IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
passwords). The maximum term of validity for these passwords should thus be
stipulated. In order to be able to change the ADMINCFG.EXE password
efficiently, the relevant configuration files can be stored centrally on one
server. As changing the share passwords can involve a high degree of
organisation (see No. 5), it should be determined in advance how often these
are to be changed and how those persons affected are to be informed of the
new passwords.
Windows 95
Under Windows 95, the amount of passwords to be used depends upon which
access model is deployed (User Level Security or Share Level Security). In
the former case, as with Windows NT, the passwords will only be required for
the computers having shared resources for network access. In the latter case,
similar to WfW, passwords for the shared resources will also be required.
Separate passwords for the administration of Peer-to-Peer functions are not
required as these will be controlled via the user profile.
Access protection at the user level is based on the user lists contained in
Windows NT or Novell Netware servers, and can thus only be implemented in
these networks. If Peer-to-Peer functions must be implemented despite having
a Windows NT or Novell Netware server network, then it is preferable to
implement this access model since it offers a higher level of protection.
Windows NT
Under Windows NT, the administration of Peer-to-Peer functions takes place
under general network and access control, so that no separate passwords are
required for these administrative tasks. Regarding administration of access
passwords for the users concerned, please refer to the notes contained in
safeguard S 2.11 Provisions governing the use of passwords.
7. Responsibilities for users in a Peer-to-Peer network
In addition to Peer-to-Peer management tasks (see No. 2), other
responsibilities must be determined. It should be determined what the
responsibilities of the various Peer-to-Peer network users are to be, such as:
These can, for example, be responsibilities for
- the evaluation of the log files on the individual servers or clients,
- the allocation of access rights,
- the escrow and changing of passwords and
- carrying out data backups.
8. Training
It must then be determined which Peer-to-Peer users have to be trained in
which points. Effective operation can only begin after adequate training.
The security strategy developed in this way should be documented and
announced to the users of the Peer-to-Peer network to the extent required.
Additional controls:
- Is the security strategy adapted to changes in the usage environment?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000