What is the principle of dividing Firewalls into classes and levels?

Question

firewall

Hello, as far as I know, Firewalls are divided into: ME class, NDVB level, ISPDn class. Please explain in more detail what this means? What determines the class, level ... and what is needed for what purposes. Thank you.

Answer 1

To begin with, the terms:
FSTEC - Federal Service for Technical and Export Control ( link )
NDV - undeclared capabilities: software functionality that is not described or does not correspond to those described in the documentation, the use of which may violate the confidentiality, availability or integrity of the information being processed.
From the point of view of the FSTEC, certified firewalls come in five classes from ME1 to ME5 ( here is a good table on the characteristics of the levels), while the higher the class, the more stringent the requirements ( link to the requirements document).
Certification according to NDV means fulfillment of the requirements of another governing document of the FSTEC:document . Four levels of control (from the lowest fourth to the highest first), invented back in 1999, are designed with varying degrees of confidence to guarantee the absence of all kinds of bugs, back doors, etc. in the software (including the firmware of hardware devices). Such checks involve opening source codes in one way or another.
ISPDn - Personal Data Information System. The ISPD class defines the type of such a system, the ISPD classification is given in this document , and here you can also find a brief description of the ISPD classes.
Now let's group this information:
For example, take thisa list of firewalls, in the table we see three columns: "Class Firewall" - this is the class of the firewall, which is assigned (by a certain authority of the Russian Federation) in accordance with certain parameters of the Firewall itself, that is, this is what the Firewall is capable of (roughly speaking), further there is a column - "NDV Level", this is the level that determines the approximate probability that the ME can be deceived / bypassed / hacked, in general, the reliability of the ME, then comes the column "ISPDn Class" - this is the class of the personal data information system for which this ME is suitable.
That is, these three criteria are not directly related (perhaps indirectly in some aspects), and each criterion (ME Class, NDVB Level, ISPD Class) is determined in accordance with the rules that are in the documents given above.