+03.13.01 Boundary Protection

03.13.01 Boundary Protection

Statement

  • a. Monitor and control communications at external managed interfaces to the system and key internal managed interfaces within the system.

  • b. Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

  • c. Connect to external systems only through managed interfaces that consist of boundary protection devices arranged in accordance with an organizational security architecture.

Guidance

Managed interfaces include gateways, routers, firewalls, network-based malicious code analysis, virtualization systems, and encrypted tunnels implemented within a security architecture. Subnetworks that are either physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting external traffic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses.

Assessment objective

communications at external managed interfaces to the system are monitored.

Assessment objective

communications at external managed interfaces to the system are controlled.

Assessment objective

communications at key internal managed interfaces within the system are monitored.

Assessment objective

communications at key internal managed interfaces within the system are controlled.

Assessment objective

subnetworks are implemented for publicly accessible system components that are physically or logically separated from internal networks.

Assessment objective

external system connections are only made through managed interfaces that consist of boundary protection devices arranged in accordance with an organizational security architecture.

Assessment method

  • system and communications protection policy and procedures procedures for boundary protection list of key internal boundaries within the system boundary protection hardware and software system configuration settings security architecture system audit records system design documentation system security plan other relevant documents or records

Assessment method

  • personnel with boundary protection responsibilities personnel with information security responsibilities system developers system administrators

Assessment method

  • mechanisms for implementing boundary protection capabilities

1. Apžvalga

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

Reikalavimai

3. Susiję teisės aktai

Teisės aktai

Susietos užduotys

Saitai
is blocked by 03.13.01 Boundary Protection – Assessment Procedure
is blocked by Inbound & Outbound Communications Traffic
is blocked by Network Intrusion Detection & Prevention Systems (NIDS & NIPS) Monitoring
is blocked by De-Militarized Zone (DMZ) Monitoring
is blocked by Network Security Controls (NSC)
is blocked by Boundary Protection
is blocked by Data Flow Enforcement – Access Control Lists (ACLs)
is blocked by Deny Traffic by Default & Allow Traffic by Exception
is blocked by Network Segmentation (macrosegmentation)
is blocked by Sensitive / Regulated Data Enclave (Secure Zone)
is blocked by Network Intrusion Detection / Prevention Systems (NIDS / NIPS)
is blocked by Separate Subnet for Connecting to Different Security Domains
is blocked by Alignment With Enterprise Architecture
is blocked by Secure Engineering Principles
is blocked by Defense-In-Depth (DiD) Architecture