IT Baseline Protection Manual - The Information Warfare Site

Data Transmission Systems Remote Access
_________________________________________________________________________________________
To implement IT baseline protection, selection of the required packages of safeguards ("modules"), as
described in Sections 2.3 and 2.4, is recommended.
A RAS system consists of several components which from the outset should be protected as individual
components. Quite apart from the RAS functionality, these should be viewed as normal IT systems or
network switching elements which need to be protected according to the suggestions made in the
relevant safeguard modules. RAS servers are computers which are normally fully under the control of
an organisation and perform the important task of controlling access to the internal network. The RAS
functionality is generally superimposed on an operating system which in most cases offers additional
services as well. Hence the security of RAS access also depends on there being no security
weaknesses either at operating system or service level.
As well as protecting the RAS system components, however, it is also necessary to draw up a RAS
security policy which must be integrated into the existing security policy. At the same time as
implementing existing security requirements, the RAS system requires that new, RAS-specific
security rules are defined.
A RAS system will generally be used in the environment of other systems which serve to control
access to the internal network from outside. Examples of other systems with which a RAS system has
to work are firewall systems and remote maintenance systems. For this reason, when implementing the
RAS-specific safeguards, the safeguards from the relevant modules of the affected systems must also
be considered. The modules which should be considered include:
- 4.5 Working place at home (telecommuting)
- 7.3 Firewalls
- 8.1 Private branch exchanges
- 9.3 Telecommuting
Secure RAS access depends on a series of safeguards being taken, starting at the design stage, and
then moving on to procurement and operation. The steps involved here and the safeguards which
should be considered at each of the steps are listed below.
1. A RAS concept must be prepared up front, based on the security requirements for the
existing IT systems and the requirements arising from the planned situations under which
RAS will be used.
1.1 To tailor the concept to the particular application, the requirements must be determined at the
start. For this purpose a requirements analysis must be performed (see S 2.183 Performing a
RAS requirements analysis).
1.2 On the basis of the requirements thus determined, a RAS concept can then be defined (see
S 2.184 Development of a RAS concept).
1.3 To implement the concept, a RAS system architecture must be defined (see S 2.185 Selection
of a suitable RAS system architecture), which is tailored to the organisation's RAS
requirements and the RAS concept to be implemented.
2. Before the RAS system can be procured, the requirements relating to the RAS product must
be derived from the RAS concept and the choice of a suitable RAS product must be based on
these (see S 2.186 Selection of a suitable RAS product).
3. The security-relevant safeguards for the implementation of the RAS concept may be broken
down into the following areas:
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000