ГОСТ Р № 57580.1-2017 от 01.01.2018

СМЭ.9 Выделение в составе сегментов контуров безопасности отдельных сегментов управления, в которых располагаются только АРМ эксплуатационного персонала, используемые для выполнения задач администрирования информационной инфраструктуры
3-Н 2-Н 1-Т

/STANDARD
A workstation or a server used for administration actions must, under no circumstances, have access to the Internet, due to the risks that web browsing (websites containing malware) and email (potentially infected attachments) bring to its integrity. 

For other administrator uses requiring the Internet (viewing documentation online, their email, etc.), it is advisable to provide them with a separate workstation. Failing this, access to a remote virtual infrastructure for office applications from an admin device is possible. The reverse, consisting of providing remote access to an admin infrastructure from an office device, is not advisable as it can lead to a privilege elevation in the event admin authenticators are recuperated. 

/STANDARD
When the network is "flat", without any partitioning mechanism, each device in the network can access any other device. If one is compromised all of the connected devices are therefore in jeopardy. A hacker can therefore compromise a user’s device and then, moving around from device to device, find a way to critical servers. 

Therefore it is important, from the network architecture’s design, to work through segmentation into areas made up of systems with uniform security needs. You may, for example, separately group infrastructure servers, business servers, user workstations, administrator workstations, IP phones, etc. 

One area is therefore characterised by dedicated VLANs and IP subnetworks or even by infrastructures dedicated according to their criticality. Therefore, partitioning measures such as an IP filter with the help of a firewall can be implemented between the different areas. Specifically, you will ensure that the devices and flows associated with administration tasks are segregated as far as possible. 

For networks for which subsequent partitioning would not be easy, integrating this approach in any new network extension or when devices are changed is recommended. 

/STANDARD
An administration network interconnects, among others, the administration devices or servers and the device administration interfaces. Within the logic of segmentation for the organization’s global network, it is essential to specifically segregate the administration network from the user office network, to prevent any intrusion by redirection from a user device to an administration resource. 

Depending on the organization’s security needs, it is advisable:

A.9.2.3 Управление привилегированными правами доступа 
Мера обеспечения информационной безопасности: Распределение и использование привилегированных прав доступа следует ограничивать и контролировать 

А.5.18 Права доступа
Права доступа к информационным и иным связанным с ней активам должны предоставляться, пересматриваться, изменяться и удаляться в соответствии с специфической тематической политикой и правилами управления доступом организации.

А.8.2 Привилегированные права доступа
Должны ограничиваться и управляться назначение и использование привилегированных прав доступа.

А.8.22 Сегментирование сетей
Сеть организации должны быть сегментирована на группы информационных сервисов, пользователей и информационных систем.

А.8.2 Privileged access rights
The allocation and use of privileged access rights shall be restricted and managed.

А.8.22 Segregation of networks
Groups of information services, users and information systems shall be segregated in the organization’s networks.

А.5.18 Access rights
Access rights to information and other associated assets shall be provisioned, reviewed, modified and removed in accordance with the organization’s topic-specific policy on and rules for access control.