IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
the user to define a new rule. However, as it is often difficult for the user to
distinguish between permitted and unauthorised accesses, the ruleset
should be pre-installed by an Administrator.
- RAS clients too should be included in the system management as far as is
possible. Firstly this permits monitoring of the clients within the
framework of maintaining ongoing operations. And secondly it enables
software updates (e.g. virus databases, applications programs) to be
imported over a controlled route. Remote computers, however, place
higher requirements on system management as they are not permanently
linked to the network, so that the computers must regularly be examined
for (non-permitted) configuration changes. Here, depending on the
management product, the "Discovery" function can be used to ascertain the
current status of the computer. It should be noted that capturing this
information places a load on the RAS client and the data has to be
transmitted over the RAS connection. If the RAS connection has a low
bandwidth, as is the case for example on a mobile phone, this can result in
response times which are unacceptable to users.
- If TCP/IP is used as the protocol, consideration should be given to the
possibility of using fixed IP addresses for RAS clients rather than assigning
addresses dynamically. This procedure does carry high administrative
penalties (e.g. the necessity to maintain the assignment tables), but it does
allow unique network addresses to be assigned to individual computers.
The disadvantage of dynamic assignment of network addresses is that a
record must be made of which RAS client was given a certain network
address when. Otherwise it is generally not possible to establish which
RAS client executed a particular action.
The communications link between RAS client and RAS server is generally
established over third-party networks. The network components used here are
generally not under the control of the operator of the LAN with which the
connection is to be established. It must also be assumed that the data will not
only be transmitted over the telecommunications network of a provider but
that the networks will also be used by partners of the telecommunications
provider. This applies especially where a LAN is accessed from abroad. To
satisfy the protection requirements of the data thus transmitted, security
measures must be taken which, for example, assure the confidentiality of data.
The following therefore applies to data transmission:
- It is imperative for secure operations that all data transmitted is encrypted.
- Signature mechanisms should be employed to safeguard the authenticity
and integrity of the data.
A number of security mechanisms can be used for RAS connections in order
to satisfy these data protection requirements. These include the following:
- The communication can be encrypted at a low protocol level (so-called
tunnelling - see S 5.76 Use of suitable tunnel protocols for RAS
communication). This requires selection of a suitable procedure.
Conventional RAS systems offer such methods as standard, though in
different number and form.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Include RAS clients in
system management
Unique assignment of IP
address and computer
Tunnelling