IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
S 4.76 Secure system version of Windows NT
Initiation responsibility: Head of IT Section, IT Security management
Implementation responsibility: Administrators, Procuring Department
Before the Windows NT operating system is purchased, a decision must be
made as to whether the English or German version is to be used. A general
recommendation cannot be made here. Consequently, this section only
describes the specific advantages and disadvantages of each version.
The English version of Windows NT is used more commonly than the German
version. As a result, tools, service packs and hot fixes can be obtained more
quickly for the English version. In addition, there are tools which can only be
used for the English version of Windows NT. Furthermore, it is possible to
configure the English version of Windows NT in such a way that error
messages appear in German.
However, the same applies to the availability of destructive programs. Such
programs are also developed at a faster rate for the English version, and some
of them are not available for the German version at all.
Windows NT can only be operated reliably if at least version 3.51 or version
4.0 is installed. Installation of the latest service pack is also recommended.
Before it is actually put to use, it should be tested whether the service pack
functions together with all the components in the environment concerned. It
may be necessary to update other hardware and software components in
addition to installing the service pack. At the time off issue of this document
for Windows NT Version 3.51 service pack 5 is available and for Windows
NT Version 4.0 service pack 6a. The system version installed and, if
appropriate, the service pack installed are displayed when the system is
started. Furthermore, Microsoft offers "hot fixes" as updates for the latest
service pack versions. The current hot fixes should also be installed if they
influence the functionality of the system in use. Hot fixes are created at short
notice when problems occur. This also means that they are not tested as
thoroughly as the service packs. Therefore, only hot fixes that are really
needed should be installed on a system. The system administrator must
regularly check which service packs and hot fixes are currently available for
the system being operated.
A one-time installation of a service pack or hot fix is not sufficient for
ensuring system integrity. Every change to the system configuration requiring
access to the installation CD-ROM, or the addition of new device drivers,
requires a new installation of the current service pack and the necessary hot
fixes. If this is not done, there is a danger of system files originating from the
respective service pack or hot fix being replaced by older versions. In the
worst case, this could prevent the Windows NT system from being started up
again.
After a service pack or hot fix has been installed, the start-up disks should be
updated (refer to S 6.42 Creating start-up disks for Windows NT).
Furthermore, the security configuration of the computer in question should be
checked.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000