IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.100 Secure operation of Novell Netware servers
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
Secure operation of a Novell Netware network requires various actions which
are listed below:
Allocation of access rights to directories and files
The allocation of access rights (Trustee Assignments) to files and directories
on Novell Netware servers plays a central role in the security of Novell
Netware servers.
In contrast to the assignment of attributes, Trustee Assignments are assigned
to individual users or user groups.
Directories and files can be assigned to specific tasks via the access rights.
This ensures that user groups and users are only granted access to the
directories and files which they require for performing their respective tasks.
For a clearer overview, easier administration and improved auditing
capability, access rights should be assigned primarily to user groups.
To prevent accidental release of directories by users, system administration
should ensure that the directories allocated to users and user groups do not
contain "Supervisory" (S) and "Access Control" (A) privileges.
If certain properties (e.g. write-protected files) are allocated to files or
directories with the help of Netware Attributes, attention should be paid to the
fact that users possessing the "Modify" (M) privilege for the corresponding
files and directories are able to change these attributes. The number of users
with this access right should thus be restricted (see below Allocation of
Netware Attributes to files and directories).
Allocation of access rights to directories and files
Besides granting access rights to users and groups for files and directories, the
allocation of Netware-Attributes to files and directories can increase data
security. Attributes always concern files or directories, i.e. they are
independent of the allocated access rights and are valid for all users including
the supervisor.
Users, who have been granted the "Modify (M)" privilege for the files and
directories concerned, can change the Netware-Attributes and thereby carry
out every action permitted by their effective privileges.
By installing Netware-Attributes, security will take the form of a subsystem in
file and directory security.
When allocating Netware-Attributes to files and directories, the following
properties of Netware-Attributes should be taken into account.
- Directory Attributes:
Hidden (H): The directory will be labelled as hidden; it will not show up
in a contents list under DOS, neither can it be copied or deleted.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000