IT Baseline Protection Manual - The Information Warfare Site

Networked Systems IT-Security Management
_________________________________________________________________________________________
Threat Scenario
Organisational shortcomings:
- T 2.21 Inadequate organisation of the exchange of users
- T 2.22 Lack of evaluation of auditing data
Human Failure:
- T 3.17 Incorrect change of PC users
Deliberate Acts:
- T 5.18 Systematic trying-out of passwords
- T 5.19 Abuse of user rights
- T 5.20 Misuse of administrator rights
- T 5.21 Trojan Horses
Recommended Countermeasures (S)
Organisation:
- S 2.5 (2) Division of responsibilities and separation of functions
- S 2.7 (2) Granting of (system/network) access rights
- S 2.8 (2) Granting of (application/data) access permissions
- S 2.63 (1) Establishing Access Rights
- S 2.64 (2) Checking the log files
- S 2.65 (1) Checking the efficiency of User separation on an IT System
Personnel:
- S 3.10 (1) Selection of a trustworthy administrator and his substitute
- S 3.11 (1) Training of maintenance and administration staff
- S 3.18 (1) Log-out obligation for PC users
Hardware & Software:
- S 4.7 (1) Change of preset passwords
If the operating system underlying the IT system does not allow a division between users, the
following safeguard should also be observed:
- S 4.41 (1) Use of a suitable PC security product
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000
