IT Baseline Protection Manual - The Information Warfare Site

Other IT Components Mobile Telephones
_________________________________________________________________________________________
defective, while the black list holds details of all the phones which either have a fault or have been
reported stolen. However, not all network providers maintain an equipment register.
In order that the network provider can prepare billing details of the services used by customers, the
call data must be stored. This includes, for example, details of communication partners (e.g. call
numbers dialled), time and duration of the connection and the location identifiers of the mobile
terminals.
Call establishment
As soon as the owner switches on his mobile phone, it registers with the network provider via the
nearest base station. The subscriber is identified to the network provider by means of his SIM card and
cryptographic algorithms installed on this card. Authentication is effected with the aid of a key which
is known only to the network provider and the subscriber. The network provider logs and stores data
on the identity of the user, the serial number of the mobile phone and the identity of the base station
over which he has registered. This occurs even if no conversation takes place. Moreover, information
is stored on every number dialled, irrespective of whether a connection is established. As a result the
network provider knows which subscribers are on the network so that connections can now be
established from and to subscribers.
Landline network
The conventional public telephone network with its connecting paths is referred to as the landline
network.
As every mobile phone connection also entails the use of landline networks, a number of threats
relating to the landline network apply also where mobile communication networks are used. The lineconnected
part of the GSM network is a special instance of an ISDN network. Hence, most of the
threats and safeguards which apply to ISDN are applicable to GSM as well. Section 8.4 LAN
connection of an IT system via ISDN is therefore also relevant to data transmission over GSM.
This chapter considers those security characteristics of mobile phones which are relevant to persons
using them. The intention is to present a systematic approach as to how to draw up a concept for the
use of mobile phones within an organisation and ensure that this is implemented and integrated.
Threat Scenario
For IT baseline protection, the following typical threats are assumed to affect the use of mobile
phones:
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000