IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Disclosure of call numbers
It is possible to choose whether and what data on mobile phone connections
should be entered in public phone directories and/or be available to users of
directory enquiry services. If a call number is entered it is easier for other
people to call one. However, this is not appropriate for all applications, e.g.
where a mobile phone pool is used or if it is desirable to keep the number of
incoming calls low.
If the calling number display function is enabled, persons called can see the
number from which they are being called (assuming their equipment has the
appropriate configuration). This service can generally be enabled or disabled
by the network provider for a given mobile phone.
Call number suppression
In the GSM network, the number from which a call is being made can be
indicated to the recipient of a call. If this is not desirable, then the precautions
suggested in S 5.79 Protection against call number identification during use
of mobile phones should be heeded.
Protection against interception of phone calls
The only effective protection against interception of the contents of phone
calls is to employ interoperable, network-wide end-to-end encryption. As this
encryption is not implemented, every connection over either the landline
network or the mobile communication network can potentially be intercepted.
However, in Germany and most other countries communications between
mobile phone and base station are automatically encrypted.
The following measures are recommended as a means of reducing the threat:
- Phone calls should not be made at any time and in any place. To make a
phone call, a quiet area should be sought (this will also mean less
disturbance to other people).
- As a matter of principle, confidential information should not be
communicated on the telephone.
- Some mobile phones indicate on the display when the transmission
between mobile phone and base station is not encrypted. If such a display
is provided, users should be told about it. From time to time users should
glance at the display to satisfy themselves that calls are actually being
encrypted. Thus, for example, there are some countries in which
communications between mobile phone and base station are not encrypted.
- There are also a few, relatively expensive mobile phones which allow endto
end encryption of communications. However, to avail oneself of this
facility, both the caller and the person receiving the call must use
compatible equipment. If there is a need to frequently communicate highly
sensitive information over mobile phone, it may be appropriate to invest in
such equipment.
- Where data is to be transmitted e.g. from a laptop over GSM, it should be
encrypted on the terminal device prior to transmission. A number of
programs are available for achieving this relatively simply.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000