What is this standard about?
This is the fifth in a six-part international series of standards on ICT network security. This part is about strengthening the technical controls which underpin the security of Virtual Private Networks (VPNs). The other parts are:
- Part 1: Overview and concepts
- Part 2: Guidelines for the design and implementation of network security
- Part 3: Reference networking scenarios – Threats, design techniques and control issues
- Part 4: Securing communications between networks using security gateways
- Part 6: Securing wireless IP network access
Who is this standard for?
- Those responsible for information security within organizations, specifically network security
- Those involved in detailed planning, design and implementation of networks, e.g.:
- Systems architects and designers
- Network managers
- Network security officers
Why should you use this standard?
VPNs have developed rapidly as a means of inter-connecting networks and connecting remote users to networks. In their simplest form, they provide a mechanism for establishing a secure data channel over an existing network or point-to-point connection. They’re assigned to the exclusive use of a restricted user group, and can be established and removed dynamically, as needed.
However organizations can expect increasingly sophisticated attacks to be mounted against their systems. Attempts at unauthorized access can be malicious, for example leading to a Denial of Service attack, the misuse of resources, or access to valuable information.
As a defence, this standard gives guidelines for the selection, implementation and monitoring of the technical controls necessary to provide network security using Virtual Private Network (VPN) connections to interconnect networks and connect remote users to networks.
It supplies guidance on how to:
- Address space and routing separation between VPNs carried over the label switched network
- Provide resistance to unauthorized access attacks
- Ensure the internal structure of the label switched network core is not visible to outside networks
- Limit information available to a potential attackers
- Protect against label spoofing
What’s changed since the last update?
This standard is a technical revision of BS ISO/IEC 18028-5:2006 which it supersedes.