IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
- SSL can also be used for encryption if it is not possible for particular
reasons to use encryption at a low protocol level. This applies especially to
access on Web servers or e-mail servers via Web browsers, which support
SSL-protected communication as standard. In this connection see also
S 5.66 Use of SSL.
- As well as software protection of communications, the use of network
switching elements such as routers and modems which encrypt data should
also be considered. These are especially advisable for stationary use and
where several computers are to be connected, as the encryption process is
transparent and no extra load is placed on clients and server. However, it
should be noted that the devices must be carefully configured and
maintained.
- Where e-mails are to be exchanged over insecure channels it may be
appropriate to use e-mail encryption (see also S 4.34 Using encryption,
checksums or digital signatures).
Security with remote access over a RAS connection can only be assured if all
the components of the RAS system are correctly and consistently configured.
However, it should be noted that, depending on the access procedure, a large
proportion of the components used are not under the direct control of the local
RAS administration. Therefore RAS access to a LAN must be monitored
especially carefully and thoroughly.
Example
As Windows NT comes with RAS support as standard, the Remote Access
Service of Windows NT will be used as an example. The functionality offered
and the available security mechanisms are, however, generally only suitable
for a small number of RAS users and for data which has a low protection
requirement. Where there are large numbers of users and the protection
requirement is high, additional RAS products should be considered as well.
The following applies to RAS clients running under Windows NT:
- For RAS clients, the option of saving user names and passwords so as to
allow automatic connections should be disabled. This requires that the
"Save password" option in the Dial-Up Networking dialogue is disabled. If
the password has been saved by mistake, it can be deleted again by clicking
the "Unsave password" pushbutton on the "Security" tab of the properties
dialogue.
- Automatic establishment of a dial-up connection should only occur after
confirmation by the user. This is ensured by selecting the "Always prompt
before auto-dialing" option on the "Settings" tab of "User preferences" in
Dial-Up Networking. However, it is best that auto-dialling should be
completely disabled. This is ensured by disabling the option "Enable autodial
by location" for all locations on the "Dialing" tab of "User
preferences" in Dial-Up Networking.
- Care should be taken to ensure that no incoming connections are allowed.
For the "Port Usage" setting under Control Panel, Network, Services,
Remote Access Service, Attached Device, Configure the option "Dial out
only" should be enabled.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
SSL encryption
Encryption through
network switching
elements
E-mail encryption