ANSI INCITS ISO IEC 18028-4-2005 Information technology - Security techniques - IT network security - Part 4 Securing remote access《信息技术.安全技术.IT网络安全.第4部分 远程访问安全》.pdf

1、INCITS/ISO/IEC 18028-4-2005 (ISO/IEC 18028-4:2005, IDT) Information technology Securitytechniques IT network security Part 4: Securing remote accessINCITS/ISO/IEC 18028-4-2005 (ISO/IEC 18028-4:2005, IDT)Copyright American National Standards Institute Provided by IHS under license with ANSI Not for R

2、esaleNo reproduction or networking permitted without license from IHS-,-,-INCITS/ISO/IEC 18028-4-2005 ii ITIC 2005 All rights reserved PDF disclaimer This PDF file may contain embedded typefaces. In accordance with Adobes licensing policy, this file may be printed or viewed but shall not be edited u

3、nless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept therein the responsibility of not infringing Adobes licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a tradem

4、ark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies.

5、 In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. Adopted by INCITS (InterNational Committee for Information Technology Standards) as an American National Standard.ate of ANSI Approval: 11/3/2005 Published by American Nat

6、ional Standards Institute, 25 West 43rd Street, New York, New York 10036 Copyright 2005 by Information Technology Industry Council (ITI). All rights reserved. These materials are subject to copyright claims of International Standardization Organization (ISO), International Electrotechnical Commissio

7、n (IEC), American National Standards Institute (ANSI), and Information Technology Industry Council (ITI). Not for resale. No part of this publication may be reproduced in any form, including an electronic retrieval system, without the prior written permission of ITI. All requests pertaining to this

8、standard should be submitted to ITI, 1250 Eye Street NW, Washington, DC 20005. Printed in the United States of America Copyright American National Standards Institute Provided by IHS under license with ANSI Not for ResaleNo reproduction or networking permitted without license from IHS-,-,-INCITS/ISO

9、/IEC 18028-4-2005 ITIC 2005 All rights reserved iii Contents Page Foreword .v Introduction vi 1 Scope 1 2 Terms, definitions and abbreviated terms.1 3 Aim 5 4 Overview .6 5 Security requirements 7 6 Types of remote access connection 8 7 Techniques of remote access connection 9 7.1 General9 7.2 Acces

10、s to communications servers 9 7.3 Access to LAN resources 13 7.4 Access for maintenance. 14 8 Guidelines for selection and configuration . 14 8.1 General 14 8.2 Protecting the RAS client . 15 8.3 Protecting the RAS server . 16 8.4 Protecting the connection 17 8.5 Wireless security 18 8.6 Organizatio

11、nal measures . 19 8.7 Legal considerations 20 9 Conclusion 20 Annex A (informative) Sample remote access security policy 21 A.1 Purpose. 21 A.2 Scope 21 A.3 Policy 21 A.4 Enforcement . 22 A.5 Terms and definitions 23 Annex B (informative) RADIUS implementation and deployment best practices . 24 B.1

12、General 24 B.2 Implementation best practices 24 B.3 Deployment best practices 25 Annex C (informative) The two modes of FTP 27 C.1 PORT-mode FTP . 27 C.2 PASV-mode FTP . 27 Annex D (informative) Checklists for secure mail service . 29 D.1 Mail server operating system checklist . 29 D.2 Mail server a

13、nd content security checklist 30 D.3 Network infrastructure checklist . 31 D.4 Mail client security checklist 32 D.5 Secure administration of mail server checklist . 32 Annex E (informative) Checklists for secure web services . 34 E.1 Web server operating system checklist 34 E.2 Secure web server in

14、stallation and configuration checklist 35 E.3 Web content checklist 36 Copyright American National Standards Institute Provided by IHS under license with ANSI Not for ResaleNo reproduction or networking permitted without license from IHS-,-,-INCITS/ISO/IEC 18028-4-2005 iv ITIC 2005 All rights reserv

15、ed E.4 Web authentication and encryption checklist. 37 E.5 Network infrastructure checklist . 37 E.6 Secure web server administration checklist . 38 Annex F (informative) Wireless LAN security checklist . 40 Bibliography . 42 Copyright American National Standards Institute Provided by IHS under lice

