IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 6.54 Procedures in case of a loss of network
integrity
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrator, IT users
If the network acts unexpectedly (for example, servers are not available,
access to network resources is not possible, or network performance is
consistently poor), a loss of network integrity could have occurred. This could
be due to misuse of the network, e.g. due to changes in the configuration of
the active network components or damage to them.
Users should observe the following procedure in this case:
- Working documents should be saved and any programs still running should
be closed down.
- The Administrator must be informed via an appropriate escalation stage
(e.g. User Help Desk). The reporting procedure should not be allowed to
significantly hinder the Administrator's activities.
The Network Administrator should observe the following procedure:
- Narrow the faulty response down to a network segment or network
component.
- Check the configuration of the active network components present there
(this also includes password checks).
- Back up all files which could provide information on the nature and cause
of the problem (for example, whether an intrusion has taken place, and if
so, how penetration was effected), i.e. it is especially important to back up
all the relevant log files.
- If necessary, restore the original configuration data (refer to S 6.52 Regular
backup of configuration data of active network components).
- If necessary, check the hardware in use (cabling, plug connectors, active
network components etc.) for faults.
- Request all users to check their working domains for irregularities.
If there are signs of a deliberate attack on the network, it is essential to act
immediately in order to minimise the damage and prevent further damage
from occurring. This requires that there is an alarm plan which lists the steps
to be implemented and specifies who should be informed of the incident (see
also S 6.60 Procedural rules and reporting channels for security incidents).
The alarm plan should also specify whether and how the Data Privacy Officer
and the legal department should be involved.
Additional controls:
- What steps have been taken to ensure to ensure that the Administrator is
properly informed?
- Are these procedures actually followed?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Misuse
Notify Administrator
Back up log files
Implement alarm plan