+NET.1.1.A18 P-A-P Structure for the Internet Connection (S)

NET.1.1.A18 P-A-P Structure for the Internet Connection (S)

An organisation’s network SHOULD be connected to the Internet via a firewall with a P-A-P structure (see NET.1.1.A4 Network Separation into Zones).

A proxy-based application layer gateway (ALG) MUST be implemented between the two firewall levels. The ALG MUST be connected via its own transfer network (dual-homed) to both the external packet filter and the internal packet filter. The transfer network MUST NOT be occupied with tasks other than those performed for the ALG.

If no ALG is used, appropriate security proxies MUST be implemented. The security proxies MUST be connected via a separate transfer network (dual-homed). The transfer network MUST NOT be occupied with tasks other than those performed for the security proxies. Whether mutual attacks are possible via the security proxies MUST be checked. If this is the case, the transfer network MUST be appropriately segmented.

All data traffic MUST be decoupled via the ALG or the corresponding security proxies. A transport network that connects both firewall stages with each other MUST NOT be configured. In addition, the internal firewall MUST reduce the exposure of the ALG or the security proxies to internal attackers or IT systems in the internal network.

Authenticated and trusted network access attempts from the VPN gateway to the internal network SHOULD NOT pass through the ALG or the security proxies of the P-A-P structure.

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.22 Manipulation of Information
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems