IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
PAP works with simple, unencrypted passwords, thereby offering little in the
way of responsible protocol for confirmations of authenticity. This protocol
will normally only be selected if the external workstation and the server
cannot agree on a form of encryption that offers more security.
Depending upon which level of protection is required, the RAS encryption
protocol should be selected according to the following table, so that at least
the relevant protocol given below is deployed. This can mean that, if the
security demands are high, the use of clients not supporting the required
protocol must be ruled out.
Protection
requirement
Type of encryption RAS encryption protocol
High One-sided CHAP, MD5
Moderate Mutual SPAP
Low Unencrypted Text PAP
Data encryption protects data and ensures a secure dial-up connection. The
RAS administrator can set up the RAS server in such a way that the
transmission of data always takes place in encrypted form. Users connected to
this server automatically encrypt all data sent.
Note: This option requires that all connected clients know how to encrypt
data. In this case as, for example, in a homogeneous Windows NT network,
this option must in any case be activated.
The start options for RAS are set under the control panel option "Services",
and the configuration takes place via the control panel option "Network",
where the choice of authentication procedure also takes place. By choosing the
option "Only Microsoft-encrypted confirmation of authenticity", the choice of
CHAP can be forced by MD5; the encryption for data can additionally be
activated. Under the german version of Windows NT transmitted data is then
not encrypted with DES but with RC4.
RAS supports the security-hosts of other manufacturers, whereby the securityhost
switches between the remote user and the RAS server. A security host is
an additional computer in the network, which offers security services such as
support for chip cards. A security host of this type generally offers an extra
security level by demanding an identity card for confirmation of authenticity,
or by supporting similarly strong authentication procedures, before allowing
access to the RAS Server.
Access supervision via call-back is an additional safeguard offered by RAS.
With this function the system administrator can demand that a certain remote
user dials from a previously determined place (e.g. private telephone line) or
that this user can be dialled from anywhere. With access supervision via callback,
the user initialises a call and makes a connection with the RAS server.
The RAS server then hangs up and momentarily calls the previously-given
call-back number. When using an analogue telephone network call-back
modems must be installed, where during transmission via ISDN or X.25 (e.g.
Datex-P), the features of these networks can be used. However, it must be
borne in mind that the security of the partner identification is no longer
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000