IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
5. Trap: used by agents in order to inform the manager of exceptional events.
Unlike a GetResponse message, a Trap message is not preceded by a query
from the manager.
The essential advantages and disadvantages are:
+ SNMP has a simple design and is thus easy to implement. This reduces its
susceptibility to faults and improves the stability of the protocol.
+ SNMP is used on a widespread basis and is regarded as a de-facto standard.
As a result, it is supported by nearly all products in network and system
technology.
+ The protocol can be adapted very easily to future requirements. For this
reason as well as the above-mentioned widespread use of SNMP, this
protocol can be considered extremely future-oriented, thus providing a high
degree of investment protection.
+ SNMP is a simple, connectionless protocol on the transport level.
Consequently, the transmission of SNMP packets in a network is more
efficient compared with the connection-oriented CMIP.
- The use of SNMP harbours security risks which could allow intruders to
obtain detailed information on the system and network environment.
Except for the community names (which, in the case of SNMP, allow the
formation of groups and provide basic password protection), no real
password protection is available for access to network components.
- Due to its simple nature and the features it possesses, the SNMP protocol
exhibits shortcomings when operated in very large or rapidly expanding
networks.
- The performance of version 1 proves inadequate in the case of complex
MIB queries, as the complete MIB tree always needs to be specified.
One of the main disadvantages of version 1 of the SNMP is that it does not
support authentication for access to monitored components. Version 2 of the
SNMP compensates for some of these disadvantages and provides better
performance in the handling of MIB queries.
However, different variants of SNMPv2 exist in terms of the security features
supported. Only the variants SNMPv2* and SNMPv2u offer the possibility of
symmetric, user-based authentication, while SNMPv2c continues to rely on
communities. In SNMP, communities are firstly used to classify individual
network components into groups, and secondly used as substitute passwords
during access to these groups. SNMPv2* also offers the possibility of data
encryption in accordance with the Data Encryption Standard in the Cipher
Block Chaining Mode (DES-CBC). Due to the different variants of SNMPv2
presently in use, manufacturers of network components and network
management systems are quite uncertain about their installation strategies, as a
result of which implementations based on SNMPv2 are not yet encountered on
a widespread scale, and are only inter-operable to a restricted extent.
The different variants of SNMPv2 are to be consolidated in the next SNMP
version (SNMPv3). The release of SNMPv3 is currently being prepared but
has not yet been completed.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000