IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
Information in the cache
Internet Explorer, Netscape and other browsers generate large numbers of files
in a cache directory. These files contain the text and pictures from all Web
pages visited since the last time the cache was deleted.
The cache is intended to avoid a multiple loading of pages during a single
session. However, the Internet Explorer does not independently delete these
data, which are of no use in subsequent sessions, so that tens of megabytes of
garbage accumulate in caches which are not deleted regularly. These data can
also be used to generate user profiles.
For this reason, the cache should be deleted regularly, just like the history
folder.
Unfortunately, it is not always easy for users to find out how to empty the
cache. In the case of the Internet Explorer under Windows 95 for example, the
cache is emptied by selecting the option Empty folder under
View/Options/Advanced/Temporary Internet Files/Settings.
When WWW sites secured with SSL are accessed, this can, amongst other
things, be used to transmit sensitive information such as credit card numbers
over the Internet in encrypted form. Such pages should, therefore, not be
stored in the cache in the first place. In the Internet Explorer, for example, this
can be deactivated with "Do not save encrypted pages to disk" under
Tools/Internet Options/Advanced/Security.
Access to client hard disk
With some browsers (e.g. Netscape or Microsoft Internet Explorer) the WWW
servers will be given the opportunity to actively access the hard disk of the
client (ActiveX, Java).
Rather than being executed on the server, Java and ActiveX programmes will
be executed on the client site via the browser. However, this transfers the
security risk from the server to the client. Therefore, various safeguards have
been built into Java and ActiveX to prevent misuse. Many security pitfalls
have nevertheless been discovered so far.
Certain security risks exist when using browsers which allow access to the
files of the client in connection with ActiveX and Java. Under certain
conditions ActiveX allows local resources to be used. Access of this kind is
also possible with Java, but only if the user explicitly allows it. The ActiveX
security concept is based upon the user having confidence in the content
provider and in an authentic third party in the World Wide Web. This
confidence is problematic if the web-pages of unknown or new providers are
called up.
Due to the existing problems with ActiveX, Java and JavaScript, these should,
as a general rule, be deactivated.
If ActiveX, Java and JavaScript absolutely must be used, they should only be
allocated to computers separated from other internal computers in such a way
that security-relevant data cannot be impaired.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000