IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Where IT systems are used to process sensitive data or are connected to a
computer network, no mobile phone cards should be permitted (see also
S 5.81 Secure transmission of data over mobile phones).
There is no foolproof way of protecting against the unauthorised transmission
of data over mobile phones, especially by insiders. However, taking mobile
phones into sensitive areas should be forbidden and checks should be made at
regular intervals to ensure that this ban is being adhered to.
Telephone directories
Call numbers and the associated names and/or additional details can be stored
in the telephone directory of a mobile phone. Telephone directories can be
stored on the terminal device, i.e. on the mobile phone or SIM card. They do
not have to have the same content. PINs can be used to restrict access to a
given telephone directory in the memory of the terminal device and/or of the
SIM card.
Whether it is best to hold telephone numbers in the mobile terminal or on the
SIM card will depend on various factors, for example how easy it is to back up
the data to other media (see S 6.72 Precautions relating to mobile phone
failures). Generally it is recommended that the data is stored on the SIM card,
since
- if the SIM card is replaced, the data can be made available on other devices
and
- any sensitive data can be easily cleared from the device (this is important,
for example, where repair work is necessary or a change of user occurs).
If possible, only one type of storage should be chosen. All important call
numbers should be stored in this telephone directory to ensure that they are
available at all times. The stored call numbers should be checked from time to
time to ensure that they are still correct and are necessary. All call numbers
should be stored in such a way that they can be called from anywhere in the
world, i.e. including the country and area codes. Since only the country code
is internationally agreed, and not the zero, every call number should be
entered with a "+" at the beginning, followed by the country code (e.g. +49 for
Germany), area code without leading zero and then the actual phone number.
For example, a possible entry might be +492289582369 GS hotline.
If the mobile phone is used by several users, only phone numbers which are
shared should be stored here. In addition, any facilities allowing the
prevention of changes to the telephone directory via the existing blocking
mechanisms should be used.
Use of answerphone functionality
Most network providers offer a service allowing an answerphone function on
a mobile phone. Under such arrangements, incoming calls are stored at the
network provider's in a mailbox or mobile box which can be retrieved by the
user at any time. This can be very useful, but generally use of the service
incurs additional costs.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Protection against
transfer of data over
mobile phones