IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.25 Using transmission and reception logs
Initiation responsibility: IT Security Management
Implementation responsibility: IT Security Management, Fax Officer, Fax
Office
When fax services are used, a distinction must be made as regards the use of
transmission and reception logs between conventional fax machines and fax
servers.
Use of a conventional fax machine
Lists of completed transmissions (journals) which are compiled automatically
by the fax machine must be printed out regularly. Who is responsible for these
printouts, how long they are kept for, and in what form sample checks for
irregularities are made on them must all be specified. The requirements of the
Federal Data Privacy Protection Act must be observed here. In particular,
access by unauthorised persons must be prevented.
A fax journal listing the senders and recipients of fax messages should also be
kept. Optionally, a log of incoming faxes can be kept as well.
Another means of checking is available where the fax machine is connected to
a modern private branch exchange, in which case it is possible, for example, to
evaluate the call charge data records for the fax subscriber number in the PBX
(cf. S 2.40 Timely involvement of the staff council / works council).
Use of a fax server
It is also possible to log transmissions on fax servers. These logs should be
evaluated and archived regularly. It is especially necessary to define the basic
requirements and responsibilities for processing, interpreting and archiving of
the logs.
Thus, for example, one option is that the fax mail centre is responsible for
these activities but that the logs can only be evaluated in the presence of a
member of the works council or staff council or a member of the audit or data
privacy team. Once again, the requirements of the Federal Data Privacy
Protection Act must be observed and access by unauthorised parties must be
prevented.
When fax servers are used, it is inappropriate to keep manual fax journals.
Instead, it should be sufficient to archive the transmission and reception logs
in their entirety.
It may sometimes also be possible to use the data records of charges incurred
for outgoing fax transmissions from the fax server to pass on these costs based
on usage.
Additional controls:
- What procedures apply to the checking of transmission and reception logs?
- Where are the logs archived and who can access them?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Check transmission and
reception logs regularly
Maintaining a fax journal
Evaluate log files
regularly