IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Password protection:
- Are there passwords which have been pre-set by the manufacturer? Typical
examples of such passwords are the product name, the manufacturer’s
name, ”SUPERVISOR”, ”ADMINISTRATOR”, ”USER”, ”GUEST”.
- Which file changes if a password was changed? Can this file be replaced
by an old version from a backup to activate old passwords? Are the
passwords stored in encrypted form or are they readable in plain text? Is it
possible to make changes in this file to activate new passwords?
- Is access actually blocked following several incorrect password entries?
- Are programs offered in magazines or mailboxes which can determine the
passwords of the product being examined? Such programs are available for
some standard applications.
- If files are protected by passwords, can the position at which the password
is stored be determined by a comparison of a file before and after the
change in the password? Is it possible to enter changes or old values at this
point in order to activate known passwords? Are the passwords stored in
encrypted form? How is the position allocated if password protection is
deactivated?
- Can the password testing routine be interrupted? Are there key
combinations with which password entry can be bypassed?
Access rights:
- In which files are access rights stored and how are they protected?
- Can access rights be altered by unauthorised persons?
- Can files be inserted using old access rights and which rights are needed
for this?
- Can the rights of the administrator be restricted such that he does not
obtain access to the usage- or protocol data?
Data backup:
- Can backups which have been created be reconstructed without difficulty?
- Can backups be protected by a password? If so, can the password trial
attempts described above be used?
Encryption:
- Does the product offer the possibility of encrypting files or backups?
- Are several different encryption algorithms offered? In this connection,
generally speaking, the following rule of thumb should be observed: ”The
quicker an encryption algorithm produced in software is, the more insecure
it is.”
- Where are the keys used for encryption and decryption stored?
In the case of local storage there must be an examination of whether these
keys are password-protected or are protected by a second encryption with a
further key. In the case of password protection the above points must be
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000