IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
- The relevant powers must be laid down as part of the security policy. In the
field of management, too, there is a division of roles between
administrators and auditors – and depending on the product also between
administrators with different rights (such as workgroup administrators or
divisional administrators). It is advisable to define certain roles and to set
up users with the appropriate authorisations in accordance with these
different roles. In that way the user accessing the system is granted only
those rights to components or data in the management system that are
necessary for the task in hand. Depending on the management system,
users are set up either in the management system or in the user
administration system for the computers. As the existing systems do not
include direct provision for the definition of different roles (such as
administrator and auditor), the roles must be emulated as closely as
possible by creating various user accounts (e.g. "Administrator", "Auditor",
"Computer Admin", "Data Privacy Officer") with the corresponding rights.
Depending on the system, these roles can only be emulated incompletely
and at some expense, because it may be necessary to assign and maintain
the rights for individual roles explicitly for each system component (files,
programs).
- Access to the management software must be protected by secure
passwords. The passwords should be changed at regular intervals, in
accordance with the security policy.
- Functions offered by the management software which according to the
management strategy should not be used should (if possible) be disabled.
- The logging files must be checked for anomalies at regular intervals (such
as the execution of functions that are not supposed to be used). It is
recommended to use log analysers for this, which may either be integrated
into the management product or be available as add-on software, and which
can generate alarm messages (such as by e-mail or pager) as the need
arises, usually under rule control.
- Integrity tests must be run on the management system at certain intervals
so that unauthorised changes can be detected as early as possible. This
applies in particular to all configuration data in the management system.
- If the system management system is also used to distribute software, the
program data that is to be distributed must also be checked regularly for
changes in order to prevent the distribution of modified software across the
entire network.
- The response of the management system in the event of a system crash
should be tested. Automatic restarting of the management system or of
local subcomponents of the system must be ensured, depending on the
management and security policies. This prevents computers that are
connected to the management system from being inaccessible to
management for lengthy periods (see also S 6.57 Creation of an emergency
plan for the failure of the management system).
- In the event of a system crash, the management databases must not be
destroyed or enter an inconsistent state. This prevents a potential attacker
from exploiting provoked inconsistencies for an attack. To ensure this, the
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000