Network Access

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.6.1 Network Access] and [2.6.5 Wireless Network Access], which belong to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

All paths that can access the organization's network shall be identified, and network access control management procedures shall be established and implemented so that related risks, such as unauthorized access to the network, can be effectively prevented and responded to.

• Control of unauthorized IP use, such as assigning IP addresses to information systems, personal information processing systems, PCs, etc. in accordance with an approval procedure
• Control of internal network access by unauthorized persons and terminals
• Blocking of unnecessary services and ports installed on network devices, etc.

Network areas shall be physically or logically separated according to services, user groups, the importance of information assets, and legal requirements, and access control shall be applied between each area.

• Determine the level of network separation and inter-area access control for core business areas through risk assessment

Access control area	Access control application example
DMZ	Public servers such as web servers and mail servers for external services are located in the DMZ. Direct connections from the internet to internal systems not passing through the DMZ are blocked
Server farm	Configured separately from other network areas. Access control policy applied to allow only access by authorized internal users
DB zone	The network area where databases storing important information such as personal information are located is separated from other network areas
Operator environment	The operator network area operating servers, security devices, network devices, etc. is separated from the general user network area
Development environment	The network used for development work (development servers, test servers, etc.) is separated from the operational network
External party area	The network area used by external personnel (outsourced services, civil affairs offices, training rooms, etc.) is separated from the internal business network
Other	For the business network, network band separation criteria are established and operated according to the characteristics and importance of the work. When using cloud services, access control criteria reflecting the characteristics of the cloud environment are established and implemented. However, if it is difficult to distinguish server farms and database farms considering the size of the enterprise, etc., it is necessary to apply supplementary measures based on risk assessment results, etc. (host-based access control, etc.)

• Between network areas separated according to the access control policy, control is applied using firewalls, network device ACLs, etc., to allow only access to the services necessary for performing work between network areas

Criteria for assigning IP addresses by network band shall be established, and when important systems such as database servers do not require connection to the outside, they shall be assigned private IPs so that direct access from the outside is impossible.

• Keep the IP address assignment status up to date, and manage it securely at a confidential or higher level so that it is not leaked externally
• Use a private IP address scheme for the addressing scheme in the internal network, and apply the NAT (Network Address Translation) function so that the internal addressing scheme is not exposed externally
• When assigning private IP addresses, use private IP address bands in accordance with international standards

※ Private IP address bands

• A Class : 10.0.0.0 ~ 10.255.255.255
• B Class : 172.16.0.0 ~ 172.31.255.255
• C Class : 192.168.0.0 ~ 192.168.255.255

When connecting to physically remote IDCs, branches, agencies, partner companies, customer centers, etc., a secure connection environment shall be configured using dedicated lines or VPN (Virtual Private Network), etc.

When a wireless network is used for business purposes, protective measures must be established and implemented to secure the wireless AP and network segment, taking into account the following matters such as authentication and encryption of transmitted and received data.

• Managing the list of wireless network devices (APs, etc.)
• Configuring encryption functions for user authentication and information transmission/reception (WPA2-Enterprise mode, WPA3-Enterprise mode, etc.)
• Authentication methods for terminals connecting to the wireless AP (MAC authentication, etc.)
• Enabling the SSID hiding function
• Configuring ACLs for the wireless network
• Access control for administrators of the wireless AP (IP restriction), etc.

Application and termination procedures must be established and implemented so that only authorized employees can use the wireless network.

• Procedures for applying for and approving wireless network usage rights (registration of users and connecting terminals, etc.)
• Procedures for terminating access rights when the wireless network is no longer needed due to reasons such as resignation or expiration of the usage period
• Separating the wireless network provided to external persons from the wireless network used by employees, etc.

Protective measures against unauthorized wireless networks, such as detection/blocking of AD Hoc connections and unauthorized wireless APs within the organization, must be established and implemented.

• Installing/operating a WIPS (Wireless Intrusion Prevention System) and periodically checking for the installation of unauthorized APs (Rogue APs), etc.