SANS 18028-5-2009 Information technology - Security techniques - IT network security Part 5 Securing communications across networks using virtual private networks《信息技术 安全技术 信息网络安全 .pdf

1、 Collection of SANS standards in electronic format (PDF) 1. Copyright This standard is available to staff members of companies that have subscribed to the complete collection of SANS standards in accordance with a formal copyright agreement. This document may reside on a CENTRAL FILE SERVER or INTRA

2、NET SYSTEM only. Unless specific permission has been granted, this document MAY NOT be sent or given to staff members from other companies or organizations. Doing so would constitute a VIOLATION of SABS copyright rules. 2. Indemnity The South African Bureau of Standards accepts no liability for any

3、damage whatsoever than may result from the use of this material or the information contain therein, irrespective of the cause and quantum thereof. ISBN 978-0-626-22052-5 SANS 18028-5:2009Edition 1ISO/IEC 18028-5:20Edition 1 06 SOUTH AFRICAN NATIONAL STANDARD Information technology Security technique

4、s IT network security Part 5: Securing communications across networks using virtual private networks This national standard is the identical implementation of ISO/IEC 18028-5:2006 and is adopted with the permission of the International Organization for Standardization and the International Electrote

5、chnical Commission. Published by SABS Standards Division 1 Dr Lategan Road Groenkloof Private Bag X191 Pretoria 0001 Tel: +27 12 428 7911 Fax: +27 12 344 1568 www.sabs.co.za SABS This standard may only be used and printed by approved subscription and freemailing clients of the SABS.SANS 18028-5:2009

6、 Edition 1 ISO/IEC 18028-5:2006 Edition 1 Table of changes Change No. Date Scope National foreword This South African standard was approved by National Committee SABS SC 71F, Information technology Information security, in accordance with procedures of the SABS Standards Division, in compliance with

7、 annex 3 of the WTO/TBT agreement. This SANS document was published in March 2009. This standard may only be used and printed by approved subscription and freemailing clients of the SABS. Reference number ISO/IEC 18028-5:2006(E) ISO/IEC 2006INTERNATIONAL STANDARD ISO/IEC 18028-5 First edition 2006-0

8、7-01 Information technology Security techniques IT network security Part 5: Securing communications across networks using virtual private networks Technologies de linformation Techniques de scurit Scurit de rseaux TI Partie 5: Communications sres travers les rseaux utilisant les rseaux privs virtuel

9、s SANS 18028-5:2009This standard may only be used and printed by approved subscription and freemailing clients of the SABS.ISO/IEC 18028-5:2006(E) PDF disclaimer This PDF file may contain embedded typefaces. In accordance with Adobes licensing policy, this file may be printed or viewed but shall not

10、 be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept therein the responsibility of not infringing Adobes licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe

11、 is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO me

12、mber bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. ISO/IEC 2006 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic

13、 or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Case postale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org We

14、b www.iso.org Published in Switzerland ii ISO/IEC 2006 All rights reservedSANS 18028-5:2009This standard may only be used and printed by approved subscription and freemailing clients of the SABS.ISO/IEC 18028-5:2006(E) ISO/IEC 2006 All rights reserved iii Contents Page Foreword iv Introduction v 1 S

15、cope 1 2 Normative references 1 3 Terms and definitions .2 3.1 Terms defined in other International Standards.2 3.2 Terms defined in this part of ISO/IEC 18028 .2 4 Abbreviated terms .3 5 Overview of VPNs 3 5.1 Introduction3 5.2 Types of VPN4 5.3 VPN techniques5 5.4 Security aspects 6 6 VPN security

16、 objectives 7 7 VPN security requirements.7 7.1 Confidentiality8 7.2 Integrity.8 7.3 Authentication8 7.4 Authorization8 7.5 Availability8 7.6 Tunnel Endpoints.8 8 Guidelines for the selection of secure VPNs 9 8.1 Regulatory and legislative aspects9 8.2 VPN management aspects9 8.3 VPN architectural a

17、spects 9 9 Guidelines for the implementation of secure VPNs.12 9.1 VPN management considerations12 9.2 VPN technical considerations 12 Annex A (informative) Technologies and protocols used to implement VPNs.15 A.1 Introduction15 A.2 Layer 2 VPNs15 A.3 Layer 3 VPNs17 A.4 Higher Layer VPNs.17 A.5 Comp

18、arison of typical VPN protocol security features .19 Bibliography 20 SANS 18028-5:2009This standard may only be used and printed by approved subscription and freemailing clients of the SABS.ISO/IEC 18028-5:2006(E) iv ISO/IEC 2006 All rights reservedForeword ISO (the International Organization for St

19、andardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organi

20、zation to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technolog

21、y, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standards ad

22、opted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. Attention is drawn to the possibility that some of the elements of this document may be the subject

23、of patent rights. ISO and IEC should not be held responsible for identifying any or all such patent rights. ISO/IEC 18028-5 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques. ISO/IEC 18028 consists of the following parts, unde

24、r the general title Information technology Security techniques IT network security: Part 1: Network security management Part 2: Network security architecture Part 3: Securing communications between networks using security gateways Part 4: Securing remote access Part 5: Securing communications across

25、 networks using virtual private networks SANS 18028-5:2009This standard may only be used and printed by approved subscription and freemailing clients of the SABS.ISO/IEC 18028-5:2006(E) ISO/IEC 2006 All rights reserved v Introduction The telecommunications and information technology industries are s

26、eeking cost-effective comprehensive security solutions. A secure network should be protected against malicious and inadvertent attacks, and should meet the business requirements for confidentiality, integrity, availability, non-repudiation, accountability, authenticity and reliability of information

