IT Baseline Protection Manual - The Information Warfare Site

Threats Catalogue Deliberate Acts Remarks
____________________________________________________________________ .........................................
T 2.45 Conceptual deficiencies of a network
Correct planning of the installation and expansion of a network decisively
determines the success of all network operations. Progressively shorter
innovation cycles in IT pose a particular challenge to networks which cannot
meet the new requirements due to their design, and therefore easily create
bottlenecks:
- A network must be designed in accordance with the requirements of
network users (e.g. workgroups) as regards the confidentiality of data and
the integrity of the network. Otherwise, confidential data of a particular
workgroup could be read by other, unauthorised network users. The
confidentiality of data can also be violated through the relocation of
individual workgroup members or entire workgroups if it is not possible to
configure new confidential domains in the network or reconfigure existing
ones. This threat also applies to the integrity of the network or segments
thereof.
Example: A subnetwork separated by a router was configured for a
workgroup that had special requirements as regards the confidentiality and
integrity of data. Because of the routing of cables this segment was
confined to one single building. If several members of this workgroup were
later relocated to a different building, they would then need to
communicate via the standard, productive network. As a result, the
confidentiality and integrity of the data could no longer be ensured.
- If new applications with higher bandwidth demands than were foreseen
during the planning phase are placed within the network, this can easily
impair the availability of the entire network if conceptual deficiencies in its
infrastructure no longer allow adequate scaling (loss of availability due to
overload). Depending on the existing segmentation of the network, the loss
of availability might only affect individual segments.
Example: For historical reasons, many existing networks which have been
expanded during the course of time contain, in many cases, backbone
segments with a lower maximum bandwidth, such as Token-Ring or
Ethernet segments. The restricted transmission rates in these backbone
segments affect the availability of the entire network during periods when
the load is high.
- Networks intended exclusively to connect proprietary systems can also
suffer a loss of availability if they are connected to non suitable systems
(loss of availability due to network components which cannot operate
together).
Example: Proprietary networks are used primarily in the mainframe sector
for connecting mainframes with their terminals. Such networks are often
intended for terminal or printer operation only and are not suitable for other
architectures (e.g. Ethernet). This applies to the installed cables as well as
the active network components. If an attempt is made to exceed this scope,
the proprietary network usually becomes unavailable. One possibility of
integrating two different architectures is to create a connection via a
gateway.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000