IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
ensured when changing the X.25 carrier, i.e. with data transmission crossing
country borders.
Under RAS the system administrator controls remote access to the network.
Further to the service programmes that are delivered with the Windows NT
server package, the service programme RAS-Administration offers the
administrator the possibility to remove or provide access permissions for
single users and/or groups. This means that access to the network must be
explicitly provided for every user accessing the network via RAS, although
RAS is running on a Windows NT server computer. This process ensures not
only that remote access must be explicitly permitted, but also allows call-back
restrictions to be defined.
RAS offers an additional security level. RAS-Administration offers an option
which allows access to all resources that the RAS host detects, or to the
available resources on the local computer. The administrator can thus control
which data is available to a remote user. If possible, permission for access to
further computers in the network should either be provided restrictively or not
at all, in order to limit possible damage when security barriers have been
broken.
Note: If RAS is used in a domain, changes to RAS permission will not
immediately take effect on all servers. It can take up to 15 minutes for a
change to be replicated on all servers in the domain. If required, the domains
can be explicitly synchronised anew, to ensure that a user whose permissions
have been removed, no longer has access to the network until the change has
been replicated.
Additional controls:
- Are the functions of encrypted authentication and call-back security used
for all external accesses?
- Is access activated only for the RAS server, but not for the rest of the
network?
- Is the list of authorised users for RAS access regularly checked and
brought up-to-date?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000