+NET.3.3 VPN
---+NET.3.3.G1. Inadequate Planning of VPN Usage
---+NET.3.3.G2. Insecure VPN Service Providers
---+NET.3.3.G3. Insecure Configuration of VPN Clients for Remote Access
---+NET.3.3.G4. Insecure Default Settings on VPN Components
---+NET.3.3.A1 Planning the Use of VPNs (B)
---+NET.3.3.A2 Selection of an Appropriate VPN Service Provider (B)
---+NET.3.3.A3 Secure Installation of VPN End Devices (B)
---+NET.3.3.A4 Secure Configuration of a VPN (B)
---+NET.3.3.A5 Blocking Unneeded VPN Accounts (B)
---+NET.3.3.A6 Analysis of VPN Requirements (S)
---+NET.3.3.A7 Planning the Technical VPN Implementation (S)
---+NET.3.3.A8 Drawing Up a Security Policy for VPN Usage (S)
---+NET.3.3.A9 Selection of Suitable VPN Products (S)
---+NET.3.3.A10 Secure Operation of a VPN (S)
---+NET.3.3.A11 Secure Integration of an External Network (S)
---+NET.3.3.A12 User and Access Management for Remote Access VPNs (S)
---+NET.3.3.A13 Integration of VPN Components into a Firewall (S)
|
NET.3.3 VPN
IntroductionWith the help of virtual private networks (VPNs), sensitive data can be transmitted through untrustworthy networks like the Internet. A VPN is a virtual network that is operated within another network, but logically separated from this network. A VPN only uses the network as a transport medium; it is independent of the structure and design of the network used. VPNs can use cryptographic procedures to protect the integrity and confidentiality of data. VPNs also enable the secure authentication of communication partners when several networks or IT systems are connected to each other via leased lines or public networks. ObjectiveThis module defines requirements for the secure and systematic planning, implementation, and operation of a VPN. Scoping and ModellingThis module must be applied to every option that is available to access a given organisation's network via a VPN endpoint. The module does not deal with the basics of secure networks and how to assemble them (see NET.1.1 Network Architecture and Design). Moreover, this module does not cover all the processes involved in operating a VPN. VPNs should always be included as part of the modules ORP.4 Identity and Access Management, OPS.1.1.3 Patch and Change Management, OPS.1.2.5 Remote Maintenance, OPS.1.1.2 Proper IT Administration, and CON.1 Crypto Concept. Recommendations on how to configure the operating systems of VPN end points are not part of this module either. Corresponding requirements are included in the modules SYS.1.1 General Server and SYS.2.1 General Client, as well as in the relevant operating-system-specific modules of the IT-Grundschutz Compendium. Useful ResourcesThe BSI has published the advanced document “Virtuelles Privates Netz (ISi-VPN): BSI-Leitlinie zur Internet Sicherheit (ISi-L)” [Virtual Private Network (ISi-VPN): BSI Guideline on Internet Security (ISi-L)” on the topic of VPNs. The International Organization for Standardization (ISO) provides guidelines for the use of VPNs in the standard ISO/IEC 27033-5:2013, “Information Technology – Security Techniques - Network Security – Part 5: Securing Communications Across Networks Using Virtual Private
Networks (VPNs)”. The National Institute of Standards and Technology (NIST) provides general guidelines for the use of VPNs in Special Publication 800-77, “Guide to IPsec VPNs”.
1. Panoramica
| Titolo |
Standard |
|
NET.3.3.A1 Planning the Use of VPNs (B)
|
The introduction of a VPN MUST be planned carefully. The responsibilities for operating the VPN MUST be defined. User groups and their authorisations MUST also be planned for the VPN. Moreover, it MUST be defined how access authorisations that are granted, changed, or withdrawn are to be documented.
|
|
NET.3.3.A2 Selection of an Appropriate VPN Service Provider (B)
|
If a VPN service provider is to be used, service level agreements (SLAs) MUST be negotiated and documented in writing. The VPN service provider's compliance with the agreed SLAs MUST be checked regularly.
|
|
NET.3.3.A3 Secure Installation of VPN End Devices (B)
|
If an appliance that requires maintenance is used, this MUST be subject to a valid maintenance contract. It MUST be ensured that VPN components are only installed by qualified personnel. The installation of VPN components and any deviations from the planning specifications at hand SHOULD be documented. The functions and the selected security mechanisms of a VPN MUST be checked before it is put into operation.
|
|
NET.3.3.A4 Secure Configuration of a VPN (B)
|
Secure configurations MUST be established for all VPN components. This SHOULD be documented in a suitable manner. The administrator in charge MUST check regularly that these configurations are still secure and adapt them to all the IT systems at hand (if applicable).
|
|
NET.3.3.A5 Blocking Unneeded VPN Accounts (B)
|
It MUST be checked regularly that only authorised IT systems and users can access a given VPN. VPN access that is no longer required MUST be disabled promptly. VPN access MUST be limited to the usage time required.
|
|
NET.3.3.A6 Analysis of VPN Requirements (S)
|
A requirements analysis SHOULD be performed to determine the usage scenarios for a given VPN and use them as a basis for deriving the specifications that the corresponding hardware and software components will need to fulfil. The requirements analysis SHOULD take into consideration the following: - business processes and specialised tasks
- access routes
- identification and authentication procedures
- users and user authorisations
- responsibilities
- reporting channels
|
|
NET.3.3.A7 Planning the Technical VPN Implementation (S)
|
In addition to the general planning required (see NET.3.3.A1 Planning the Use of VPNs), the technical aspects of a VPN SHOULD be planned carefully. Encryption methods, VPN end points, permitted access protocols, services, and resources SHOULD be specified for the VPN. Furthermore, the sub-networks that can be accessed via VPN SHOULD be defined. (See NET.1.1 Network Architecture and Design.)
|
|
NET.3.3.A8 Drawing Up a Security Policy for VPN Usage (S)
|
A security policy SHOULD be created for VPN usage. All the relevant employees SHOULD be made aware of this policy. The security safeguards described in the security policy SHOULD be explained through related training. If VPN access is set up for an employee, they SHOULD be issued an information sheet detailing the most important VPN security mechanisms. All VPN users SHOULD be obligated to comply with the security policy.
|
|
NET.3.3.A9 Selection of Suitable VPN Products (S)
|
When selecting VPN products, an organisation SHOULD consider its requirements regarding the networking of different locations and the connections of mobile employees and teleworkers.
|
|
NET.3.3.A10 Secure Operation of a VPN (S)
|
An operational concept SHOULD be created for VPNs. This SHOULD include the aspects of quality management, monitoring, maintenance, training, and authorisation.
|
|
NET.3.3.A11 Secure Integration of an External Network (S)
|
It SHOULD be ensured that VPN connections are ONLY created between the intended IT systems and services. The tunnel protocols used for this SHOULD be suitable for such use.
|
|
NET.3.3.A12 User and Access Management for Remote Access VPNs (S)
|
In cases involving remote access VPNs, central and consistent user and access management SHOULD be ensured.
|
|
NET.3.3.A13 Integration of VPN Components into a Firewall (S)
|
VPN components SHOULD be integrated into a firewall. This SHOULD be documented.
|
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
Ticket collegati
|