IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- On the LAN side, does the server software support all the
network technologies that are used locally (e.g. ethernet,
Token Ring, ATM)?
- On the WAN side, do the client and server software support
all the access technologies which will be used (e.g. ISDN,
mobile phone, analogue telephone line, X.25)?
- Does the RAS server allow several RAS clients to dial in at
the same time?
- Does the RAS product support different protocols for remote
access over telecommunications networks (e.g. PPP, SLIP)?
- Does the RAS product support different service protocols for
remote access (e.g. TCP/IP, NetBEUI, XPC, DECnet)?
- Are tunnel protocols (e.g. PPTP, L2F, IPSec) supported for
Internet-based access?
- Depending on the access technology used, does the RAS
product allow the use of additional, technology-dependent
mechanisms (e.g. channel bundling for ISDN, callback of the
RAS client by the RAS server)?
2.6 Security: communication, authentication and access
- Does the product allow secure data transmission?
- Does the product allow the use of alternative security
mechanisms (IPv4 mechanisms, IPSec)?
- Is communication protected using standard mechanisms? In
particular, all the cryptographic algorithms used should be
established and state-of-the-art. The product should comply
with current standards.
- Does the product architecture allow subsequent installation of
new security mechanisms?
- Are remote users granted access to the local network only
after successful authentication?
- Does the system allow remote users to be authenticated using
several authentication mechanisms (e.g. user name and
password, Challenge-Response, Calling Line Identification -
CLI)?
- Is the system architecture designed in such a way that new
authentication mechanisms can be subsequently integrated?
- Does the RAS system allow the use of one or more commonly
used external authentication services (e.g. SecureID,
-
RADIUS, TACACS+)?
Is it possible to integrate additional external authentication
services?
- Does the RAS system transmit the information necessary for
access control of access to data in the local network (user ID,
security ID) to the local access control mechanisms?
Once all the requirements for the product to be purchased have been
documented, the products available on the market must be thoroughly
researched to establish to what extent they satisfy these requirements. It is
likely that not every product will satisfy all the requirements at the same time
or equally well. Therefore each requirement should be weighted in a manner
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000