NET.1.1 Network Architecture and Design

Based on an organisation's general security policy, a specific policy SHOULD be drawn up for its network. It MUST comprehensibly describe requirements and specifications on how to design and construct networks securely. The policy MUST include definitions of the following:

• the cases in which zones have to be segmented and user groups or clients have to be separated logically, or even physically
• which communication relationships and which network and application protocols are permitted in each case
• how the data traffic for administration and monitoring is to be separated in the network
• what type of internal communication (WAN, wireless networks) is allowed across locations and what encryption is required on WAN, LAN, or radio links
• what type of cross-location communication is permitted

All the employees responsible for network design MUST be familiar with the policy. It MUST form the basis of their work. If the policy is changed or there are deviations from the requirements specified, this MUST be documented and agreed with the CISO in charge. The correct implementation of the policy MUST be regularly reviewed. The results MUST be documented in an appropriate manner.

Complete documentation of the network MUST be produced. It MUST include a network plan. The documentation MUST be consistently maintained. This documentation MUST contain the initial survey of the actual situation (including network performance) and all changes made to the network. The logical structure of the network MUST also be documented—in particular, the assignment of sub-networks and the zoning and segmentation of the network.

A requirements specification MUST be created based on the security policy for the network in question. The specification MUST be consistently maintained. It MUST be possible to derive all the essential elements of network architecture and design from these requirements.

The overall network at hand MUST be physically separated into at least the following three zones: internal network, demilitarised zone (DMZ), and external connections (including to the Internet and other untrusted networks). The transitions between the zones MUST be protected by a firewall. This method of control MUST follow the principle of local communication so that firewalls allow only authorised communications (whitelisting).

Untrusted networks (e.g. the Internet) and trusted networks (e.g. an intranet) MUST be separated by a two-stage firewall structure consisting of stateful packet filters (firewalls). In order to separate the Internet and external DMZ in the network, a stateful packet filter must be implemented at minimum.

In the two-stage firewall architecture, all incoming and outgoing data traffic MUST be controlled and filtered by the external packet filter or the internal packet filter.

A P-A-P structure consisting of a packet filter, an application layer gateway or security proxies, and a packet filter MUST always be implemented when required by the security policy or the requirements specification at hand.

Clients and servers MUST be placed in different network segments. The communication between these network segments MUST be controlled by a stateful packet filter at minimum.

It SHOULD be noted that possible exceptions which make it possible to position clients and servers in a shared network segment are covered in the respective application-specific and system-specific modules.

For guest access and network areas where there is no internal control of end devices, dedicated network segments MUST be established.

The end devices positioned in a given network segment MUST correspond to a similar security level.

Sensitive information MUST be transmitted using protocols that are secure according to the state of the art in information security unless trusted dedicated network segments (e.g. within the management network) are used for communication. If it is not possible to use such protocols, appropriate encryption and authentication techniques according to the state of the art in information security MUST be implemented (see NET.3.3 VPN).

Internet traffic MUST be routed through a firewall structure (see NET.1.1.A4 Network Separation into Zones). Flows of data MUST be restricted to the required protocols and communication relationships by the firewall structure.

Every network's level of trustworthiness MUST be defined. Networks that are not trusted MUST be treated like the Internet and secured accordingly.

An organisation's firewall structure MUST be complemented by an external DMZ for all services and applications that can be accessed from the Internet. A concept for DMZ segmentation SHOULD be drawn up that implements the corresponding security policy and requirements specification in a transparent manner. Depending on the security level of the IT systems at hand, the DMZ segments MUST be divided further. An external DMZ MUST be connected to the external packet filter.

IP-based access to an internal network MUST run through a secure communication channel. Access MUST be restricted to trusted IT systems and users (see NET.3.3 VPN). VPN gateways of this kind SHOULD be placed in an external DMZ. It SHOULD be ensured that adequately hardened VPN gateways can be accessed directly from the Internet. Access attempts to an internal network that are authenticated via a VPN gateway MUST at least pass through an internal firewall.

IT systems MUST NOT access an internal network via the Internet or an external DMZ. It SHOULD be ensured that any exceptions to this requirement are covered in the relevant application- and system-specific modules.

Outgoing communication from an internal network to the Internet MUST be decoupled through a security proxy. This decoupling MUST take place outside of the internal network. If a P-A-P structure is in use, the outgoing communication SHOULD always be decoupled by the security proxies of the P-A-P structure.

