET.3.2 Firewall must be taken into account in addition to this module.

This module examines the security aspects of VoIP components and voice transmission via VoIP. It also applies to situations in which circuit-switching telecommunications systems exchange information using a data network.

The specific threats and requirements of classic PBX systems and hybrid systems are considered in module NET 4.1 Telecommunications Systems.

VoIP software is often operated on standard IT systems rather than dedicated hardware. If softphones are installed on clients, the requirements of module SYS.2.1 General Client and the operating-system-specific modules should be taken into account. If software for VoIP is operated on servers, the requirements of module SYS.1.1 General Server should be met in addition to the requirements of the operating-system-specific modules.

VoIP should always be included as part of the modules ORP.4 Identity and Access Management, OPS.1.1.3 Patch and Change Management, OPS.1.1.5 Logging, and OPS.1.1.2 Proper IT Administration.

Useful Resources

As part of its technical guideline series, the BSI has published "BSI-TL-02013 für organisationsinterne Telekommunikationssysteme mit erhöhtem Schutzbedarf” [BSI-TL-02013, Technical Guideline for Internal Telecommunications Systems with Increased Protection Requirements].

As part of its series of special publications, the National Institute of Standards and Technology (NIST) has published NIST Special Publication 800-5, “Security Considerations for Voice Over IP Systems”.

Introduction

This module examines the security aspects of information transmission via standard fax machines and fax servers. The information transmitted is referred to as a fax (short for telefax) or, more rarely, as a telecopy or facsimile. With a conventional fax machine, the contents of a document are scanned point by point by the transmitting machine and then sent to a recipient. The receiver device reconstructs the contents point by point and usually outputs it directly on paper.

A fax server, on the other hand, is a service that is installed on a server to enable other IT systems in its data network to send and receive faxes. Fax servers are often integrated into existing e-mail or groupware systems. It is therefore possible for incoming fax documents to be delivered to users by e-mail. Outgoing documents are relayed to the fax server either via a printer queue system or by e-mail. A document is usually sent and received as an image file between the fax server and clients in a data network. The transmitted image file cannot be processed directly in text processing systems. Optical character recognition (OCR) is usually required for this first. Documents received and processed by a fax server can usually be easily archived—for example, by the fax server service itself, by document management systems, or by groupware directly connected to the fax server service.

Objective

One aim of this module is to protect information transmitted and processed by fax. Another objective is to protect fax machines and fax servers against manipulation by unauthorised persons. Since the transmission medium used is irrelevant to the application of this module, the requirements of this module should also be implemented for fax over IP (FoIP).

Scoping and Modelling

Module NET.4.3 Fax Machines and Fax Servers must be applied to every fax machine and fax server in the information domain under consideration.

This module considers standard stand-alone fax machines and fax servers as the technical basis for sending faxes. Additional aspects of fax machines that can be found in a multifunction (or all-in-one) device are dealt with separately in module SYS.4.1 Printers, Copiers, and All-in-One Devices. To protect the information that is processed, offered, stored and transmitted on fax servers, module SYS.1.1 General Server and the respective operating-system-specific modules should be considered. Information on correct archiving can be found in module OPS.1.2.2 Archiving.

Useful Resources

No further information is available for module NET.4.3 Fax Machines and Fax Servers.