IT Baseline Protection Manual - The Information Warfare Site

Threats Catalogue Deliberate Acts Remarks
____________________________________________________________________ .........................................
T 3.39 Improper administration of the RAS system
Improper administration of RAS components constitutes a potential risk which
should not be overlooked. Once they get to a certain size and structure, RAS
systems are complex systems which only trained system administrators can
configure correctly and securely. Administrative errors generally have a
pronounced effect on the stability and security as an administrator possesses
privileged rights in the system. Some of the problems which can occur with
RAS systems are set out below.
- Security-relevant routine tasks on the RAS client are frequently neglected.
These include, for example, regular data backups or scanning for computer
viruses. In particular, mobile RAS clients are taken around by their users
and are therefore only seldom available to system administration staff.
While it is possible for remote administration to be performed during an
established RAS session, depending on usage profile, connection times
may be too short to carry out systematic remote maintenance. But if the
regular administrative tasks are not performed, different clients may have
different configurations.
- Remote administration of computers can be performed with the aid of
commonly used software products and is often possible simply using
mechanisms provided by the operating system. The use of unauthorised
software (by the user or the administrator), often means that either nonpermitted
protocols are used over a RAS connection or that settings are
made which do not comply with the security guidelines in force and can
therefore open up security loopholes.
- If computer virus checking is performed exclusively on the server,
encryption of data client-side can be a problem. Many application
protocols can be processed over RAS connections so that transport of email,
Web content or files is possible. Encrypted data can in this case no
longer be checked for viruses using anti-virus software installed on the
server.
- There is no anti-virus software installed on the RAS client or such software
is out of date or disabled. As RAS clients are frequently operated in
insecure environments with the result, for example, that the exchange of
data media is in practice uncontrolled, computer viruses constitute a
particularly serious threat. In particular, the danger exists that computer
viruses or Trojan horses can find their way into the LAN through the RAS
client.
- If functions which place heavy demands on bandwidth are performed over
RAS connections, then there is a danger that the user will terminate a RAS
session and start another one because he believes there is a fault on the
line. But in reality it is simply a case of the response time being
unacceptably slow because the bandwidth is inadequate. This can not only
result in inconsistencies in the application data due to unexpected
termination of a connection, but repeated attempts by users to establish a
connection followed by termination of the connection can also increase the
loading on the RAS system.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Neglect of securityrelevant
routine tasks
Unauthorised use of
software for remote
administration
Encryption and virus
protection
Inadequate virus
protection on RAS
clients
Long response times
due to insufficient
bandwidth