Every network implementation MUST be planned in a suitable, comprehensive, and transparent manner. In this context, the security policy and the requirements specification in question MUST be observed. In addition, the following aspects MUST be considered at minimum in the planning in accordance with the needs at hand:

• the connection to the Internet and, if available, the local network and extranet
• the topology of the overall network and network areas (i.e. zones and network segments)
• the capacity and redundancy of the network and security components, transmission routes, and external connections
• the protocols to be used and their general configuration and addressing (in particular, IPv4/IPv6 sub-networks of terminal device groups)
• administration and monitoring (see NET.1.2 Network Management)

Network plans MUST be regularly reviewed.

Planned networks MUST be implemented properly. This MUST be verified during the approval process.

Regular checks MUST be conducted to ensure that a given network corresponds to the target condition. At minimum, the extent to which it complies with the relevant security policy and requirements specification MUST be checked. The extent to which the implemented network structure corresponds to the current network plans MUST also be checked. To this end, responsible persons and test criteria or specifications MUST be defined.

Based on the security policy and the requirements specification at hand, an architecture for a network's zones (including the internal network, DMZ, and external connections) SHOULD be developed and consistently maintained. In this context, all the relevant architectural elements of the respective organisation SHOULD be taken into account based on its specific situation. The following, however, are necessary at minimum:

• the architecture of the internal network, including specifications on how network virtualisation technologies, layer 2 and layer 3 communication, and redundancy procedures are to be used
• the network architecture for external connections, including firewall architectures, DMZ and extranet design, and specifications for site coupling
• specifications of the network locations where security components such as firewalls or IDS/IPS should be placed and the security functions they should provide
• specifications for the network connections of the different IT systems at hand
• the network architecture in virtualisation hosts, with a particular focus on network virtualisation overlays (NVOs) and the architecture in vertically integrated systems (ViS)
• specification of the basic architecture elements for a private cloud, as well as protection of the connections to virtual private clouds, hybrid clouds, and public clouds
• architecture for secure administration and monitoring of IT infrastructure

Based on the network architecture in question, the network design for the zones (including the internal network, the DMZ, and external connections) SHOULD be developed and consistently maintained. To this end, the relevant architectural elements SHOULD be considered in detail, including the following points at minimum:

• admissible forms of network components, including virtualised network components
• specifications on how WAN and wireless connections should be protected
• the connection of end devices to switching components, connections between network elements, and the use of communication protocols
• redundancy mechanisms for all network elements
• an address concept for IPv4 and IPv6, as well as associated routing and switching concepts
• virtualised networks in virtualisation hosts, including NVOs
• the structure, connection, and protection of private clouds and the secure connection of virtual private clouds, hybrid clouds, and public clouds
• specifications regarding network design for the secure administration and monitoring of IT infrastructure

An organisation’s network SHOULD be connected to the Internet via a firewall with a P-A-P structure (see NET.1.1.A4 Network Separation into Zones).

A proxy-based application layer gateway (ALG) MUST be implemented between the two firewall levels. The ALG MUST be connected via its own transfer network (dual-homed) to both the external packet filter and the internal packet filter. The transfer network MUST NOT be occupied with tasks other than those performed for the ALG.

If no ALG is used, appropriate security proxies MUST be implemented. The security proxies MUST be connected via a separate transfer network (dual-homed). The transfer network MUST NOT be occupied with tasks other than those performed for the security proxies. Whether mutual attacks are possible via the security proxies MUST be checked. If this is the case, the transfer network MUST be appropriately segmented.

All data traffic MUST be decoupled via the ALG or the corresponding security proxies. A transport network that connects both firewall stages with each other MUST NOT be configured. In addition, the internal firewall MUST reduce the exposure of the ALG or the security proxies to internal attackers or IT systems in the internal network.

Authenticated and trusted network access attempts from the VPN gateway to the internal network SHOULD NOT pass through the ALG or the security proxies of the P-A-P structure.

Servers providing basic services for IT infrastructure SHOULD be positioned in a dedicated network segment. The communication with these servers SHOULD be controlled by a stateful packet filter (firewall).

Different IPv4/IPv6 end devices SHOULD be allocated to dedicated sub-networks according to the protocol used (IPv4/IPv6 or IPv4/IPv6 DualStack).

Out-of-band management SHOULD be used comprehensively to manage infrastructure. In this context, all the end devices required to manage IT infrastructure SHOULD be positioned in dedicated network segments. The communication with these end devices SHOULD be controlled by a stateful packet filter. The communication from and to these management network segments SHOULD be restricted to the necessary management protocols with defined communication end points.

