IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.54 Procurement/selection of suitable answering
machines
Initiation responsibility: Agency/company management
Implementation responsibility: Site technical service, purchase department
This measure is to be observed for the procurement of new answering
machines. If existing devices do not meet security requirements, their disposal
and the procurement of new ones is to be considered.
To reduce threats to a minimum, the following criteria should be observed
during the purchase of answering machines, taking their price/performance
ratio into consideration:
- The devices must be authorised by the Federal Post in order to ensure
trouble-free telecommunication.
- In the case of devices with a fully or partially digital memory, it is
recommended to select those which are equipped with an emergency power
supply consisting of a battery pack or removable accumulator. Permanently
integrated accumulators need to be replaced by a service technician, and
this procedure entails longer deactivation periods for the answering
machine.
- Due to variations in the quality of message recording (e.g. by analogue or
digital units), the performance of answering machines in this context
should be checked before purchase.
- Devices with a fully or partially digital memory should be equipped with a
display for indicating the battery charge and a distinct warning signal (if
possible, acoustic) for timely indication of low battery charges.
- Answering machines which use a single cassette for incoming as well as
outgoing messages require longer waiting periods for tape winding. The
acceptability of this extra time should be weighed.
- The user-friendliness of answering machines should be evaluated.
Ergonomic and clearly arranged buttons, single-function keys and easily
understandable manuals are advantageous in this respect.
- If possible, the remote-inquiry unit should have a mechanical or electronic
deactivation function, and the security code should consist of at least three
or four digits and be freely programmable. Increased security is offered by
a disabling circuit which interrupts the connection to the answering
machine after three invalid entries of the security code. This at least
increases the time required by would-be perpetrators and the telephone
charge incurred by them. An even greater advantage is offered by devices
which completely disable the remote-inquiry function after three invalid
attempts and only allow this function to be restored on the answering
machine itself. The prolongation of the disablement periods after each
successive invalid entry is also advantageous.
Additional controls:
- Is the purchasing department aware of the above-mentioned instructions?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000