+Communication Security (COS)
---+Technical safeguards
---+Security requirements for connections in the Cloud Service Provider's network
---+Monitoring of connections in the Cloud Service Provider's network
---+Cross-network access
---+Networks for administration
---+Segregation of data traffic in jointly used network environments
---+Documentation of the network topology
---+Policies for data transmission

Communication Security (COS)

None

1. Pārskats

Technical safeguards Based on the results of a risk analysis carried out according to OIS06, the Cloud Service Provider has implemented technical safeguards which are suitable to promptly detect and respond to networkbased attacks on the basis of irregular incoming or outgoing traffic patterns and/or Distributed Denial ofService (DDoS) attacks. Data from corresponding technical protection measures implemented is fed into a comprehensive SIEM (Security Information and Event Management) system, so that (counter) measures regarding correlating events can be initiated. The safeguards are documented, communicated and provided in accordance with SP-01.
Additonal CriteriaTechnical measures ensure that no unknown (physical or virtual) devices join the Cloud Service Provider's (physical or virtual) network (e.g. MACSec according to IEEE 802.1X:2010).
Supplementary Information - About the CriteriaNetwork-based attacks can be conducted e.g. with MAC spoofing and ARP poisoning attacks. Technical measures to prevent unknown physical or virtual devices from joining a physical or virtual network can be based on e.g. MACSec according to IEEE 802.1X:2010.
Security requirements for connections in the Cloud Service Provider's network Specific security requirements are designed, published and provided for establishing connections within the Cloud Service Provider's network. The security requirements define for the Cloud Service Provider's area of responsibility:
• in which cases the security zones are to be separated and in which cases cloud customers are to be logically or physically segregated;
• which communication relationships and which network and application protocols are permitted in each case;
• how the data traffic for administration and monitoring is segregated from each on network level;
• which internal, cross-location communication is permitted and;
• which cross-network communication is allowed
Additonal Criteria-
Supplementary Information - About the CriteriaCross-location communication can be realised for e.g. individual regions or data centres via e.g. WAN, LAN, VPN, RAS.
Monitoring of connections in the Cloud Service Provider's network A distinction is made between trusted and untrusted networks. Based on a risk assessment, these are separated into different security zones for internal and external network areas (and DMZ, if applicable). Physical and virtualised network environments are designed and configured to restrict and monitor the established connection to trusted or untrusted networks according to the defined security requirements.
The entirety of the conception and configuration undertaken to monitor the connections mentioned is assessed in a risk-oriented manner, at least annually, with regard to the resulting security requirements.
Identified vulnerabilities and deviations are subject to risk assessment in accordance with the risk management procedure (cf. OIS06) and followup measures are defined and tracked (cf. OPS-18).
At specified intervals, the business justification for using all services, protocols, and ports is reviewed. The review also includes the justifications for compensatory measures for the use of protocols that are considered insecure.
Additonal Criteria-
Supplementary Information - About the CriteriaThe review of the security requirements depends on the measures implemented to design the networks. For example, monitoring and reviewing firewall rules or log files for abnormalities, as well as visual inspections of physical network components for changes.
Cross-network access Each network perimeter is controlled by security gateways. The system access authorisation for cross-network access is based on a security assessment based on the requirements of the cloud customers.
Additonal CriteriaEach network perimeter is controlled by redundant and highly-available security gateways.
Supplementary Information - About the CriteriaCross-network access is access from one network to another network via a defined network perimeter.
Networks for administration There are separate networks for the administrative management of the infrastructure and for the operation of management consoles. These networks are logically or physically separated from the cloud customer's network and protected from unauthorised access by multifactor authentication (cf. IDM09). Networks used by the Cloud Service Provider to migrate or create virtual machines are also physically or logically separated from other networks
Additonal Criteria-
Supplementary Information - About the Criteria-
Segregation of data traffic in jointly used network environments Data traffic of cloud customers in jointly used network environments is segregated on network level according to a documented concept to ensure the confidentiality and integrity of the data transmitted.
Additonal CriteriaIn the case of IaaS/PaaS, the secure segregation is ensured by physically separated networks or by means of strongly encrypted VLANs. For the definition of strong encryption, the BSI Technical Guideline TR-02102 must be considered.
Supplementary Information - About the CriteriaIf the suitability and effectiveness of the logical segmentation cannot be assessed with sufficient certainty (e.g. due to a complex implementation), evidence can also be provided based on audit results of expert third parties (e.g. security audits to validate the concept). The segregation of stored and processed data is subject of the criterion OPS-24. After successful authentication via an insecure communication channel (HTTP), a secure communication channel (HTTPS) is to be used.
With IaaS/PaaS, secure segregation is ensured by physically separated networks or strong encryption of the networks. For the definition of strong encryption, the BSI Technical Guideline TR02102 must be considered (cf. CRY01).
If the Cloud Service Provider does not use shared network environments for cloud customers and instead uses a physical segregation, the basic criterion is not applicable.
Documentation of the network topology The documentation of the logical structure of the network used to provision or operate the Cloud Service, is traceable and uptodate, in order to avoid administrative errors during live operation and to ensure timely recovery in the event of malfunctions in accordance with contractual obligations. The documentation shows how the subnets are allocated and how the network is zoned and segmented. In addition, the geographical locations in which the cloud customers' data is stored are indicated.
Additonal Criteria-
Supplementary Information - About the CriteriaZoning is a segmentation of the subnets with a firewall implemented at the network perimeters.
Policies for data transmission Policies and instructions with technical and organisational safeguards in order to protect the transmission of data against unauthorised interception, manipulation, copying, modification, redirection or destruction are documented, communicated and provided according to SP01. The policies and instructions establish a reference to the classification of information (cf. AM06).
Additonal Criteria-
Supplementary Information - About the CriteriaA safeguard against unauthorised interception, manipulation, copying, modification, redirection or destruction of data during transmission is e.g. the use of transport encryption according to CRY-02.

1.1 Atsauces

1.2 Identificētās prasības

1.3 Saistītie tiesību akti

2. Identificētās prasības

Prasības

3. Saistītie tiesību akti

Tiesību akti