IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- access to the actual terminal device, i.e. the mobile phone,
- access to certain functions of the mobile phone, e.g. the telephone
directory,
- access to the mailbox, i.e. to the answer phone function, or to other
services of the network provider,
- access to data held by the network provider (e.g. when a caller queries the
hotline about billing, sometimes a password has to be given).
All these security mechanisms should be used (see also S 4.114 Use of the
security mechanisms provided on mobile phones). Under no circumstances
should the personal identification number (PIN) be kept in the same place as
the SIM card for the mobile phone.
If the SIM card is lost, arrangements should be taken immediately for the
network provider to block the card so as to prevent possible misuse and any
resulting financial loss (see S 2.189 Blocking of the mobile phone in the event
of its loss).
To ensure that misuse of the SIM card is noticed promptly, the itemised call
breakdown should always be checked for inexplicable charges and destination
numbers.
Itemised call breakdowns
The network provider stores the call data for billing purposes. In Germany,
under the directive concerning data protection for companies which provide
telecommunications services (TDSV) the network provider is only allowed to
retain this data up to the date on which an invoice is prepared, but no longer
than 80 days. However, it can be appropriate for the customer to allow the
network provider to store the call data for longer in case any problems should
subsequently occur in connection with invoicing.
Every customer should demand itemised call breakdowns in order to be able
to review mobile phone usage. In Germany customers are entitled to receive
itemised call breakdowns free of charge. The following data can be obtained
from this source:
- invoice date,
- numbers called (full number or else the last numbers may be unavailable)
- beginning, end and duration of the call,
- cost of the call.
All users who share the telephone must be informed of the fact that an
itemised call breakdown has been requested and what data will be collected by
this means.
If an organisation maintains and analyses itemised call breakdowns for cost
control reasons, the procedure must be agreed with the works council or staff
council, and the Data Privacy Officer and users must be advised.
The itemised call breakdowns should always be checked following receipt to
ensure that they are correct. This will provide insight into possible ways of
reducing costs.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000