IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
time intervals at which subsequent attempts at authentication are
allowed become progressively longer.
- Certain minimum values can be specified for security-related
parameters. For example, passwords should have a minimum length
of six characters.
- After the mouse or keyboard has remained inactive for a certain
period of time, a screen saver is activated automatically. This screen
saver can only be deactivated following renewed identification and
authentication.
- Telecommuting workstations must have an access control mechanism.
The following conditions must be met, in particular:
- Telecommuting workstations can distinguish between different types
of users. It is possible to configure at least two separate roles on a
telecommuting workstation, namely, administrator and user.
- Access to files and programs can be regulated using differentiated
allocation of rights (read, write, execute, ...).
- If a telecommuting computer is to be equipped with a logging mechanism,
the following features might be advisable:
- It should be possible to parametrise the minimum logging scope of
the telecommuting computer. For example, the following actions and
errors should be included in logs:
- For authentication: User ID, date and time, success, ...
- For access control: user ID, data and time, success, type of
access, what was changed, read, written, ...
- Implementation of administrative activities
- Occurrence of operational errors.
- Unauthorised persons must neither be able to deactivate the logging
function, nor should they be able to read or edit the actual logs.
- Logs must be clear, complete and correct.
- If a telecommuting computer is to be equipped with a log evaluation
function, the following features might be advisable:
- An evaluation function must be able to distinguish between the
various data types contained in a log (e.g. "filtration of all
unauthorised attempts at accessing any resource over a specified
time period").
The evaluation function must be capable of generating transparent,
readable reports so that no critical security-related activities can be
overlooked.
- Telecommuting computers should be equipped with data backup
functions. At least the following requirements must be met by these
functions:
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000