IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
- User authentication must be performed via the chosen mechanism every
time that a connection is established. In particular use of the CLIP
mechanism (transmission of call numbers) on its own is not sufficient to
ensure reliable authentication.
- Protection of communications using one of the methods permitted in the
RAS security concept must be enforced for every connection in order to
ensure that the transmitted data is protected.
- The additional security mechanisms (use of call number transmission,
callback to a preconfigured phone number for non-mobile RAS clients or
for RAS clients connected over a mobile phone) provided by the access
technology should be used.
- The RAS system should be audited at regular intervals. The roles of
Administrator and Internal Auditor must not be assigned to the same
person.
- A mobile IT system can be connected to a LAN over GSM (see also ###
S 5.x5 Secure transmission over mobile phone). When RAS is used over a
mobile phone network, it should be noted that the CLIP mechanism
(transmission of call numbers) is generally only suitable as an additional
authentication feature as the mobile phone identified over the call number
can easily fall into unauthorised hands.
As RAS clients are generally operated in environments that are not under full
control, special mechanisms, procedures and safeguards must be employed to
ensure protection of the client. In particular, mobile RAS clients are exposed
to a special danger here in that their physical design makes them especially
easy to attack (e.g. theft, vandalism). Once a RAS client is compromised,
there is a danger that the security of the LAN could also be impaired as a
result.
For the secure operation of RAS clients, the following aspects must therefore
be considered:
- The basic security of the IT system must be assured (see also modules 5.3
Laptop PCs, 7.2 Modems, 8.6 Mobile phones and 9.3 Telecommuting).
- As mobile RAS clients are exposed to greater risks than stationary clients,
they need to be protected through additional safeguards. One such
safeguard is to encrypt the hard disk in order to ensure that in the event of
the device going missing it is not possible for any data to be read or for
unauthorised RAS connections to be established.
- Especially where RAS clients are linked using Internet connections, it is
essential to have anti-virus software installed on them (see also module 3.6
Computer virus protection concept).
- Consideration should be given to installing PC firewalls on the RAS clients
so that they are protected against unauthorised access from the Internet by
third parties. Like conventional firewalls (see module 7.3 Firewalls), PC
firewalls filter the packets of network communication protocols. However,
the filtering rules can generally be dynamically generated by the user. For
every access for which no rule currently exists, a selection of possible
responses is offered (e.g. allow, reject, conditional processing), enabling
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Auditing
Connection over mobile
phone
Encryption of hard disks
Up-to-date anti-virus
program
PC firewalls