Gateways securely manage data flows between connected networks from different security domains. In doing so, gateways take on the highest sensitivity or classification of connected security domains.
This section describes controls applicable to all types of gateways. Additional sections of these guidelines should also be consulted depending on the types of gateways being deployed and the security domains involved. For example, the ‘Cross Domain Solutions’ section of these guidelines should be consulted for gateways between different security domains where at least one security domain is classified SECRET or TOP SECRET.
Personnel involved in the planning, design, implementation or assessment of gateways should also refer to the Australian Signals Directorate’s (ASD) Gateway security guidance package.
Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the Guidelines for procurement and outsourcing.
Further information on the procurement of outsourced services can be found in the ‘Managed services and cloud services’ section of the Guidelines for procurement and outsourcing.
Further information on designing, configuring and managing networks can be found in the ‘Network design and configuration’ section of the Guidelines for networking.
Further information on privileged access to systems can be found in the ‘Access to systems and their resources’ section of the Guidelines for personnel security.
Further information on cyber security awareness training can be found in the ‘Cyber security awareness training’ section of the Guidelines for personnel security.
Further information on authenticating users can be found in the ‘Authentication hardening’ section of the Guidelines for system hardening.
Further information on authenticating IT equipment can be found in the ‘Network design and configuration’ section of the Guidelines for networking.
Further information on RPKI and ROA records is available from the Asia Pacific Network Information Centre.
Further information on event logging can be found in the ‘Event logging and monitoring’ section of the Guidelines for system monitoring.
Further information on event logging for network devices in gateways can also be found in ASD’s Priority logs for SIEM ingestion: Practitioner guidance publication.
Further information on the purpose of IRAP is available from ASD.
21 controls