IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.188 Security guidelines and rules for the use of
mobile phones
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Head of IT Section, IT Security Management
A number of different ways of protecting mobile phones against misuse are
available. In order that the methods are also used, a set of security guidelines
specifying all the security mechanisms to be implemented should be drawn up.
In addition, a short and clear instruction sheet covering the secure use of
mobile phones should be prepared for the users.
Data classes found
As soon as a mobile phone is switched on, it registers itself with the network
provider through the nearest base station. At the network provider, data on the
identity of the user, the serial number of the mobile phone and the identity of
the base station over which registration has occurred is logged and stored.
This is done even if no conversation takes place. Moreover, every time a
number is dialled this event is stored, irrespective of whether a connection is
established or not.
The classes of data generated during use of mobile phones fall into three
rough categories:
- Inventory data (or master data) is data which is permanently held in a
service or network and is kept available. This includes the call number and,
if necessary, the name and address of the subscriber, information about the
type of terminal device, if appropriate any features and authorisations
relevant to the connection as well as data about the assignment of
subscriber groups.
- Content data is the real "useful data", i.e. the information and messages
transmitted.
- Call data provides information about the detailed instances of
communication. This includes data on communication partners (e.g. call
numbers of the calling and called connection), time and duration of the
connection, system services used, connections used, lines and other
technical facilities, services and, in the case of mobile services, the location
IDs of the mobile terminals.
Recommendations are provided below as to how this data can be protected
against misuse.
Protection against card misuse
The mobile phone and SIM card must always be kept safe. They should never
be left unattended during business trips. In particular they should not be left in
parked vehicles.
Mobile phones and related services offered can be protected at various points
by means of PINs and passwords. These include:
- access to the SIM card,
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000