IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
c) Multiple-master domains
This model consists of several master domains which trust each other. The
user and group accounts are managed in these master domains. In addition,
there are resource domains which unilaterally trust all master domains. A
multiple-master domain is illustrated in the following diagram:
The explicit trust relationship between domain 1 and domain 3 is necessary, as
Master-
Domäne 1
positions of trust are not transitive, i.e. mutual trust between domains 1 and 2,
as well as between domains 2 and 3, does not automatically imply mutual trust
between domains 1 and 3.
The master domain concepts are often used in networks where more than
15,000 users are present. This concept also allows a network to be partitioned
among main departments, and the resources to be managed by these individual
departments. For this purpose, a master domain is configured for each main
department. The users of a main department are assigned user accounts in the
master domain. The resources are managed by the departments in the resource
domains. It is also possible to organise a network by location. This involves
the configuration of a master domain for each location, and a resource domain
for each department. This domain model is scaleable, and no limits are
imposed on the size of the organisation. Central security management is
possible here, and global groups and user accounts only need to be configured
once throughout the organisation.
Finally, it must be noted that this module requires a high degree of
administrative discipline and careful planning. Particular care must be
exercised when defining the trust relationships. In addition, it is absolutely
necessary to prevent a configuration of user accounts in the resource domains.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Master-
Domäne 2
Ressourcen-Domänen
Master-
Domäne 3