IT Baseline Protection Manual - The Information Warfare Site

Data Transmission Systems Remote Access
_________________________________________________________________________________________
Force Majeure
- T 1.1 Loss of personnel
- T 1.2 Failure of the IT system
- T 1.10 Failure of a wide area network
Organisational Shortcomings
- T 2.2 Insufficient knowledge of requirements documents
- T 2.16 Non-regulated change of users in the case of laptop PCs
- T 2.19 Inadequate key management for encryption
- T 2.37 Uncontrolled usage of communications lines
- T 2.44 Incompatible active and passive network components
- T 2.49 Lack of, or inadequate, training of teleworkers
- T 2.64 Lack of or defective rules for the RAS system
Human Error
- T 3.30 Unauthorised private use of telecommuting workstations
- T 3.39 Improper administration of the RAS system
- T 3.40 Inappropriate use of authentication services with remote access
- T 3.41 Improper use of remote access services
- T 3.42 Insecure configuration of RAS clients
- T 3.43 Inappropriate handling of passwords
- T 3.44 Carelessness in handling information
Technical Failure
- T 4.35 Insecure cryptographic algorithms
- T 4.40 Unsuitable fitting out of the RAS client operational environment
Deliberate Acts
- T 5.7 Line tapping
- T 5.8 Manipulation of lines
- T 5.22 Theft of a mobile IT system
- T 5.39 Infiltrating computer systems via communication cards
- T 5.71 Loss of confidentiality of classified information
- T 5.83 Compromising cryptographic keys
- T 5.91 Disabling of RAS access security mechanisms
- T 5.92 Use of the RAS client as RAS server
- T 5.93 Permitting use of RAS components by third parties
Recommended Countermeasures (S)
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000