IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
S 4.45 Setting up a secure Peer-to-Peer environment
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
The administrator should individually authorise or block the Peer-to-Peer
functions for every computer in the WfW network and thus restrict the WfW
environment in a user-specific way. To do this he requires the administration
tool ADMINCFG.EXE.
After calling up ADMINCFG.EXE, the security configuration file
WFWSYS.CFG, in which the security settings of the respective WfW
computer are stored, must first be opened. ADMINCFG.EXE cannot
distinguish in this case between different users on one WfW computer.
Even if it is not intended to restrict the environment, the security configuration
file WFWSYS.CFG must be provided with password protection. If the
administration tool ADMINCFG.EXE is installed locally for this purpose, it
must be removed afterwards.
From the point of view of security, it is possible to create the following
configurations for the computer with the aid of the administration tool
ADMINCFG.EXE:
The sharing options must be specified:
- If the computer is not intended for the sharing of directories, the option
“Deactivate file sharing“ must be set. The corresponding functions are then
no longer available in the file manager but it remains possible to link up
with the directories of other computers.
- If the computer is not intended for the sharing of printers, the option
“Deactivate printer sharing“ must be set.
- If the computer is not intended for network DDE sharing (e.g. telephony
under WfW, data communication via the filing folder), the option
“Deactivate network DDE sharing“ must be set.
The password options must be specified:
- In the case of activated password caching, all WfW network connections
will be stored in a file with associated passwords if this is desired by the
user in the respective connection set-up. Repeated password entries are
then no longer necessary at a later date. The “Deactivate password
caching“ option should always be set, at the very least, if the WfW
computer does not have adequate access protection (e.g. BIOS password).
- “Display passwords in sharing dialogue fields in a readable manner“ may
not be activated as otherwise the password appears on the screen in plain
text when it is entered.
- “Expiration of log-on password“ should be set in the period specified in the
security strategy.
- “Minimum password length“ must be set to at least 6.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000