IT Baseline Protection Manual - The Information Warfare Site

Threats Catalogue Deliberate Acts Remarks
____________________________________________________________________ .........................................
T 5.22 Theft of a mobile IT system
Mobile use of an IT system carries the risk of new threats to which stationary
IT systems are less exposed. Mobile systems such as laptops are normally not
used in a room secured by protective measures. They are carried in cars or on
public transport, set down in other people's offices during breaks and left
unattended in hotel rooms.
Because of these environmental factors, mobile use of IT systems intrinsically
exposes them to a higher risk of theft. It is not totally uncommon for mobile
IT systems to be "accidentally" stolen, e.g. there might be a laptop in the boot
of a car that happens to be stolen.
If a mobile IT system should be stolen it is also possible that any existing boot
protection (boot/BIOS password) may be surmounted. For IT systems which
do not have boot protection but whose protection relies exclusively on the
authentication mechanism of the operating system (user name, password), an
aggressor can access the data on the hard disk by booting up from a diskette or
CD-ROM.
If the mobile IT system is integrated into a remote access system and
automatic RAS connection (auto-dial, storage of authentication data) is
enabled, an unauthorised third party could access resources on the destination
LAN.
Example
The managing director of a large company had his laptop stolen during a
business trip. The material loss was trivial as it was possible to obtain a new
laptop within a day. Far more painful, however, was the loss of important
customer data which had been stored on the laptop. No backup of this
information existed as it had only been entered during the business trip.
Examples of destructive functions of computer viruses
- Every year on March 6th the boot virus Michelangelo overwrites the first
tracks of a hard disk with stochastic material, thus rendering the hard disk
useless.
- The multi-partite virus Onehalf encrypts a maximum of half of the contents
of a hard disk. If the virus is removed, the encrypted data becomes
inaccessible.
- The Word macro virus WAZZU inserts the word "Wazzu" at random
points in infected documents.
- The Word macro virus Melissa appeared on 26 March 1999 and spread all
over the world in the course of the following weekend. This virus is
contained in a Word 97 or Word 2000 file which is sent by an infected
computer via Microsoft Outlook to up to 50 address entries stored in each
address book. In some relatively large organisations the virus completely
overwhelmed the mail system.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Insufficient access
protection
Higher threat potential
with remote access