IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
- System: Here the following restrictions can be laid down:
- Deactivate programs for editing the registry
- Only execute approved applications for Windows
For normal users, access to the registry should not be possible, as changes
to the registry can cause serious problems.
Most users only have to discharge certain tasks with the IT system and
accordingly only require certain applications. For this reason their access
should also be restricted to these applications, such as, for example, a word
processing program.
- Windows NT Shell: Here the following restrictions can be laid down:
- Use only permitted Shell extensions
- Remove general program groups from the "Start" menu
Under Windows NT, very sophisticated user profiles can be created. These
should be drawn up in accordance with the security policy of the authority or
the company. This can be time-consuming, as for different user groups user
profiles tailored to each of the groups should also be created. All user profiles
must be tested beforehand to determine whether they neither leave open
loopholes nor obstruct users in carrying out their tasks. Consideration should
also be given to the fact that restrictions which are too far-reaching can not
only lead to user dissatisfaction even to the point of the complete rejection of
the system, but can also cause the administrators a great deal of work, if the
latter continually have to implement users’ wishes such as, for example,
setting another type size.
The Windows NT environment is determined by the values of the current user
profile, even if the current user has neither a prescribed nor a personal profile
or even if no-one is currently logged in. The User Default Profile is loaded
under the following conditions:
- if the current user does not have his own (prescribed or personal) profile
and has not yet logged in to the current computer;
- if a user logs in to the guest account.
In the first case, the current values of the user environment are stored in a
newly-created local personal profile, in the second case they are lost when
logging off.
If no-one is logged in, the current values for the screen background and other
environment variables are determined by the System Default Profile.
Additional controls:
- Is the guest account, provided it is not locked out, restricted by a profile to
the minimum functionality required?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000