+NET.1.1.A22 Specification of the Segmentation Concept (S)
|
NET.1.1.A22 Specification of the Segmentation Concept (S)
Based on the specifications of the network architecture and network design at hand, a comprehensive segmentation concept SHOULD be created for the respective internal network. This segmentation concept SHOULD include any existing virtualised networks in virtualisation hosts. The segmentation concept SHOULD be planned, implemented, followed, and consistently maintained. The concept SHOULD comprise at least the following aspects, assuming they are planned in the target environment: - network segments to be created initially, as well as specifications on how new network segments are to be created and how end devices should be positioned in the network segments
- specification for the segmentation of development and test systems (staging)
- network access control for network segments with clients
- connection of network areas which are connected to the network segments via wireless technologies or a dedicated line
- connection of the virtualisation hosts and virtual machines on the hosts to the network segments
- data centre automation
- specifications on how end devices that supply several network segments, such as load balancers and storage and backup solutions, are to be incorporated
Depending on the security policy and the requirements specification at hand, a concept SHOULD be developed that describes how each network segment is to be implemented in networking terms. In addition, the security functions that must be provided by the coupling elements between the network segments (e.g. a firewall as a stateful packet filter or IDS/IPS) SHOULD be defined.
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|