S 5.19 Internet use
Description
Today, using Internet services at the workplace is a matter of course and necessary in most organisations. This includes for example e-mail, using information offers and Internet services, online banking, e-commerce and e-government applications. Depending on the tasks and the workplace, using instant messaging, social networks, web conferences and other services may also be required.
Most Internet services can be used via browsers or other applications that are already available in standard operating systems. In some operational scenarios, special software is required for using Internet services, for example, for using instant messaging, for reading news or for online banking.
This module must always be applied when the Internet is to be accessed (except for e-mail) using a browser or special software. The module does not cover networks and other connections. Corresponding modules must be applied to them. Secure integration of e-mail is described in module S 5.3 Groupware.
This module describes the threats and safeguards applying specifically to Internet use. In addition, other modules such as the corresponding modules on networks as well as S 3.301 Security gateway (firewall) and S 1.6 Protection against malware must be implemented to ensure secure connection to the Internet. In order to secure the clients, module S 3.201 General clients as well as possibly an additional module specific to the operating system must be implemented. This module does not cover stand-alone Internet PCs (see S 3.208 Internet PCs), which constitute a special form of Internet use.
Threat scenario
The following typical threats to the IT-Grundschutz of Internet use are assumed to exist:
Force Majeure
| T 1.10 | Failure of a wide area network |
Organisational Shortcomings
| T 2.1 | Lack of, or insufficient, rules |
| T 2.2 | Insufficient knowledge of rules and procedures |
| T 2.4 | Insufficient monitoring of security safeguards |
Human Error
| T 3.3 | Non-compliance with IT security measures |
| T 3.38 | Errors in configuration and operation |
| T 3.44 | Carelessness in handling information |
| T 3.45 | Inadequate checking of the identity of communication partners |
| T 3.105 | Unapproved use of external services |
| T 3.106 | Inappropriate behaviour when using the Internet |
| T 3.107 | Damage to reputation |
Technical Failure
| T 4.22 | Software vulnerabilities or errors |
Deliberate Acts
| T 5.2 | Manipulation of information or software |
| T 5.28 | Denial of services |
| T 5.42 | Social Engineering |
| T 5.48 | IP spoofing |
| T 5.78 | DNS spoofing |
| T 5.87 | Web spoofing |
| T 5.88 | Abuse of active content |
| T 5.156 | Bot networks |
| T 5.157 | Phishing and pharming |
| T 5.158 | Abuse of social networks |
| T 5.177 | Abuse of short URLs and QR codes |
Method recommendation
To secure the information system examined, other modules will need to be implemented in addition to this module. These modules are selected based on the results of the IT-Grundschutz modelling process.
For secure Internet use, the following steps regarding information security should be taken in a company and/or government agency:
Planning and design
It is necessary at the beginning to answer some questions relating to Internet use, for example which Internet services should be used in the organisation, who is allowed to use which Internet services, which rules need to be observed in this respect and how the internal IT systems that are allowed to use the Internet must be protected (see S 2.457 Concept for secure Internet use).
For secure Internet use, a binding guideline must be specified, covering for example who is allowed to use what Internet services when and for what purpose (see S 2.458 Guideline for using the Internet). With respect to e-mail, a separate module including a guideline for e-mail use is available.
Implementation
Both users and administrators have a very significant influence on secure Internet use. Therefore, users and administrators must be trained on how to handle the IT components used and/or on how to use the Internet services (see S 3.77 Awareness-raising for secure Internet use).
Operation
Depending on the security requirements, the IT components needed may require different configurations. This relates to security gateways and the network switching elements, but also to servers and clients. For the clients, the browser used (see S 5.45 Secure use of browsers and S 5.155 Data protection aspects when using the Internet), the e-mail client (see also module S 5.3 Groupware) and the software for the web applications used in particular must be protected and secured.
Contingency Planning
Since Internet use can be critical to operations, failure must be prevented. For this purpose, alternate procedures must also be established for the Internet applications (see S 6.141 Defining alternate procedures when using the Internet). In addition, responses to security incidents caused by Internet use must be defined (see also module S 1.8 Handling of security incidents).
The bundle of security safeguards for the "Internet use" module is presented in the following:
Planning and design
| S 2.457 | (A) | Concept for secure Internet use |
| S 2.458 | (A) | Guideline for using the Internet |
| S 2.459 | (W) | Overview of Internet services |
| S 5.66 | (B) | Use of TSL/SSL |
| S 5.69 | (A) | Protection against active content |
Implementation
| S 2.460 | (C) | Regulated use of external services |
| S 3.77 | (A) | Awareness-raising for secure Internet use |
Operation
| S 2.313 | (A) | Secure registration with Internet services |
| S 3.78 | (W) | Correct behaviour on the Internet |
| S 5.45 | (B) | Secure use of browsers |
| S 5.155 | (Z) | Data protection aspects when using the Internet |
| S 5.156 | (Z) | Secure use of Twitter |
| S 5.157 | (Z) | Secure use of social networks |
| S 5.158 | (Z) | Use of web disk space |
| S 5.173 | (Z) | Use of short URLs and QR codes |
Contingency Planning
| S 6.141 | (C) | Defining alternate procedures when using the Internet |