SANS Institute

The most trusted source for computer security training, certification and research.

Critical Control 5: Boundary Defense

20 Critical Security Controls << previous control next control >>

How do attackers exploit the lack of this control?

Attackers focus on exploiting systems that they can reach across the Internet, which include not only DMZ systems, but also workstation and laptop computers that pull content from the Internet through network boundaries. Threats such as organized crime groups and nation states use configuration and architectural weaknesses found on perimeter systems, network devices, and Internet-accessing client machines to gain initial access into an organization. Then, with a base of operations on these machines, attackers often pivot to get deeper inside the boundary to steal or change information or to set up a persistent presence for later attacks against internal hosts. Additionally, many attacks occur between business partner networks, sometimes referred to as extranets, as attackers hop from one organization's network to another, exploiting vulnerable systems on extranet perimeters.

To control the flow of traffic through network borders and to police its content looking for attacks and evidence of compromised machines, boundary defenses should be multi-layered, relying on firewalls, proxies, DMZ perimeter networks, and network-based Intrusion Prevention Systems and Intrusion Detection Systems.

It should be noted that boundary lines between internal and external networks are diminishing through increased interconnectivity within and between organizations, as well as the rapid rise in deployment of wireless technologies. These blurring lines sometimes allow attackers to gain access inside networks while bypassing boundary systems. However, even with this blurring, effective security deployments still rely on carefully configured boundary defenses that separate networks with different threat levels, different sets of users, and different levels of control. Even with the blurring of internal and external networks, effective multi-layered defenses of perimeter networks help to lower the number of successful attacks, allowing security personnel to focus on attackers who have devised methods to bypass boundary restrictions.

How can this control be implemented, automated, and its effectiveness measured?

The boundary defenses included in this control build on Critical Control 4, with these additional recommendations focused on improving the overall architecture and implementation of both Internet and internal network boundary points. Internal network segmentation is central to this control because once inside a network, many intruders attempt to target the most sensitive machines. Usually, internal network protections are not set up to defend against an internal attacker. Setting up even a basic level of security segmentation across the network and protecting each segment with a proxy and a firewall will greatly reduce the intruders' access to the other parts of the network.

QW: Organizations should deny communications with (or limit data flow to) known malicious IP addresses (blacklists) or limit access to trusted sites (whitelists). Periodically, test packets from bogon source IP addresses should be sent into the network to verify that they are not transmitted through network perimeters. Lists of bogon addresses (unroutable or otherwise unused IP addresses) are publicly available on the Internet from various sources, and indicate a series of IP addresses that should not be used for legitimate traffic traversing the Internet.
QW: Deploy IDS sensors on Internet and extranet DMZ systems and networks that look for unusual attack mechanisms and detect compromise of these systems. These IDS sensors may detect attacks through the use of signatures, network behavior analysis, or other mechanisms to analyze traffic.
QW: On DMZ networks, monitoring systems (which may be built-in to the IDS sensors or deployed as a separate technology) should be configured to record at least packet header information, and preferably full packet header and payloads of the traffic destined for or passing through the network border.
Vis/Attrib: Define a network architecture that clearly separates internal systems from DMZ systems and extranet systems. DMZ systems are machines that need to communicate with the internal network as well as the Internet, while extranet systems are systems whose primary communication is with other systems at a business partner.
Vis/Attrib: Design and implement network perimeters so that all outgoing web, FTP, and secure shell traffic to the Internet must pass through at least one proxy on a DMZ network. The proxy should support logging individual TCP sessions; blocking specific URLs, domain names, and IP addresses to implement a blacklist; and applying whitelists of allowed sites that can be accessed through the proxy while blocking all other sites.
Vis/Attrib: Require all remote login access (including VPN, dial-up, and other forms of access that allow login to internal systems) to use two-factor authentication.
Config/Hygiene: All devices remotely logging into the internal network should be managed by the enterprise, with remote control of their configuration, installed software, and patch levels.
Config/Hygiene: Organizations should periodically scan for back-channel connections to the Internet that bypass the DMZ, including unauthorized VPN connections and dual-homed hosts connected to the enterprise network and to other networks via wireless, dial-up modems, or other mechanisms.
Config/Hygiene: To limit access by an insider or malware spreading on an internal network, organizations should devise internal network segmentation schemes to limit traffic to only those services needed for business use across the internal network.
Config/Hygiene: Organizations should develop plans for rapidly deploying filters on internal networks to help stop the spread of malware or an intruder.
Advanced: Organizations should force outbound traffic to the Internet through an authenticated proxy server on the enterprise perimeter.
Advanced: To help identify covert channels exfiltrating data through a firewall, built-in firewall session tracking mechanisms included in many commercial firewalls should be configured to identify long-term TCP sessions that last an unusually long time for the given organization and firewall device, alerting personnel about the source and destination addresses associated with these long-term sessions.