The management area SHOULD include at least the network segments below. Depending on the security policy and the requirements specification at hand, these SHOULD be further subdivided into the following:

• network segment(s) for IT systems that are responsible for the authentication and authorisation of administrative communication
• network segment(s) for the administration of IT systems
• network segment(s) for monitoring
• network segment(s) containing the central logging system, including the syslog server and SIEM server
• network segment(s) for IT systems that are required for basic services of the management area
• network segment(s) for the management interfaces of the IT systems to be administered

The different management interfaces of the IT systems at hand MUST be separated according to their purpose and their network position via a stateful packet filter. In addition, the following IT systems (management interfaces) SHOULD be separated via dedicated firewalls:

• IT systems that can be accessed from the Internet
• IT systems in the internal network
• security components located between the IT systems accessible from the Internet and the internal network

It MUST be ensured that the segmentation cannot be circumvented by management communication. The possibility of bypassing segments MUST be prevented.

Based on the specifications of the network architecture and network design at hand, a comprehensive segmentation concept SHOULD be created for the respective internal network. This segmentation concept SHOULD include any existing virtualised networks in virtualisation hosts. The segmentation concept SHOULD be planned, implemented, followed, and consistently maintained. The concept SHOULD comprise at least the following aspects, assuming they are planned in the target environment:

• network segments to be created initially, as well as specifications on how new network segments are to be created and how end devices should be positioned in the network segments
• specification for the segmentation of development and test systems (staging)
• network access control for network segments with clients
• connection of network areas which are connected to the network segments via wireless technologies or a dedicated line
• connection of the virtualisation hosts and virtual machines on the hosts to the network segments
• data centre automation
• specifications on how end devices that supply several network segments, such as load balancers and storage and backup solutions, are to be incorporated

Depending on the security policy and the requirements specification at hand, a concept SHOULD be developed that describes how each network segment is to be implemented in networking terms. In addition, the security functions that must be provided by the coupling elements between the network segments (e.g. a firewall as a stateful packet filter or IDS/IPS) SHOULD be defined.

IT systems with different protection needs SHOULD be placed in different network segments. If this is not possible, IT systems SHOULD be protected according to the highest protection needs present in their network segment. In addition, network segments SHOULD be further divided depending on their size and the requirements of the segmentation concept in question. It MUST be ensured that it is not possible to bypass network segments, much less zones.

If the virtual LANs (VLANs) on a switch belong to different organisations, they SHOULD be physically separated. Alternatively, data SHOULD be encrypted to protect the transmitted information from unauthorised access.

If VLANs are used, they MUST NOT create a connection between a given internal network and a zone before the ALG or the security proxies.

In general, it MUST be ensured that VLANs cannot be overwhelmed.

Detailed and implementation planning for network architecture and design SHOULD be carried out, documented, reviewed, and consistently maintained.

Operating processes SHOULD be created, adapted as required, and documented. In particular, the impact of zoning and segmentation concepts on IT operations SHOULD be considered.

The impact that network architecture and concepts derived from it have on contingency planning SHOULD be analysed initially and at regular intervals in a transparent way.

The central areas of an internal network and the security components in place SHOULD be designed for high availability. To this end, the components SHOULD be designed redundantly and realised with high internal availability.

The network connections (such as the Internet connection and WAN connections) SHOULD be designed with full redundancy. Depending on the availability requirements at hand, redundant connections to one or more providers SHOULD be implemented with different technology and performance. Redundant routes SHOULD also be implemented as needed both within and outside of an organisation's purview. To this end, possible single points of failure (SPoF) and disruptive environmental conditions SHOULD be considered.

In order to fend off DDoS attacks, the available bandwidth SHOULD be purposefully distributed over different communication partners and protocols by means of bandwidth management.

In order to be able to thwart DDoS attacks with very high data rates, mitigation services SHOULD be purchased via larger Internet service providers (ISPs). Their use SHOULD be contractually regulated.

Depending on the security policy and requirements specification at hand, network segments SHOULD be physically separated by separate switches.

Depending on the security policy and requirements specification at hand, the network segments of a management area SHOULD be physically separated from each other.

A network SHOULD be divided into small network segments with very similar requirement profiles and the same protection needs. This SHOULD be considered for DMZ segments in particular.

Network segments SHOULD already be realised at the network level in a given internal network, extranet, and DMZ by means of cryptographic techniques. To this end, VPN techniques or IEEE 802.1AE SHOULD be used.

If communication within an internal network or DMZ takes place via transmission routes which are not sufficiently secure for increased protection needs, the communication SHOULD be adequately encrypted at the network level.

Systems for data loss prevention (DLP) SHOULD be implemented at the network level.

In cases involving very high protection needs, VLANs SHOULD NOT be used.