IT Baseline Protection Manual - The Information Warfare Site

Threats Catalogue Deliberate Acts Remarks
____________________________________________________________________ .........................................
T 3.9 Improper IT system administration
Improper IT system administration can jeopardises the security of the system
if it results in circumvention of or failure to observe IT security measures.
Improper administration exists, for example, if network access points (daemon
processes) which are not necessary for the regular operation of the IT system
or which represent a particularly large threat due to their error-proneness are
created or not disabled.
Under no circumstances should access accounts be used when working on the
system which possess more privileges than are absolutely necessary for the
work, as this raises the danger of loss or damage due to viruses and Trojan
horses unnecessarily.
It is extremely rare that standard installations of operating systems or system
programs have all the features of a secure installation. Inappropriate
modifications to specific security requirements can pose a considerable risk
here.
Special care must be taken with systems which, if poorly administrated, could
affect the protection of other systems (e.g. firewalls).
Every modification of security settings and extension of access rights
constitutes a potential threat to overall security.
Examples
In addition to the instances mentioned under T 3.8 Improper use of the IT
system, the System Administrator may create threats due to the incorrect
installation of new or existing software. Other instances of incorrect
management are: failure to use auditing functions or to analyse existing log
files, granting of overgenerous access rights, failure to review access rights at
regular intervals, multiple assignment of the same log-in name or UID, and
failure to use the available security tools, e.g. failure to use a shadow file for
passwords under UNIX.
The older a password is, the less effective it becomes. The reason for this is
that the probability of a successful attack increases steadily over time.
Special care must be taken over the administration of a firewall system as the
protection of many other systems depends on it.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Insecure network access
Unnecessary access
rights
Improper modifications
Inadequate logging
Ageing of passwords