IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
it is not possible to give away files and directories. Irrespective of the entries
in the access control list, administrators can assume ownership of any file or
directory.
Note:
As far as possible, users should never allocate the permission “Full
access“, but at most the permission “Change“, so that ownership cannot be
withdrawn from them and they always retain sovereignty over rights
allocation.
The attention of all users must be drawn to the fact that they should check
regularly with File Manager or Explorer whether they are still owners of
their directories and files. This is the only way in which users can tell
whether access rights set by them have been by-passed.
The safeguards mentioned in the following sections apply mainly to files and
directories for which the administrator is responsible, i.e. to those which are
either important for all users or useful for administration purposes. It is not
sufficient to check the rights of one program. The rights allocation of all
programs which are called up from this program must also be checked (in
particular to avoid Trojan horses).
The attributes of all system files should, as far as possible, be set in such a
way that only the system administrator has access to them. Directories should
provide no more than the required privileges for users.
Directories of the operating system and the application programs
The files and directories of the operating system itself must be adequately
protected against illicit accesses. Immediately following installation of the
system, the standard access rights specified should be adjusted to more
restrictive forms of access control for the relevant files and directories (the
Windows directory, %SystemRoot%, e.g. \WINNT, the Windows system
directory %SystemRoot%\SYSTEM32 and any further program directories, e.g.
\MsOffice and \Programs, and all sub-directories).
At this point, however, it should be noted that quite a number of programs,
particularly 16-bit programs but also MS Winword 7.0, create initialisation
and configuration files in the Windows directory and/or in the program
directory. If such programs are to be used it can become necessary to give
users the access right "Change" for the relevant directories and files.
Only administrators should have write access to these directories. All other
users should only have read and execute permissions (RX).
User (group) Access right
SYSTEM Full access
Administrators Full access
Users Read
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000