IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
The RAS security concept should address the following points:
- A set of security guidelines covering RAS usage should be drawn up.
These RAS security guidelines must be oriented to the existing
organisation-wide security guidelines. As a general rule, permissions
granted for access over the RAS system should be less far-reaching and
checks should be tougher than with local access.
- The type and manner of user authentication and the mechanisms to be used
for this purpose should be specified.
- All components involved in authentication should be recorded and their
functions and interactions should be described.
- All components involved in access control should be recorded and their
functions and interactions should be described. In this way it is possible to
determine whether, for example, existing access control mechanisms can
be configured in such a way that more restrictive settings automatically
apply during remote access.
- As part of the security design, all points of RAS access to the local network
must be recorded and the manner in which these access points are
connected to the LAN must be specified (see also module 7.3 Firewalls).
- Proceeding on the basis of the current network structure, the security
concept must analyse which subnets can be remotely accessed. For busbased
networks (e.g. ethernet) typically all the computers in the subnet in
which the RAS access resides can be accessed. In this connection
consideration should be given to the possibility of creating dedicated
access networks from which only controlled access to the operational
network is possible (e.g. with the aid of routers, packet filters or an internal
firewall). The creation of access networks requires the purchase and
maintenance of additional hardware and software (see also S 5.77 Creation
of subnets).
- Organisational reporting channels must be planned so that in the event of a
security incident a targeted and rapid response is possible. The technical
concept should lay down appropriate mechanisms which enable the
detection of security incidents and calling in of the responsible
administrator who constitutes the initial point in the organisational
reporting channel.
- Since remote access to a LAN poses special security risks because of the
generally insecure environment in which RAS clients are used, every user
who is to be allowed RAS access must be given special training. This
training should ensure that users are made aware of the dangers and also
instruct them in how to handle the technical devices and software.
- If any authentication tokens are to be used, users must be informed of the
proper manner in which they should be handled.
- Again, the administrators must be given thorough training on the products
used and they must also be made aware of all the potential security risks.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
RAS security guidelines
Authentication
Access control
Recording of all RAS
access points
Restrictions on external
access
Reporting system for
security problems
Training and security
awareness