IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
- Automatic call-back
The call-back option of the modem should be used (c.f. S 5.30 Activating
an existing call-back option). If a PC gateway is used, the call-back should
be started from there.
- Limitation of the rights of the remote port (optional)
In the event that the PBX system is to manage the rights for various ports,
this can be used to prevent security-critical actions via remote access and
only to allow this on-site. Many PBX systems do not have this option,
however. In such cases, additional products, e.g. port controllers, can limit
the transactions executed by a particular port.
In order to ensure that only authorised persons within the internal network
can gain access to remote accesses, the following steps must be taken:
- Identification and authentication,
- Challenge response procedures for authentication (optional).
Securing an internal remote access via ISDN networks
For practical reasons, it is recommended to equip the PC's used for network
management tasks with ISDN cards. In this instance, a closed user group
should be created. Here, the number of the calling party can be used (Calling
Line Identification and Presentation CLIP). This could be implemented by the
terminal itself using the number of the calling terminal (CLIP) provided by the
network.
Securing Direct Inward System Access (DISA)
If possible, direct system accesses should be blocked. If this is not possible,
the authorisation should be set in such a way that the direct system access can
only take place via a dedicated port. In this way it is possible to run the DISA
access via a gateway. An example of this is shown in the following
illustration:
Menu diagram: Securing a direct system access
Establishment and accommodation of a network management centre
The advantage of a central network management is, that besides being a
convenient method of system administration, physical access to the PBX is no
longer needed for everyday administration work.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000