IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
phone is switched on. For example, this PIN can be used to prevent the mobile
phone being used with a different SIM card (anti-theft protection).
Access to mailbox
The network provider can set up a mailbox for every subscriber which
amongst other functions serves as an answerphone. As the mailbox can be
interrogated from anywhere and also from any terminal device, it must be
protected against unauthorised access with a PIN. When the mailbox is first
set up, the network provider issues a predefined PIN. It is important that this is
changed immediately.
Other passwords
As well as the various personal identification numbers listed above, there may
be additional passwords for various types of use. For example, a password will
be required to access the user data held by the network provider. Thus, a
password may be required when the user rings the hotline to query a bill.
Services which incur additional charges, such as retrieval of information or
getting the network provider to perform certain configurations are generally
protected through additional passwords. Like all other passwords, these should
be chosen carefully and kept securely.
As a general rule, all PINs and passwords should be handled with care (see
also S 2.11 Provisions governing the use of passwords).
Note: There have been a number of cases recently in which criminals have
attempted to obtain the PIN or PUK of mobile phone users over the phone
by posing as staff of a network provider and pretending that there is a
technical defect. Information on personal identification numbers should
never be given out over the telephone.
There are many different security mechanisms available with mobile phones.
Which of these are available and how they can be activated depends on the
particular mobile phone used, the SIM card and the selected network provider.
Therefore the network provider's operating instructions and security
instructions should be evaluated carefully. Where company phones are used, it
is recommended that the most important security mechanisms are
preconfigured and also documented in a well laid out leaflet.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000