IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
- Module 6.1 Server-supported Network must be applied to every IT system which offers services
(e.g. file or print services) as a server in the network.
- Module 6.2 UNIX Server must be applied to every server which runs under the UNIX operating
system.
- Module 6.3 Peer-to-Peer Network must be applied to every client which offers peer-to-peer
services (for example shared directories) in the network.
- Module 6.4 Windows NT Network must be applied to every server which runs under
Windows NT.
- Module 6.5 Novell Netware 3.x must be applied to every server which runs under this operating
system.
- Module 6.6 Novell Netware 4.x must be applied to every server which runs under this operating
system.
NB in addition to the operating system-specific module, module 6.1 must be applied for every
server as this module draws together all the platform-independent security aspects of servers.
- Module 8.1 must be applied to every private branch exchange or to every sample of the same
from a corresponding group.
- Module 8.2 must be applied to every fax machine or to every sample of the same from a
corresponding group.
- Module 8.3 must be applied to every answering machine or to every sample of the same from a
corresponding group.
- Module 8.6 Mobile Telephones should be applied at least once if the use of mobile phones is not
forbidden in the organisation or organisational unit under consideration. If there are several
different mobile phone operational areas (for example several mobile phone pools) then module 8.6
should be applied separately to each one.
- Module 9.3 Telecommuting must also be applied to every IT system which is used for telework.
Tier 4: Security in the network
This tier is concerned with security aspects in the network which cannot be isolated to particular IT
systems (e.g. servers) in the network. Rather, the concern here is those security aspects which relate to
the network connections and communications between the IT systems.
To simplify matters, it may be appropriate to consider sections within the complete network rather
than the whole network at once. The division of the full network into subnetworks should be
performed in accordance with these two criteria:
- The assessment of protection requirements will have identified connections over which certain data
must under no circumstances be transported. These connections should be viewed as "interfaces"
between subnetworks, i.e. the two endpoints of such a connection should be in different
subnetworks. Conversely, connections which transport data that has a high or very high protection
requirement should if possible not pass over any subnetwork boundaries. If this principle is
followed, the protection requirements of the resulting subnetworks will be uniform as far as
possible.
- Components which are only connected to each other over a long-distance connection should not be
assigned to the same subnetwork i.e. subnetworks should not extend over more than one location or
property. This is desirable both in order to retain an overview and for the efficient conduct of the
project.
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000