IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
If this access capability is not required, e.g. because the administrator is not
supposed to be able to access local user data, the right ”Access to this
computer from the network ” should be blocked for administrators via User
Manager, under Guidelines - User Rights.
By default, Windows NT assigns the "Full Access" share permission for the
"Everyone" group every time a share is created. In particular for directories
located on data media without the NTFS file system, this is unacceptable,
because in this case apart from the share permissions there are no other means
of assigning rights and hence of access control. The "Everyone" group
therefore has to be removed from the access control list and replaced by the
groups and if appropriate individual users who are intended to have access to
the shared directory. Corresponding share permissions should then also be
assigned.
Even where directories are in fact located on NTFS data media, the
"Everyone" group should be removed from the access control list in the event
of a share being created. It would be conceivable in this case, however, to
include the "User" group with assignment of the "Full Access" access right.
The individual assignment of access rights to the directory or the files and
subdirectories that it contains is then carried out at the level of NTFS
permissions (see S 4.53).
Additional controls:
- Is there any documentation indicating which directories on which
computers have been shared for network access?
- Has the "Everyone" group in the shared directories located on data media
without an NTFS file system been removed and replaced by the groups
and, if appropriate, individual users who are allowed to access the relevant
shared directory via the network?
- Is the existing share profile adapted to changes in operational conditions?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000