3.1.20 Verify & Control/Limit Connections to & use of External Systems

To go back to the NIST 800-171 Controls page, click here.

Guides

• NIST SP 800-41 – Guidelines on Firewalls and Firewall Policy
• NIST SP 800-77 – Guide to IPSec VPNs
• SANS Institute – Web Application Firewalls

Sample Policy & Procedures

• Norfolk State University – Administrative Policy # 32-8-120 (2014) Use of External Information Systems
• National Weather Service Central Region Supplement 02-2010 – Information Technology Security Policy, NWSPD 60-702

Example Tools

• Proxy Servers
• Access Control Lists (ACLs)
• Web Application Firewall
• Virtual Private Network (VPN)

Additional Lessons Learned

• SANS Institute – Proxies and Packet Filters in Plain English

Vendor Documentation

• Microsoft Technet – Install and Configure the Web Application Proxy Server
• Squid – Proxy Server
• Symantec – Web Application Firewall & Reverse Proxy