IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
5. Contingency planning and operational reliability
The fax security guidelines should also cover contingency planning and failsafe
fax operation. If availability is an important factor, it may be appropriate
to have redundant fax servers. In this connection consideration should also be
given to the question of whether conventional fax machines should be kept
available for use in emergencies (see also S 6.69 Contingency planning and
operational reliability of fax servers).
6. Data backup
The fax server should be included in the data backup policy of the
organisation (see Section 3.4). In particular, the data backup policy must
specify who is responsible for taking the backups and what should be backed
up. The items subject to backup can include software, configuration data,
saved or archived fax data and even log files. The intervals at which backups
are taken and the number of generations which must be kept should also be
specified, as must the person responsible for checking any log files generated
during data backup. Finally, the fact that a backup has been performed or that
the log files have been evaluated should be documented.
7. Training
In addition, the fax security guidelines should be supplemented by an
organisation-wide training concept. As a first step, the staff responsible for
administering the IT system and the fax server application must be given
appropriate training. The users must then be made aware of the dangers which
apply where a fax server is used in comparison with a conventional fax
system.
Additional controls:
- Are there any security guidelines for the use of faxes?
- Are the security guidelines for the use of faxes regularly updated in line
with changes to the environment in which they are used?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000