IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.186 Selection of a suitable RAS product
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Head of IT Section, Administrator
RAS products differ as to the range of functions provided, the security
mechanisms offered, ease of operation and cost-effectiveness. Moreover there
are differences in the hardware and software components in the operational
environment which they require for smooth operation.
Before a RAS product is purchased, a list of requirements against which the
products available on the market can be evaluated should therefore be drawn
up. An informed purchase decision which will ensure that the product
purchased satisfies the requirements when put into operation can then be made
on the basis of the evaluation.
A RAS system generally consists of several hardware and software
components so that, strictly speaking, one should not really talk about a RAS
product as if it were a single entity. Initially a rough distinction can be made
between LAN-side and client-side components. The specific components
which have to be purchased depend on the chosen RAS system architecture.
Thus, in the simplest case, for example, a Windows-based PC and a laptop,
each of which is fitted with an ISDN card (see also S 2.106 Purchase of
suitable ISDN cards), can function as RAS server and client and use the
Windows NT Remote Access Service. On the other hand, large organisations
often operate many RAS connections concurrently for different operational
purposes. Solutions here generally require special IT systems (hardware and
software) which are specifically designed for use as RAS servers.
The list below provides a rough summary of the possible general evaluation
criteria, but does not claim to be exhaustive and can be extended to include
other general requirements. In addition to the criteria listed here, further
specific requirements which result from the planned actual operational
scenarios must be identified as part of the RAS requirements analysis (see
safeguard S 2.183 Performing a RAS requirements analysis).
1 General criteria
1.1 Performance and scalability
- Can the system satisfy the performance requirements?
- Can transparent load balancing or data compression be
configured for the system?
- Can the system be designed in such a way that it can cope
with future growth requirements (e.g. through modular system
structure, simple integration of new RAS servers, no separate
user administration for new RAS connections)?
1.2 Maintainability
- Is the product simple to maintain?
- Does the vendor offer regular software updates?
- It is possible to conclude maintenance contracts for the
product?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000