IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
partition size of 1024 to 2047 MB, each cluster is 32 KB large. This results in
a memory loss of 16 KB for each file.
Another problem (in the case of DOS-based systems) is that the remaining
bytes of the last cluster or block are filled with old data still present in the
main memory. Termed slack bytes, they can consist of unintelligible entries,
information concerning file structure, and even passwords. Depending on the
size of the clusters involved, a file can also be filled with slack bytes when
being copied from one data medium to another.
Before files are forwarded, care must be taken to ensure they do not contain
any slack bytes. This can be checked with a suitable editor (i.e. hex editor). or
with the PRUNE public-domain program. Available from the BIS mailbox,
this program can be used specifically to overwrite slack bytes.
In addition, many Windows applications are problematic in that they do not
continuously overwrite the available memory with program data while a file is
being processed. This can create gaps containing old data of the IT system.
Hidden text / comments
A file can contain text passages with a "hidden" format. Some programs also
offer the possibility of adding comments which often do not show up on
printouts or monitors. Such text passages might contain remarks not intended
for the attention of the recipient. Consequently, this type of additional
information should be deleted from files before they are transferred to external
parties.
Marking of changes
In some cases, it is necessary to mark changes made to files when processing
them. As such markings can be masked out on printouts and monitors, files
should also be checked for these markings before being forwarded.
Version management
Microsoft Word 97 allows several different versions of a document to be
stored in one file. This makes it possible to invoke earlier versions of a
document should the need arise. However, this can also easily lead to very
large files, for example, in the case of documents containing graphic objects.
On no account should the option titled "Save version automatically on
closing" be activated, as this would also store the entire, previous version of a
file each time it is closed.
File attributes
File attributes are stored in the file information module which is meant to
facilitate subsequent searches for the file. Depending on the application
involved, this file information can include the title, directory path, version,
creator (and editor, if applicable), comments, editing time, date of last
printout, document name and document description. Some of this data is
generated by the program itself, and cannot be influenced by the person
editing the file. Other data needs to be entered manually. Before being
transferred to external parties, files should be checked for additional
information of this type.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000