IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Under Windows NT the only authorised users are those defined by the
administrator. Only administrators may change computer names. However,
users can try to log on under another user name via the option "log on as"
under "connect network drive".
In addition, name conventions can be introduced for the sharing of names of
directories or printers. In the event that it should not be possible to draw
conclusions regarding the contents of the directory, pseudonyms should be
used. Should a shared resource not be recognisable as such, the symbol ”$”
must be attached to the share name. The latter is recommended if directories
are only used for the bilateral exchange of information between two users.
5. Determining directories or printers to be shared and the granting of access
rights
For the application server, it should be determined which directories (e.g. the
Post Office directory AGPO under Mail) are to be shared. For the file server,
the directories to which the users are to have access should be selected. Under
WfW and Windows 95 any user can share resources for network access; under
Windows NT only administrators have permission to do this.
Two access models must be differentiated. Share Level Security, in which
access to shared resources is controlled by passwords and User Level Security,
in which access is controlled by the server operating system. WfW supports
only the first of these models, Windows NT (as client) only the second whilst
Windows 95 allows the choice between both models, via the system control
option "network" under the register card "access control". When using Share
Level Security, access rights (read and write access) for shared directories
must be defined and appropriate passwords selected.
As a result of the allocation of these passwords to individual users, the access
authorisations are distributed in the Peer-to-Peer network. These passwords
should only be made known as far as is necessary, since the withdrawal of
authorisation for one person involves changing the password for all other
authorised users.
When using User Level Security under Windows NT and Windows 95 access
rights will be explicitly assigned to individual users and/or groups. The clients
must be connected in a workgroup or domain with at least one Windows NT
system. In this case password entry will be omitted. Use of Share Level
Security must be avoided here, since it offers considerably less protection. It
should then be decided whether the directories are automatically shared when
the server is started and whether it should automatically be connected to the
accessing computer upon start-up.
The above comments also apply to the sharing of printers.
6. Changing passwords
Windows for Workgroups
A series of passwords are used in the WfW network - registration passwords,
the password for calling up ADMINCFG.EXE and the passwords for the
various rights of shared directories, printers and output file. The registration
passwords and the password for calling up ADMINCFG.EXE should be
changed on a regular basis (see also S 2.11 Provisions governing the use of
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000