IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
S 4.79 Secure access mechanisms for local
administration
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
Some active network components can be administered via local access. Such
local access is generally implemented by means of a serial interface (normally
of type V.24 or EIA-232-E). The following measures must be observed to
ensure secure local access:
- The active network components and their periphery, such as connected
terminals, must be installed securely (refer to S 1.29 Adequate siting of an
IT system).
- Local access for the purpose of administering local components must be
disabled by means of software and / or hardware.
- Any existing default password for local access must be modified
immediately after putting the active network component into operation (for
selection of a new password, refer to S 2.11 Provisions governing the use
of passwords).
- The security features of permanently connected terminals and computers,
such as automatic screen lock and auto logout, must be activated (refer to S
5.11 Blocking the server console and active network components).
A local administration offers the following advantages:
- The danger of intercepting passwords is reduced.
- Administration is still possible after a failure of a network segment
containing the active component, or after a failure of the entire network.
A local administration has the following disadvantages:
- As a rule, active network components can be configured such that they can
be administered either locally or centrally. No general recommendations
can be made concerning the selection of the appropriate configuration
technique. However, it must be noted that if an exclusively local
administration has been configured, central administration of the active
network components is no longer possible. These components must then
always be administered directly on-site. This also increases reaction times
in the event of a failure, as longer distances possibly need to be covered in
order to reach the components.
- Local access by means of a V.24 or EIA-232-E interface is generally
slower than remote access via the network.
Additional controls:
- Have the default passwords for local access been replaced by secure ones?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000