IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
Normally this should entail the use of predefined acceptance configurations
and simulated operational scenarios. During testing care must be taken to
ensure that only the persons authorised to participate in testing can access
the RAS system.
Upon completion of installation of a RAS system, the system should have a
secure starting configuration which initially allows access only to the
authorised administrators (see also S 4.111 Secure configuration of the RAS
system). These persons should then convert the RAS system to a secure
operating state. Once this is achieved, continuous operations can then
commence.
Example
Under Windows NT the installation of RAS servers and clients is very simple
and is virtually identical as the Windows NT Remote Access Service contains
both client and server functions.
The following applies to a RAS client running under Windows NT:
- The server functions of the Remote Access Service must be disabled. This
is done by allowing only outgoing calls on all devices which can be used
for remote access (e.g. modem, ISDN card, VPN adapter). The relevant
dialogue boxes are reached by selecting the following sequence of options:
Control Panel, Network, Services, Remote Access Service, Attached
Device, Configure.
- For the RAS client only the protocols that are permitted for remote access
should be enabled. This is done by selecting Control Panel, Network,
Services, Remote Access Service, Attached Device, Network.
- The characteristics of a RAS connection are specified in Windows NT
through Dial-Up Networking. Here the parameters required under the RAS
security concept should be set (e.g. "Require data encryption").
The following applies to a RAS server running under Windows NT:
- The client functions of the Remote Access Service must be disabled. This
is done by allowing only incoming calls on all the devices which can be
used for remote access.
- For the RAS server only the protocols that are permitted for remote access
should be enabled.
- The parameters required under the RAS security concept must be set for
incoming RAS connections. This is done by selecting Control Panel,
Network, Services, Remote Access Service, Attached Device, Network.
- Only authorised users should be allowed to dial in. This can be specified
under Windows NT through either RAS Manager or User Manager.
Additional controls:
- Have all deviations from the planning premises for the RAS system been
noted in the planning documentation?
- Have the security mechanisms been function tested (e.g. has encryption of
communications been tested using a network analyser)?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000