+NET.1.1.A21 Separation of the Management Area (S)

NET.1.1.A21 Separation of the Management Area (S)

Out-of-band management SHOULD be used comprehensively to manage infrastructure. In this context, all the end devices required to manage IT infrastructure SHOULD be positioned in dedicated network segments. The communication with these end devices SHOULD be controlled by a stateful packet filter. The communication from and to these management network segments SHOULD be restricted to the necessary management protocols with defined communication end points.

The management area SHOULD include at least the network segments below. Depending on the security policy and the requirements specification at hand, these SHOULD be further subdivided into the following:

  • network segment(s) for IT systems that are responsible for the authentication and authorisation of administrative communication
  • network segment(s) for the administration of IT systems
  • network segment(s) for monitoring
  • network segment(s) containing the central logging system, including the syslog server and SIEM server
  • network segment(s) for IT systems that are required for basic services of the management area
  • network segment(s) for the management interfaces of the IT systems to be administered

The different management interfaces of the IT systems at hand MUST be separated according to their purpose and their network position via a stateful packet filter. In addition, the following IT systems (management interfaces) SHOULD be separated via dedicated firewalls:

  • IT systems that can be accessed from the Internet
  • IT systems in the internal network
  • security components located between the IT systems accessible from the Internet and the internal network

It MUST be ensured that the segmentation cannot be circumvented by management communication. The possibility of bypassing segments MUST be prevented.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.22 Manipulation of Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems