topic Re: Boundary Protection in Network Security

Boundary Protection

warwolf002 — Fri, 21 Feb 2020 16:01:16 GMT

I need to know for a client if the Cisco ASA 5506-X Network Security Firewall with Security Plus License is compliant with this security question:

Does the agency ensure that boundary protection devices do not release unauthorized information if a failure occurs (the device should "fails closed" versus "fails open")?

Thank you.

Re: Boundary Protection

mvsheik123 — Thu, 26 Jul 2018 01:46:15 GMT

Hi,

AFAIK there is no definitive answer for your client. This this depends on multiple factors like how the device is configured, what traffic permitted, what encryption used, how it is administered (software updates etc) and so on. A failure can be different ways. As you are well aware- if there its power failure - the fail close and all traffic will be blocked. Any network device can protect upto certain extent and it is recommended to implement multi layer protection at perimeter.

hth

Re: Boundary Protection

Dennis Mink — Thu, 26 Jul 2018 05:17:45 GMT

What is their definition of "failure" was this elaborated? if not, its impossible to answer the question.

Re: Boundary Protection

warwolf002 — Thu, 26 Jul 2018 17:26:24 GMT

Thank you for your response.

Here is the only additional information I could find on this question from
the questionnaire:

5. Ensure the operational failure of the boundary protection mechanisms do
not result in any unauthorized release of information outside of the
information system boundary (i.e. the device shall "fails closed" vs. "fails
open").

Re: Boundary Protection

mvsheik123 — Thu, 26 Jul 2018 20:23:54 GMT

Hi,

You can tell client incase of power failure - its fail close. You may hear back from them with more color to the question.

hth