IT Baseline Protection Manual - The Information Warfare Site

Telecommunications Fax Servers
_________________________________________________________________________________________
Organisational Shortcomings
- T 2.7 Unauthorised use of rights
- T 2.9 Poor adjustment to changes in the use of IT
- T 2.22 Lack of evaluation of auditing data
- T 2.63 Uncontrolled use of Faxes
Human Failure
- T 3.3 Non-compliance with IT security measures
- T 3.14 Misjudgement of the legal force of a fax
Technical Failure
- T 4.15 Fax transmission errors
- T 4.20 Data loss due to exhausted storage medium
Deliberate Acts
- T 5.2 Manipulation of data or software
- T 5.7 Line tapping
- T 5.9 Unauthorised use of IT systems
- T 5.24 Replay of messages
- T 5.25 Masquerading
- T 5.27 Repudiation of a message
- T 5.30 Unauthorised use of a fax machine or fax server
- T 5.31 Unauthorised reading of fax transmissions
- T 5.32 Evaluation of residual information in fax machines and fax servers
- T 5.33 Impersonation of wrong sender on fax transmissions
- T 5.35 Deliberate overload through fax transmissions
- T 5.39 Infiltrating computer systems via communication cards
- T 5.90 Manipulation of address books and distribution lists
Recommended Countermeasures (S)
For the implementation of IT baseline protection, selection of the required packages of safeguards
("modules"), as described in Sections 2.3 and 2.4, is recommended.
As a first step a comprehensive set of security guidelines for the fax server should be prepared (see
S 2.178) and a suitable fax server should be procured (see S 2.181 Selection of a suitable fax server).
These should be used as the basis for developing appropriate procedures. Finally, Fax Officers should
be appointed for the fax server (see S 3.10 Selection of a trustworthy administrator or deputy and
S 2.180 Setting up a fax mail centre). Both the security guidelines and the procedures based on them
and the appointment of Fax Officers should be effected in writing. These specifications should then be
implemented in the form of specific security measures. As well as secure operation of the fax server, it
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000