IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
- On top of the RAS system configuration, dividing the network into subnets
can also be useful for access control. For reasons of IT security it can
therefore be appropriate to set up access networks (see also S 5.77
Creation of subnets).
- The routing settings of the network switching elements within the RAS
system should be used to restrict the flow of network traffic. Network
packets should only be forwarded on permitted connections. In addition,
the latest network switching elements allow selective forwarding of
packets within permitted network connections (packet filter function). In
this way it is possible, for example, to ensure that only connection requests
are forwarded to the HTTP service of a server.
- Restricting access to RAS clients is especially difficult to implement with
mobile computers. With mobile RAS clients it is therefore especially
important that users adhere strictly to the defined rules (e.g. to protect
against theft; see also module 5.3 Laptop PCs).
- The secure configuration of the RAS server software requires that the
security settings which are offered by the software and are appropriate in
the existing operational scenario are also enabled and can be used. The use
of certain security settings may presuppose that other components of the
RAS system also possess corresponding functions and/or can be
correspondingly configured. Thus, for example, when the Calling Line
Identification Protocol (CLIP) is used, it is important to ensure that this is
also enabled for the selected connection. For example, user identification
on access over the Internet using X.509 certificates requires that the storage
location of the user certificates is known to the RAS system. So the RAS
software must either support external authentication servers or else offer a
certificate management module of its own.
It is therefore necessary to check in advance whether all the security
mechanisms offered can also be used or whether different and/or additional
hardware or software is necessary for this. Once the RAS system is up and
running, regular checks must then be made in order to verify that the
settings are correct.
- The requirements which apply to the secure configuration of the RAS
client software are similar to those which apply to the server software. In
addition, care must be taken to ensure that passwords required for RAS
access are not stored within the software, even though this option is
frequently offered. If this cannot be technically prevented, all users must be
forbidden from making use of the option. Moreover, all users must be
informed of the problem.
- In order that clients and server can communicate in a secure manner, care
must be taken to ensure that the components involved are configured in a
consistent manner (e.g. as regards the method used to protect
communications).
- The secure and consistent configuration of client and server can be
supported by specifying a standard configuration for RAS clients
(hardware and software) in the RAS concept and implementing it through
appropriate organisational measures. The result of doing this is that only a
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Setting up access
networks
Routing settings
Use of existing security
mechanisms
Client configuration
Setting up standard IT
systems