Associated NIST SP 800-53 Rev 3 Priority 1 Controls:

AC-17 (1), AC-20, CA-3, IA-2 (1, 2), IA-8, RA-5, SC-7 (1, 2, 3, 8, 10, 11, 14), SC-18, SI-4 (c, 1, 4, 5, 11), PM-7

Procedures and tools for implementing and automating this control:

One element of this control can be implemented using free or commercial IDSs and sniffers to look for attacks from external sources directed at DMZ and internal systems, as well as attacks originating from internal systems against the DMZ or Internet. Security personnel should regularly test these sensors by launching vulnerability-scanning tools against them to verify that the scanner traffic triggers an appropriate alert. The captured packets of the IDS sensors should be reviewed using an automated script each day to ensure that log volumes are within expected parameters and that the logs are formatted properly and have not been corrupted.

Additionally, packet sniffers should be deployed on DMZs to look for HTTP traffic that bypasses HTTP proxies. By sampling traffic regularly, such as over a 3-hour period once per week, information security personnel search for HTTP traffic that is neither sourced by nor destined for a DMZ proxy, implying that the requirement for proxy use is being bypassed.

To identify back-channel connections that bypass approved DMZs, network security personnel can establish an Internet-accessible system to use as a receiver for testing outbound access. This system is configured with a free or commercial packet sniffer. Then, security personnel connect a sending test system to various points on the organization's internal network, sending easily identifiable traffic to the sniffing receiver on the Internet. These packets can be generated using free or commercial tools with a payload that contains a custom file used for the test. When the packets arrive at the receiver system, the source address of the packets should be verified against acceptable DMZ addresses allowed for the organization. If source addresses are discovered that are not included in legitimate, registered DMZs, more detail can be gathered by using a traceroute tool to determine the path packets take from the sender to the receiver system.

Control 5 Metric:

The system must be capable of identifying any unauthorized packets sent into a trusted zone or out of a trusted zone and ensure that the packets are properly blocked and/or alerted on. Any unauthorized packets must be detected 24 hours, with the system generating an alert or e-mail for enterprise administrative personnel. Alerts must be sent every hour thereafter until the boundary device is reconfigured. While the 24 hour timeframe represents the current metric to help organizations improve their current state of security, in the future, organizations should strive for even more rapid alerting, with notification about unauthorized packets in a trusted zone being sent within two minutes.

Control 5 Test:

To evaluate the implementation of Control 5 on a periodic basis, an evaluation team must test boundary devices by sending packets from outside any trusted network to ensure that only authorized packets are allowed through the boundary. All other packets must be dropped. In addition, unauthorized packets must be sent from a trusted network to an untrusted network to make sure egress filtering is functioning properly. The evaluation team must then verify that the systems generate an alert or e-mail notice regarding the unauthorized packets within 24 hours. It is important that the evaluation team verify that all unauthorized packets have been detected. The evaluation team must also verify that the alert or e-mail is received within one hour indicating that the unauthorized traffic is now being blocked. The evaluation team must verify that the system provides details of the location of each machine with this new test software, including information about the asset owner. It is also important that the evaluation team test to ensure that the device fails in a in a state where it does not forward traffic when it crashes or becomes flooded.

20 Critical Security Controls << previous control next control >>

List Of Controls

Additional Security Controls

The following sections identify additional controls that are important but cannot be fully automatically or continuously monitored to the same degree as the controls covered earlier in this document.