IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.179 Procedures controlling the use of fax servers
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrator of the fax server, fax mail
centre
To ensure the smooth operation of the fax server(s), procedures must be put in
place covering the points set out below.
1. Specification of responsibilities
A fax server consists of an IT system, the operating system installed on it and
the fax server application. Then there are the fax clients of the users.
Accordingly the maintenance for the fax server must be organised. Depending
on the existing organisational structure, persons who will have responsibility
for these areas must be appointed. In some cases this can mean that each of
these areas is supported by different administrators. For example, the
operating system could be administered by the organisational unit which is
also responsible for administration of the other IT systems. On the other hand,
the fax application should be administered in the fax mail centre. Depending
on the type of use, the mail centre is also responsible for ensuring that
incoming fax transmissions are forwarded to the responsible person.
Responsibility for issuing access authorisations for the fax server should lie in
the mail centre as well. Other tasks include resetting passwords and
configuration of new users. Thus it is especially important to define the tasks
and responsibilities of the fax mail centre (see S 2.180 Setting up a fax mail
centre).
2. Definition of the user community
The group of persons who are authorised to use the fax server must also be
specified. Authorisations for incoming fax transmissions could include the
following:
- Read rights,
- Forwarding rights
- Delete rights.
Authorisations for outgoing fax transmissions could include the following:
- Send rights,
- Suspend rights,
- Delete rights,
- right to alter transmission options.
These classes of authorisation should if possible be granted only to user
groups and only in exceptional cases to individual users, as is customary in
administration generally (see also S 2.30 Provisions governing the
configuration of users and user groups).
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000