IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
NTFS permissions initially become effective during local access. For
example, if several users need to work on a computer, file and directory access
rights can be granted appropriately to ensure that each user only has access to
the data intended for him/her.
NTFS permissions also become effective during access via the network.
However, a prerequisite for access via a network is that the directory which
needs to be accessed or which contains the required subdirectory or file must
be shared and assigned a corresponding share permission beforehand (refer to
S 2.94 Sharing of directories under Windows NT). During the interplay
between share permissions and NTFS permissions, it must be noted that the
more restrictive permission is conclusive in each case. NTFS permissions can
be graded more finely than share permissions. In particular, it is possible to
assign separate NTFS permissions for each subdirectory and file.
Consequently, it is also possible to assign shares with the "full access" share
permission for the user groups and domain users, and allocate the effective
access rights via the NTFS permissions.
NTFS permissions are classified as specific (or individual) permissions or
predefined, standard permissions which constitute combinations of the
specific access permissions.
The following individual permissions are possible:
R Read
W Write
X Execute
D Delete
P Change permissions
O Transfer ownership
From these individual permissions, default standard permissions have been
combined under Windows NT.
Standard permission Individual permissions
No access –
Read RX
Change RWXD
List RX
Add WX
Add and read RWX
Full access RWXDPO
Every owner of a file or directory has the right to grant and withdraw
permissions for that file or directory. Every user who creates a file or directory
automatically assumes ownership of this resource. Ownership of a file or
directory can be transferred by means of the "Transfer ownership" option (O)
to other users. However, this ownership only becomes effective once it has
actually been obtained by the recipient. In contrast to other operating systems,
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000