IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
Where necessary, access to executable files (.EXE, .COM and .BAT) can be
restricted still further, so that only executable (X) access to these files is
possible. In a similar manner, the files which are of critical importance in
starting the system, namely \BOOT.INI, \NTDETECT.COM, \NTLDR,
\AUTOEXEC.BAT and \CONFIG.SYS, must be protected against
unauthorised amendment by non-privileged users.
However, checks should also be carried out - preferably in a test environment
- to determine whether all application programs are still able to run with this
restrictive setting, or whether individual access controls still have to be
supplemented by further access capabilities, in order to permit, for example,
the storage of temporary files or configuration information in a program
directory. Generally, however, access to the program files themselves (.EXEfiles)
and to dynamic libraries (.DLL-files) for the group "Everyone" should
be restricted to read access, especially as this safeguard also offers a certain
protection against the spread of viruses.
Temporary files
Temporary files, which are used by various application programs for the
relocation and intermediate storage of data, are filed under Windows NT in
the directory %TEMP% (usually C:\TEMP). All users also need the right to
store files in this directory, but, at the same time, users must be prevented
from gaining access to temporary files of other users. The access rights for the
directory should therefore be changed to the following value:
Registration
User (group) Access right
SYSTEM Full access
Administrators Full access
Creator/Owner Change
Users Add
The registry of Windows NT is located in the sub-directory CONFIG of the
Windows system directory %SystemRoot%\SYSTEM32, i. e. in general in the
directory C:\WINNT\SYSTEM32\CONFIG. The user must have access to this
directory, as the registry is automatically changed by settings of the user in
application programs. If the user cannot access this directory, it leads to
system errors or to the crashing of the system. Under version 3.51, the
standard rights set for this directory, which, as far as possible, should not be
amended, are:
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000