add network separation rule to A14

sig-bsi-grundschutz · Oct 9, 2024 · 024b942 · 024b942
1 parent 5c5aaa6
commit 024b942
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/applications/openshift/general/general_network_separation/rule.yml b/applications/openshift/general/general_network_separation/rule.yml
@@ -18,3 +18,5 @@ ocil_clause: 'Network separation needs review'
 
 ocil: |-
     Create separate Ingress Controllers for the API and your Applications. Also setup your environment in a way, that Control Plane Nodes are in another network than your worker nodes. If you implement multiple Nodes for different purposes evaluate if these should be in different network segments (i.e. Infra-Nodes, Storage-Nodes, ...).
+    Also evaluate how you handle outgoing connections and if they have to be pinned to
+    specific nodes or IPs.
diff --git a/controls/bsi_app_4_4.yml b/controls/bsi_app_4_4.yml
@@ -406,6 +406,7 @@ controls:
     rules:
       # Section 1,2,3,4
       - general_node_separation
+      - general_network_separation
       # Section 2
       - configure_egress_ip_node_assignable
       # Section 3