+NET.3.2.A19 Protection Against TCP SYN Flooding, UDP Packet Storms, and Sequence Number Guessing on the Packet Filter (S)

NET.3.2.A19 Protection Against TCP SYN Flooding, UDP Packet Storms, and Sequence Number Guessing on the Packet Filter (S)

On packet filters protecting server services that are available from untrustworthy networks, a suitable limit SHOULD be configured for semi-open and open connections.

On packet filters protecting server services that are available from untrustworthy (or less trustworthy) networks, rate limits SHOULD be set for UDP data streams.

On outer packet filters, the random generation of initial sequence numbers (ISN) SHOULD be enabled for outgoing TCP connections unless this is already implemented by security proxies.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.40 Denial of Service
blocks G 0.41 Sabotage