IT Baseline Protection Manual - The Information Warfare Site

Telecommunications Telecommunications System (Private Branch Exchange, PBX)
_________________________________________________________________________________________
Force Majeure
- T 1.4 Fire
- T 1.7 Inadmissible temperature and humidity
Organisational shortcomings:
- T 2.6 Unauthorised admission to rooms requiring protection
Human Failure:
- T 3.6 Hazards posed by cleaning staff or outside staff
- T 3.7 Failure of the PBX due to operating errors
Technical Failure:
- T 4.6 Voltage variations / overvoltage / undervoltage
Deliberate Acts:
- T 5.1 Manipulation/destruction of IT equipment or accessories
- T 5.11 Loss of confidentiality of data stored in PBX installations
- T 5.12 Interception of telephone calls and data transmissions
- T 5.13 Eavesdropping of rooms
- T 5.14 Call charges fraud
- T 5.15 "Inquisitive" staff members
- T 5.16 Threat posed by internal staff during maintenance/administration work
- T 5.17 Threat posed by external staff during maintenance work
- T 5.44 Abuse of Remote Access Ports for Management Functions of Private Branch
Exchanges
Here, consideration is given to those threats which may impair the functioning of an institution. Thus,
the focus is not on legal data privacy aspects. These are already covered, for a major part, by existing
operating agreements and/or service agreements. Nevertheless, IT baseline protection does, of course,
also contribute to the protection of person-related data.
Recommended Countermeasures (S)
For the implementation of IT baseline protection, selection of the required packages of safeguards
("modules") as described in chapters 2.3 and 2.4, is recommended.
The central devices of a PBX facility should be installed in a room which meets the requirements laid
down for a server room (Chapter 4.3.2), or for a technical infrastructure room (Chapter 4.3.4). For
provision of a PBX with cables, see Chapter 4.2.
In the following, the safeguard group "Private Branch Exchange" is set out:
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000