IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
2.2 Error handling
- Is the security of RAS connections also assured after a critical
failure or error (e.g. by preventing any further connections
after abnormal termination)?
- Can the system behaviour be reconfigured after a critical
failure or error? For example, is it possible to configure the
system so that after a critical error it is automatically rebooted
or the Administrator is informed?
2.3 Administration
- Does the documentation delivered with the product contain a
full description of all the technical and administrative details?
- Can the administrative functions be accessed via a graphical
user interface which is intuitive to use? Are the administrative
functions designed so that attention is drawn to any incorrect,
insecure or inconsistent configurations settings or these are
prevented?
- Do the administrative functions permit both command line
data input and entry via a graphical user interface?
- Is access to the administrative functions protected through
adequate access control, e.g. using password entry,
2.4
implementation of a role concept (Administrator, Internal
Auditor), two-person rule?
Logging
- Does the product offer logging facilities?
- Is it possible to configure the amount of detail logged? Is all
the relevant data captured by the logging?
- Do the logging facilities allow data to be captured in different
categories (e.g. by connection, user, protocol, service)?
- Are there constraints on who may access the logged data?
- Does the product allow the logged data to be stored not only
locally but also on remote computers (central logging)? Are
different data transmission methods offered for remote
storage, so that external logging systems can also be used (e.g.
syslog)? Can the logged data be transmitted securely?
- Does the product offer a component enabling analysis of the
logged data?
- Is the logging mechanism compatible with the system
management system used (transmission format, transmission
protocol)?
- Does the product offer facilities enabling the administrator to
be informed or suitable protective measures (rejecting the
RAS client, blocking of user accounts) to be automatically
implemented in the event of certain predefined events
occurring (e.g. denial of access, several successive
-
unsuccessful attempts at authentication)?
Can logging be performed in such a way that the data privacy
protection regulations can be satisfied?
2.5 Communication and data transmission
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000