16、nse with ANSI Not for ResaleNo reproduction or networking permitted without license from IHS-,-,-INCITS/ISO/IEC 18028-4-2005 ITIC 2005 All rights reserved v Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized

17、system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committee

18、s collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International St

19、andards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publica

20、tion as an International Standard requires approval by at least 75 % of the national bodies casting a vote. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such

21、patent rights. ISO/IEC 18028-4 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques. ISO/IEC 18028 consists of the following parts, under the general title Information technology Security techniques IT network security: Part 2: N

22、etwork security architecture Part 3: Securing communications between networks using security gateways Part 4: Securing remote access Network security management and securing communications between networks using Virtual Private Networks will form the subjects of the future Parts 1 and 5, respectivel

23、y. Copyright American National Standards Institute Provided by IHS under license with ANSI Not for ResaleNo reproduction or networking permitted without license from IHS-,-,-INCITS/ISO/IEC 18028-4-2005 vi ITIC 2005 All rights reserved Introduction In Information Technology there is an ever increasin

24、g need to use networks within organizations and between organizations. Requirements have to be met to use networks securely. The area of remote access to a network requires specific measures when IT security should be in place. This part of ISO/IEC 18028 provides guidance for accessing networks remo

25、tely either for using email, file transfer or simply working remotely. Copyright American National Standards Institute Provided by IHS under license with ANSI Not for ResaleNo reproduction or networking permitted without license from IHS-,-,-AMERICAN NATIONAL STANDARD INCITS/ISO/IEC 18028-4-2005 ITI

26、C 2005 All rights reserved 1 Information technology Security techniques IT network security Part 4: Securing remote access 1 Scope This part of ISO/IEC 18028 provides guidance for securely using remote access a method to remotely connect a computer either to another computer or to a network using pu

27、blic networks and its implication for IT security. In this it introduces the different types of remote access including the protocols in use, discusses the authentication issues related to remote access and provides support when setting up remote access securely. It is intended to help network admin

28、istrators and technicians who plan to make use of this kind of connection or who already have it in use and need advice on how to set it up securely and operate it securely. 2 Terms, definitions and abbreviated terms For the purposes of this document, the following terms, definitions and abbreviated

29、 terms apply. 2.1 Access Point AP the system providing access from a wireless network to a terrestrial network 2.2 Advanced Encryption Standard AES a symmetric encryption mechanism providing variable key length and allowing an efficient implementation specified as Federal Information Processing Stan

30、dard (FIPS) 197 2.3 authentication the provision of assurance of the claimed identity of an entity. In case of user authentication, users are identified either by knowledge (e.g., password), by possession (e.g., token) or by a personal characteristic (biometrics). Strong authentication is either bas

31、ed on strong mechanisms (e.g., biometrics) or makes use of at least two of these factors (so-called multi-factor authentication). 2.4 call-back a mechanism to place a call to a pre-defined or proposed location (and address) after receiving valid ID parameters 2.5 Challenge-Handshake Authentication P

32、rotocol CHAP a three-way authentication protocol defined in RFC 1994 Copyright American National Standards Institute Provided by IHS under license with ANSI Not for ResaleNo reproduction or networking permitted without license from IHS-,-,-INCITS/ISO/IEC 18028-4-2005 2 ITIC 2005 All rights reserved

33、2.6 Data Encryption Standard DES a well-known symmetric encryption mechanism using a 56 bit key. Due to its short key length DES was replaced by the AES, but is still used in multiple encryption mode, e.g., 3DES or Triple DES (FIPS 46-3). 2.7 de-militarised zone DMZ a separated area of a local or si

34、te network whose access is controlled by a specific policy using firewalls. A DMZ is not part of the internal network and is considered less secure. 2.8 Denial of Service DoS an attack against a system to deter its availability 2.9 Digital Subscriber Line DSL a technology providing fast access to ne

