IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
- To ensure that communications are protected (using MPPE encryption), in
the "Security" tab of Dial-Up Networking, the options "Accept only
Microsoft encrypted authentication" and "Require data encryption" should
be enabled. Care must be taken to ensure that the RAS server is
correspondingly configured.
- Assignment of a fixed IP address to each RAS client should be considered.
This makes it easier to trace activities performed over the RAS connection.
The IP address can be entered in the TCP/IP properties of Dial-Up
Networking under Phonebook, Server, TCP/IP Settings in the field
"Specify an IP address".
The following applies to RAS servers running under Windows NT:
- RAS dial-in should only be permitted for authorised users. For all other
users, the option "Grant dialin permission to user" must be disabled. This
can be performed either through the User Manager or the RAS Manager.
- The option of callback by the RAS server should only be enabled for those
users for whom this is explicitly allowed. If possible, a fixed callback
number should be used.
- In order that RAS clients can request a fixed IP address, the option "Allow
remote clients to request a predetermined IP address" under Control panel,
Network, Services, Remote Access Service, Attached Device, Network,
TCP/IP settings must be enabled.
- If use is to be made of MPPE encryption, then the relevant option must be
enabled. This is achieved by selecting the following sequence of menu
options: Control Panel, Network, Services, Remote Access Service,
Attached Device, Network, Encryption settings.
- It is possible to specify for a RAS server under Windows NT whether RAS
clients should only access the resources of the RAS server or whether they
should be able to access the network to which the RAS server is connected
as well. Depending on the intended purpose (e.g. export of local resources,
RAS access server for a network), the appropriate access restrictions
should be set. This is performed by selecting the option "Allow remote
TCP/IP clients to access" under Control Panel, Network, Services, Remote
Access Server, Attached Device, Network, TCP/IP settings.
Additional controls:
- Are all security breaches identified documented?
- Is user authentication performed for every connection established using the
specified mechanism?
- Is protection of communications enforced for every connection through
one of the procedures permitted in the RAS security concept?
- Can mobile RAS clients be protected through additional safeguards (e.g.
encryption of hard disks)?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000