IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
required to check recipients' call numbers in the case of important fax
transmissions (e.g. individual quotations).
9. Use of the fax server
Procedures covering use of the fax server by staff must also be drawn up (see
S 3.15 Information on the use of faxes for all employees). Finally, which rights
employees may exercise on the fax server must also be specified.
10. Protection of the fax client
Appropriate organisational and technical measures must be taken to ensure
that no faxes can be read without authorisation or can be sent either without
authorisation or unintentionally. Users must therefore be trained in use of the
fax programs and made aware of the potential risks.
Authentication of employees on the fax server is especially important. This
can be effected explicitly via a fax client or else by logging on to a directory
service, a domain controller (in a Microsoft Windows NT environment) or an
e-mail system. Where employees are authenticated to the fax server over a
client, if possible the logon password should not be stored on the hard disk as
that would invalidate its value as a security mechanism. Anyone who has
access to the appropriate fax client can send faxes under another name and
read incoming fax transmissions without authorisation. Moreover, employees
should be encouraged to log off from the fax server after collecting incoming
fax transmissions and sending outgoing faxes. Steps should be taken to ensure
that the computer is protected when staff leave their desks, e.g. through the
use of password-protected screen savers or some mechanism of the operating
system used (see S 4.1 Password protection for IT systems and S 4.2 Screen
lock).
11. Repairs and maintenance
There should also be procedures covering repairs and maintenance work
performed on the fax server. System administrators must know whom to
contact when maintenance work or a repair is necessary. Procedures for
handling faulty data media and especially faulty hard disks must also be
defined.
Additional controls:
- Are the procedures for use of the fax server regularly updated in line with
changes to the environment in which they are used?
- Are procedures covering the forwarding of incoming fax transmissions
when recipients are absent from the office absent in force?
- Are there any procedures relating to training of staff in the use of fax
programs?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000