COS-04 Cross-Network Access

Each network perimeter is controlled by security gateways.

The system access authorisation for cross-network access is based on a security assessment based on the requirements of the cloud service customers.

Supplementary information

A security gateway is a stack of chained filtering and firewall components that restrict communication to explicitly permitted traffic. Security gateways can, for example, employ a P-A-P structure, consisting of an outer packet filter, an application-level gateway acting as a deep-inspection proxy, and an inner packet filter. The stack may be further enriched with an intrusion detection system, intrusion prevention system, or antivirus scanner. However, this structure is not mandatory. It serves to keep filtering and inspection functionally independent of each other, so that a failure of one does not automatically lead to a failure of the other.

Supplementary information

Cross-network access is access from one network to another network via a defined network perimeter.

Each network perimeter is controlled by redundant and highly available security gateways.

Cloud service customers ensure with suitable controls that access is controlled according to their protection needs by security gateways on the perimeters of the virtual networks within the cloud service for which they are responsible.