IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.122 Standard e-mail addresses
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrator, IT users
E-mail addresses should be allocated on the basis of clearly defined rules. In
this context, it is advisable to base the nomenclature for personal e-mail
addresses on the names of the users of the IT systems (e.g. e-mail address =
first eight characters of the surname). User names on IT systems which can be
accessed outside the protected network should not be directly derivable from
the e-mail addresses, in order to prevent intrusions into user accounts. It is
important not to change addresses too frequently or make them too long and
complicated. In particular, it must be ensured that non-ASCII characters such
as mutated vowels are not used as part of e-mail addresses.
To impede intrusions, avoid e-mail advertisements and release as little
information as possible outside the protected network, it might be advisable to
assign e-mail addresses which are difficult to guess instead of addresses
related directly to users and organisations, for example,
surname@organization.com. However this also makes the forwarding of
addresses less convenient, and can render communications with external
parties more difficult.
If e-mail addresses are modified or no longer applicable, it must be ensured
that e-mail bearing the old address is transferred to the new address at least for
a transitional period.
In addition to personal e-mail addresses, specific organisational and specific
functional e-mail addresses can also be configured in order to guarantee
proper delivery to the right department, regardless of the persons involved.
This is of particular importance in the case of central gathering points.
Additional controls:
- According to which rules are e-mail addresses assigned?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000