IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 6.44 Data back-up under Windows NT
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: IT-user
Under Windows NT, data backup can be carried out with the service program
NTBACKUP.EXE which is integrated into the system. It must be borne in
mind that this program only supports backups onto tape and is not capable of
encrypting the backup tapes these must, therefore, be securely stored in a safe
place.
When carrying out data backup, the following points must be taken into
account:
- Access rights to the Windows System directory %SysRoot%\SYSTEM32
(usually \WINNT\SYSTEM32) are necessary for data backup since
NTBACKUP stores temporary and log files there.
- Back-up software is able to back up the registry of the local computer. This
should be carried out at regular intervals and after significant changes to
the configuration.
- Quarter-inch tapes used for data backup should be wound up properly at
regular intervals (after being used approximately 20 times) via the option
"Wind Tape" to avoid loose sections and possible damage due to abrasion.
This safeguard is not necessary for 4 mm (DAT) and 8 mm (Video 8)
tapes; the appropriate operation is not available for these tapes.
- When entering the option "Delete Tape", "Secure Deletion" should be
selected if the tape contained valuable data as this will ensure that the old
data is overwritten. If this option is not selected, a large portion of the data
originally stored on the tape remains available and can be reconstructed
without a great deal of effort.
- When carrying out a backup operation the opportunity to create a log-file
absolutely must be used. Once the operation is completed, the log-file can
be used to check whether all the relevant data was really backed up or if
any faults occurred during the backup. The option "Log all entries" is
recommended, since it can thus also be determined if all relevant data was
backed up and whether the directories to be backed up were, in fact,
included in the backup.
- When reproducing backed up files, their access protection will also be
reproduced, given that the directory into which they are reproduced does
not assert any explicit access controls on the files saved therein. If,
however, such control is specified in the directory, this then applies to the
files and the original access control information is ignored.
- The choice of files and directories to be backed up cannot be saved under
the graphic user interface. To regularly back up the same directories,
Scripts can be created; these are, however, not designed for file selection.
Due to the restrictions existing in the service program NTBACKUP.EXE,
additional data backup software should be installed to ensure extensive
installation or for high availability requirements. When selecting backup
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000