27、 and services. Securing a network is also essential for maintaining the accuracy of billing or usage information as appropriate. Security capabilities in products are crucial to overall network security (including applications and services). However, as more products are combined to provide total so

28、lutions, the interoperability, or the lack thereof, will define the success of the solution. Security must not only be a thread of concern for each product or service, but must be developed in a manner that promotes the interweaving of security capabilities in the overall end-to-end security solutio

29、n. Thus, the purpose of ISO/IEC 18028 is to provide detailed guidance on the security aspects of the management, operation and use of information system networks, and their inter-connections. Those individuals within an organization that are responsible for information security in general, and netwo

30、rk security in particular, should be able to adapt the material in ISO/IEC 18028 to meet their specific requirements. Its main objectives are as follows: in ISO/IEC 18028-1, to define and describe the concepts associated with, and provide management guidance on, network security including on how to

31、identify and analyze the communications related factors to be taken into account to establish network security requirements, with an introduction to the possible control areas and the specific technical areas (dealt with in subsequent parts of ISO/IEC 18028); in ISO/IEC 18028-2, to define a standard

32、 security architecture, which describes a consistent framework to support the planning, design and implementation of network security; in ISO/IEC 18028-3, to define techniques for securing information flows between networks using security gateways; in ISO/IEC 18028-4, to define techniques for securi

33、ng remote access; in ISO/IEC 18028-5, to define techniques for securing inter-network connections that are established using virtual private networks (VPNs). ISO/IEC 18028-1 is relevant to anyone involved in owning, operating or using a network. This includes senior managers and other non-technical

34、managers or users, in addition to managers and administrators who have specific responsibilities for information security and/or network security, network operation, or who are responsible for an organizations overall security program and security policy development. ISO/IEC 18028-2 is relevant to a

35、ll personnel who are involved in the planning, design and implementation of the architectural aspects of network security (for example network managers, administrators, engineers, and network security officers). ISO/IEC 18028-3 is relevant to all personnel who are involved in the detailed planning,

36、design and implementation of security gateways (for example network managers, administrators, engineers and network security officers). ISO/IEC 18028-4 is relevant to all personnel who are involved in the detailed planning, design and implementation of remote access security (for example network man

37、agers, administrators, engineers, and network security officers). ISO/IEC 18028-5 is relevant to all personnel who are involved in the detailed planning, design and implementation of VPN security (for example network managers, administrators, engineers, and network security officers). SANS 18028-5:2

38、009This standard may only be used and printed by approved subscription and freemailing clients of the SABS.SANS 18028-5:2009This standard may only be used and printed by approved subscription and freemailing clients of the SABS.INTERNATIONAL STANDARD ISO/IEC 18028-5:2006(E) ISO/IEC 2006 All rights r

39、eserved 1Information technology Security techniques IT network security Part 5: Securing communications across networks using virtual private networks 1 Scope This part of ISO/IEC 18028 provides detailed direction with respect to the security aspects of using Virtual Private Network (VPN) connection

40、s to inter-connect networks, and also to connect remote users to networks. It builds upon the network management direction provided in ISO/IEC 18028-1. It is aimed at those individuals responsible for the selection and implementation of the technical controls necessary to provide network security wh

41、en using VPN connections, and for the subsequent network monitoring of VPN security thereafter. This part of ISO/IEC 18028 provides an overview of VPNs, presents VPN security objectives, and summarizes VPN security requirements. It gives guidance on the selection of secure VPNs, on the implementatio

42、n of secure VPNs, and on the network monitoring of VPN security. It also provides information on typical technologies and protocols used by VPNs. 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition c

43、ited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 7498 (all parts), Information technology Open Systems Interconnection Basic Reference Model ISO/IEC 13335-1:2004, Information technology Security techniques Management of i

44、nformation and communications technology security Part 1: Concepts and models for information and communications technology security management ISO/IEC 17799:2005, Information technology Security techniques Code of practice for information security management ISO/IEC 18028-1:2006, Information techno

45、logy Security techniques IT network security Part 1: Network security management ISO/IEC 18028-2:2006, Information technology Security techniques IT network security Part 2: Network security architecture ISO/IEC 18028-3:2005, Information technology Security techniques IT network security Part 3: Sec

46、uring communications between networks using security gateways SANS 18028-5:2009This standard may only be used and printed by approved subscription and freemailing clients of the SABS.ISO/IEC 18028-5:2006(E) 2 ISO/IEC 2006 All rights reservedISO/IEC 18028-4:2005, Information technology Security techn

47、iques IT network security Part 4: Securing remote access 3 Terms and definitions 3.1 Terms defined in other International Standards For the purposes of this document, the terms and definitions given in ISO/IEC 7498 (all parts) and ISO/IEC 18028-1 apply, as do the following terms defined in ISO/IEC 1

48、3335-1: accountability, asset, authenticity, availability, baseline controls, confidentiality, data integrity, impact, integrity, security policy, non- repudiation, reliability, risk, risk analysis, risk management, safeguard, threat, and vulnerability. 3.2 Terms defined in this part of ISO/IEC 1802

49、8 For the purposes of this document, the following terms and definitions apply. 3.2.1 layer 2 switching technology that uses internal switching mechanisms to establish and control connections between devices using layer 2 protocols NOTE It is typically used to simulate a LAN environment to upper layer protocols. 3.2.2 layer 2 VPN virtual private network used to provide a simulated LAN environment over a network infrastructure NOTE Sites linked by a layer 2