IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.45 Security of WWW browsers
Initiation responsibility: IT manager, network planner
Implementation responsibility: Administrator, IT users
When accessing the World Wide Web (WWW) various security problems can
arise on the computers at the workstation. This can be due to faulty operation
on the part of the user, insufficient browser configuration (i.e. the program
being used to access the WWW), or weaknesses in the security of the browser.
Local data can be under threat if, for example, programs are downloaded from
the Internet and executed without confirmation on the local computer (e.g.
ActiveX programs or Java-applets). Documents or pictures may also contain
commands which will automatically be executed when viewed and can thus
lead to damage (e.g. macro viruses in Winword or Excel documents). To
avoid such problems, the safeguards described in the following should be
implemented.
Downloading files and/or programmes
When files and/or programmes are downloaded, a considerable number of
security problems can arise, the most well-known amongst these being
viruses, macro-viruses and Trojan horses. Users should never rely on the fact
that the downloaded files or programmes come from trustworthy sources.
When the browser is configured, it must be ensured that the applications
associated with files which may contain macro viruses are not started
automatically (see also S 4.44 Checking incoming files for macro viruses).
Every user must be reminded that he himself is responsible for taking the
relevant precautions when downloading files. Even if the downloaded data is
automatically tested for viruses by a firewall, the responsibility for the
cleanliness of the files or programmes is still with the user. In principle, the
internal security regulations of the organisation must naturally be observed
during the installation of programs. In particular, only tested and approved
programmes may be installed. Before installation, stand-alone computers
should act as a testbed for the cleanliness of their programs.
In case of doubt contact IT administration.
Plug-ins and additional programs
Not all browsers can process all file formats directly. This generally means the
files cannot be displayed, and in some cases they cannot be played back. For
some file formats, plug-ins or additional programs are also needed.
Plug-ins are library files (e.g. DLL files) which are downloaded by installation
programs into the plug-in directory and are executed with the invocation of the
corresponding file format.
Additional programs, such as viewers, are independent programs which are
able to process certain file formats. The invocation of such an additional
program is controlled using one of the browser's configuration files, in which
the file extension and program are linked.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000