03.13.01 Boundary Protection

Statement

• a. Monitor and control communications at external managed interfaces to the system and key internal managed interfaces within the system.

• b. Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

• c. Connect to external systems only through managed interfaces that consist of boundary protection devices arranged in accordance with an organizational security architecture.

Guidance

Managed interfaces include gateways, routers, firewalls, network-based malicious code analysis, virtualization systems, and encrypted tunnels implemented within a security architecture. Subnetworks that are either physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting external traffic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses.

Assessment objective

communications at external managed interfaces to the system are monitored.

Assessment objective

communications at external managed interfaces to the system are controlled.

Assessment objective

communications at key internal managed interfaces within the system are monitored.

Assessment objective

communications at key internal managed interfaces within the system are controlled.

Assessment objective

subnetworks are implemented for publicly accessible system components that are physically or logically separated from internal networks.

Assessment objective

external system connections are only made through managed interfaces that consist of boundary protection devices arranged in accordance with an organizational security architecture.

Assessment method

• system and communications protection policy and procedures procedures for boundary protection list of key internal boundaries within the system boundary protection hardware and software system configuration settings security architecture system audit records system design documentation system security plan other relevant documents or records

Assessment method

• personnel with boundary protection responsibilities personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for implementing boundary protection capabilities

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final