IT Baseline Protection Manual - The Information Warfare Site

Networked Systems
_________________________________________________________________________________________
available today is not designed to work together with a management system. This is partly due to a
lack of standards which, for example, guarantee sufficient security and partly due to the fact that large
software packages are fitted with their own management, because restricted information necessary for
managing the software should not be revealed. For example, the Microsoft Internet Explorer has
management software, the "Internet Explorer Administration Kit (IEAK)", which allows the
administrator to select security settings which cannot be changed by the user or can only be changed to
certain values. The functions of this tool are proprietary and are not subject to any standards.
The architecture of management software generally has a centralist structure. There is a central
management station or control panel from which the system administrators can manage the network
for which they are responsible together with the hardware and software it contains. Particularly the
systems for network management are based on this. As a result of the lack of standards in the area of
system management, the available products often have centralist architecture, yet the details are
proprietary and no general statement can be made about the architecture.
A network management system is usually based on a model which distinguishes between "manager",
"agent" (also "management agent") and "managed objects". Other components are the protocol used
for communication between the manager and the agents, as well as an information database, the socalled
"MIB" (Management Information Base). The MIB must be available to both the manager and
each management agent. The idea is that management agents and their MIB are seen to be part of the
managed system.
Managementsystem
Manager
MIB
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000
Verwaltetes System
Subagenten
Managementprotokoll
Agenten
MIB
Managed
Object:
Rechner
Managed
Object:
Drucker
An agent is responsible for one or more of the objects which are to be managed. It is possible to
organise the agents hierarchically. Agents are then responsible for the subagents assigned to them.
There is always an object to be managed at the end of each command chain formed in this way. An
object to be managed is either an existing physical object (device) such as a computer, a printer or a
router, or a software object such as a background process for the administration of print jobs. In the
case of devices that can be managed with a management system, the management agent is usually
"permanently" integrated in the device by the manufacturer. If the agent does not understand the
communication protocol used by the manager, a software management agent is required which can
convert the protocol. In a similar way, software components may already contain the management
agent or a particular management agent is required which is designed for the administration of this
software component.