IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- Is too much information recorded (long log files make it more difficult to
detect irregularities)?
- Are there any particularly long periods of time when the user has not
changed (suggesting that logging-off is not being consistently carried out
when a user finishes working)?
- Are there any unusually long periods during which a connection with a
public network has been maintained (see T 4.25 Still Active Connections)?
- Have unusually high network loads or an interruption in network
operations been detected in individual network segments or throughout the
network? (suggesting that there have been attempts to obstruct or impair
network services or that the network has been inappropriately designed or
configured)?
When evaluating the log files, particular attention should be paid to all
accesses which have been carried out using an Administrator ID.
If extensive log files are to be evaluated on a regular basis, it is sensible to use
an evaluation tool. This tool should allow evaluation criteria to be selected and
highlight especially critical entries (e.g. repeated failed attempts at log-on).
The guidelines stated above also apply to the gathering of auditing data,
because in principle, this involves the logging of security-critical events.
Additional controls:
- Who analyses the log files? Is the two-person rule applied?
- Can the activities of the Administrator be monitored to a sufficient extent?
- Is the IT Security Management Team notified of irregularities?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000