IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
internal remote maintenance
service interface
interconnected PBX system
Diagram: Modem
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
from the public network
external remote maintenance
service phone
Structure of a remote maintenance unit
In this case, the following measures can be taken to protect against accesses
from external networks:
- No direct-access extension for the modem connection
The modem connection through which the administration port of the
installation is accessed should in any case not be a direct-access
extension! This minimum requirement should be checked first. Thereby
itcan be preventedfor the modem to be called directly from outside.
- Confidentiality of the call number of the service port (modem)
In order to discourage misuse from the very start, the call number of the
service phone should not be listed in telephone directories. It should be
known exclusively to the persons having a direct need for it.
- Use of dedicated lines (optional)
The use of dedicated lines for the remote connections which do not run via
switching equipment is one of the most secure methods of preventing
external access to the remote accesses. As this system is generally very
expensive, it can only be used in exceptional cases.
In order to ensure that only authorised bodies within the internal network can
gain access to remote accesses, the following steps must be taken:
- Creation of Closed User Groups (CUG)
CUG's which operate on a supra-system basis can be set up in some PBX
systems. These closed user groups represent a type of network within a
network. All required remote accesses should thus be combined with the
various authorised bodies in such CUG's.
extra PC
as a gateway