IT Baseline Protection Manual - The Information Warfare Site

Other IT Components Telecommuting
_________________________________________________________________________________________
- T 5.21 Trojan Horses
- T 5.23 Computer viruses
- T 5.24 Replay of messages
- T 5.25 Masquerade
- T 5.43 Macro viruses
- T 5.71 Loss of confidentiality of classified information
Recommended Countermeasures (S)
For the implementation of IT baseline protection, selection of the required packages of safeguards
("modules") as described in chapters 2.3 and 2.4, is recommended.
A sufficiently reliable form of telecommuting is only achieved if IT security measures from several
areas are allowed to overlap and complement each other. If any one of these areas is neglected, secure
telecommuting can no longer be ensured. The individual areas and essential measures are:
- Infrastructural reliability of the remote workstation: Measures to be implemented at the remote
workstation are described in Chapter 4.5 titled "Working Place at Home".
- Organisation of telecommuting: Secure telecommuting requires organisational regulations and
measures for governing staff activities. These are listed in the following under the general headings
"Organisation" and "Personnel". Particular attention needs to be paid to the obligations and
assignments of telecommuters, and rules concerning the usage of communications facilities. They
are described in the following measures:
- S 2.113 Requirements documents concerning telecommuting
- S 2.116 Regulated use of communications facilities
- S 2.117 Regulation of access by telecommuters
- S 3.21 Training and further education of telecommuters as regards security-related issues
- Security of the telecommuting workstations: The remote computer must be configured so as to
allow secure use even in an unsecure operational environment. In particular, only one authorised
person should be able to use the remote computer in the online and offline states. The related
measures are summarised under the general headings "Hardware/software" and "Contingency
measures". In particular, the security requirements in S 4.63 Security requirements for remote
computers should be observed.
- Secure communications between telecommuting workstations and an institution: As
communications take place via public networks, special security requirements concerning the
exchange of data between telecommuting workstations and an institution need to be observed.
These are described in S 5.51 Security-related requirements for communications links between
telecommuting workstations and the institution. For the linkage of a remote computer via the public
network, refer to Chapter 8.4 titled "LAN linkage of an IT system via ISDN".
- Protection of communications computers at institutions: To a certain extent, these computers
constitute a publicly accessible interface via which telecommuters can make use of information
technology and data at the institution. As misuse by unauthorised parties needs to be prevented
here, special security requirements described in S 5.52 Security requirements for communications
computers must be met.
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000