IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
As soon as the installation of a minimal operating system is complete,
various programs which could be helpful to a potential attacker should be
deleted. In particular, any compilers which may be present should be
removed, because these could be a valuable tool for an attacker. Besides,
another reason why it is not advisable to have compilers on Internet servers
is that these computers are production machines, and program development
and tests should be carried out on other computers. It is also conceivable to
delete all editors, which would make it very much more difficult for an
attacker to manipulate configuration files. If the editors are deleted, though,
administration is also more complicated. If changes need to be made to
configuration files, an editor has to be installed on a case-by-case basis, or
alternatively, and this is recommended, the configuration files have to be
edited on a different computer and then transferred.
A minimal operating system should of course not be an end in itself. It goes
without saying that, for an Internet server, the server service itself still has to
be installed. It depends on the particular installation whether this is done at the
end of the above list or between points 6 and 7, for example, or even
immediately after point 1. It becomes problematical if the installation fails
because of the absence of operating system packages, because in that case the
missing packages have to be located and reinstalled manually. It would be
better if the vendor of the server service specified the operating system
dependencies, so that the minimal system could be brought into line with these
from the outset.
Even a computer configured with a minimal system is not entirely protected
against attacks. The most probable cause of a successful attack is no doubt the
server service, but also the minimal system itself is still open to attack, in
particular the TCP/IP stack, which has to forward the network packets to the
application. Almost all attacks against the TCP/IP stack that have so far come
to light, however, have only affected availability, with the computers
concerned being caused to crash; this means that infiltration of computers has
not yet been observed. In order to reduce even this risk yet further, S 4.98
Restricting communication to a minimum with packet filters should also be
implemented.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000