35、tworks over local telecommunications loops 2.10 Dynamic Host Control Protocol DHCP an Internet protocol that dynamically provides IP addresses at start up (RFC 2131) 2.11 Encapsulating Security Payload ESP an IP-based protocol providing confidentiality services for data. Specifically, ESP provides e

36、ncryption as a security service to protect the data content of the IP packet. ESP is an Internet standard (RFC 2406). 2.12 Extensible Authentication Protocol EAP an authentication protocol supported by RADIUS and standardised by the IETF in RFC 2284 2.13 File Transfer Protocol FTP an Internet standa

37、rd (RFC 959) for transferring files between a client and a server 2.14 Internet Engineering Task Force IETF the group responsible for proposing and developing technical Internet standards 2.15 Internet Message Access Protocol v4 IMAP4 an email protocol which allows accessing and administering emails

38、 and mailboxes located on a remote email server (defined in RFC 2060) 2.16 Local Area Network LAN a local network, usually within a building Copyright American National Standards Institute Provided by IHS under license with ANSI Not for ResaleNo reproduction or networking permitted without license f

39、rom IHS-,-,-INCITS/ISO/IEC 18028-4-2005 ITIC 2005 All rights reserved 3 2.17 modem hardware or software that modulates digital signals into analogue ones and vice versa (demodulation) for the purpose of using telephone protocols as a computer protocol 2.18 Multipurpose Internet Mail Extensions MIME

40、a method allowing the transfer of multimedia and binary data via email; it is specified in RFC 2045 to RFC 2049 2.19 Network Access Server NAS a system, normally a computer, which provides access to an infrastructure for remote clients 2.20 one-time password OTP a password only used once thus counte

41、ring replay attacks 2.21 Passive mode PASV mode an FTP connection establishment mode 2.22 Password Authentication Protocol PAP an authentication protocol provided for PPP (RFC 1334) 2.23 Personal Digital Assistant PDA usually a handheld computer (palmtop computer) 2.24 Point-to-Point Protocol PPP a

42、standard method for encapsulating network layer protocol information over point-to-point links (RFC 1334) 2.25 Post Office Protocol v3 POP3 an email protocol defined in RFC 1939 which allows a mail client to retrieve email stored on the email server 2.26 Pretty Good Privacy PGP a publicly available

43、encryption software program based on public key cryptography. The message formats are specified in RFC 1991 and RFC 2440. 2.27 Private Branch Exchange PBX usually a computer-based digital telephone switch for an enterprise Copyright American National Standards Institute Provided by IHS under license

44、 with ANSI Not for ResaleNo reproduction or networking permitted without license from IHS-,-,-INCITS/ISO/IEC 18028-4-2005 4 ITIC 2005 All rights reserved 2.28 Remote Access Dial-in User Service RADIUS an Internet Security protocol (RFC 2138 and RFC 2139) for authenticating remote users 2.29 Remote A

45、ccess Service RAS usually hardware and software to provide remote access 2.30 remote access authorized access to a system from outside of a security domain 2.31 Request for Comment RFC the title for Internet standards proposed by the IETF 2.32 Secure Shell SSH a protocol that provides secure remote

46、login utilising an insecure network. SSH is proprietary but will become an IETF standard in the near future. SSH was originally developed by SSH Communications Security. 2.33 Secure Sockets Layer SSL a protocol located between the network layer and the application layer provides authentication of cl

47、ients and server and integrity and confidentiality services. SSL was developed by Netscape and builds the basis for TLS. 2.34 Security/Multipurpose Internet Mail Extensions S/MIME a protocol providing secure multipurpose mail exchange. Its current version 3 consists of five parts: RFC 3369 and RFC 3

48、370 define the message syntax, RFC 2631 to RFC 2633 define message specification, certificate handling and key agreement method. 2.35 Serial Line Internet Protocol SLIP a packet framing protocol specified in RFC 1055 for transferring data using telephone lines (serial lines) 2.36 Service Set Identifier SSID an identifier for wireless access points, usually in the form of a name 2.37 Simple Mail Transfer Protocol SMTP an Internet protocol (RFC 821 and extensions) for sending mail to mail servers (outgoing) 2.38 Transport Layer Security Protocol TLS the successor of SSL i