INTERNATIONAL ISO/IEC STANDARD 27033-5 First edition 2013-08-01 Information technology Security techniques Network security Part 5: Securing communications across networks using Virtual Private Networks (VPNs) Technologies de I'information - Techniques de sécurité - Sécurité de réseau Partie5:Sécuritedescommunicationsautraversdesréseauxutilisant des réseaux privés virtuels (VPNs) Reference number IS0/IEC 27033-5:2013(E) IEC SO @IS0/IEC 2013 IS0/IEC 27033-5:2013(E) COPYRIGHTPROTECTEDDOCUMENT @IS0/IEC2013 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form writtenpermission.Permission canberequestedfromeitherIso attheaddressbeloworIso'smemberbodyinthecountry of the requester. ISO copyright office Case postale 56 : CH-1211 Geneva 20 Tel. + 41 22 749 0111 Fax + 41 22 749 09 47 E-mail [email protected] Web www.iso.org Published in Switzerland ii @ IS0/IEC 2013 - All rights reserved IS0/IEC 27033-5:2013(E) Contents Page Foreword ..iv 1 Scope .1 2 Normative references 3 Terms and definitions 4 Abbreviations. ..2 5 Document structure ..2 6 Overview. .2 6.1 Introduction .2 6.2 Types of VPNs .3 7 Security Threats .4 8 Security Requirements .5 8.1 Overview .5 8.2 Confidentiality .5 8.3 Integrity .. 6 8.4 Authenticity 8.5 Authorization .6 8.6 Availability. 8.7 Tunnel Endpoint Security .. 6 9 Security Controls. .6 9.1 Security aspects. .. 6 9.2 Virtual circuits. .7 10 Design Techniques. .7 10.1 Overview 10.2 Regulatory and legislative aspects ..8 10.3 VPN management aspects ..8 10.4 VPN architectural aspects. ..8 10.5 VPN technical considerations. .11 11 Guidelines for Product Selection ..12 11.1 Carrierprotocolselection .12 11.2 VPN appliances. .12 Bibliography .14 @ IS0/IEC 2013 - All rights reserved ii