IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
unauthorised access to the output file, this should also be interrupted. It is
recommended, however, to copy the contents of the window of the
Network Monitor to the clipboard with the Print key as access to the output
file is not documented.
- Checking the protocol data: In the event that resources have been shared
on a computer, the event protocol should be activated (in the program
group CONTROL PANEL under Network for WfW, or in the program
group ADMINISTRATION under User-Manager for Windows NT) and
assessed on a regular basis (in the program group NETWORK under
Network Monitor for WfW or in the program group CONTROL PANEL
under Events for Windows NT). Windows 95 offers no standard
procedure for logging events. Therefore, under Windows 95, the Network
Monitor absolutely must remain open in case Peer-to-Peer functions need
to be carried out despite this weakness.
It should be checked on a weekly basis, for example, whether unauthorised
users accessed shared directories, whether there were errors in accessing
shared directories or whether the system was started at unusual times. As
these protocol data also contain person-related data, they should be deleted
after assessment if storage is no longer required.
Example for a possible incident protocol:
- Checking automatically shared resources: WfW and Windows 95 users
should check on a random basis which of their resources are automatically
shared after start-up of the system without their direct participation (for
example, by checking after start-up which directories, printers and pages of
the output file are then shared). If necessary, this share should be
withdrawn. Inexplicable irregularities, such as the automatic sharing of a
directory which the user himself did not share, should be reported to the
administrator. These could be indications of Trojan horses which share
directories without being detected. Should the user not be sure whether or
what was shared, the file shares.pwl under WfW should be deleted, which
contains the entries for automatic sharing. Under Windows 95, shares can
be deleted with the help of the Explorer. This problem will not arise under
Windows NT since only administrators can share resources.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000