IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
Breaches in the security of WWW browsers
Considerable security breaches have already been found in most browsers. For
example in February and March 1997 many weaknesses in the security of
different versions of the Microsoft Internet Explorer were discovered.
These mistakes can all be put down to Microsoft attempting to connect WWW
with local Windows components, thereby granting WWW-sites as much
confidence as local data. With the appropriate software it became possible to
execute harmful programmes on the local computer of the WWW-user simply
by calling up low-key WWW-sites without the user realising.
Encryption
Since all data is transmitted across the Internet in plain-text, sensitive data
should be encrypted before transmission. It is sensible, as long asthe
appropriate mechanisms are already provided in the sub-areas of the protocol.
For safe transmission of data across the Internet it must be considered whether
more recent protocols such as IPv6, S-HTTP or SSL can be used.
More recent browsers support the use of diverse security protocols. At least
SSL should be supported.
Using available security functions
In every case, the available security functions of the browser should be used
(confirmation before execution of programmes, access to restricted file
systems only, no possibility to change local data).
When surfing in the Internet, automatic execution of programmes should be
prevented (e.g. via the Disable Java option) and only reactivated for
trustworthy servers.
News-Reader and Mail-Clients frequently offer the possibility of reading any
type of data in MIME format. Commands can also be contained in this data
which lead to automatic execution of programmes on the local computer. The
appropriate possibilities should therefore be removed from the configuration
files or confirmation should be required before programmes can be executed.
Gathering information about security breaches
Since new gaps in security are constantly discovered in WWW browsers,
information should regularly be gathered regarding these gaps and how to
eliminate them. Procuring the most up-to-date version of the product should
not be a priority as new programme additions can mean new security
problems. By installing patches it is at least ensured that acknowledged
security breaches are eliminated.
Regulations
The user is responsible for the majority of the safeguards listed above, since
their implementation as, for example the activation of certain options, cannot
be consistently checked by administration. Every user should therefore be
required, via the appropriate instructions, to observe the listed security
guidelines before using Internet services. It is advisable to commit users to
compliance with an operating pattern before allowing them to access Internet
services. A training course should be held to impart the contents of the
Internet security guidelines and the operating pattern to users.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000