IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
For the above-mentioned reasons, only the use of SNMPv1 is recommended
from the perspective of IT baseline protection. If the network management
protocol or the network security features need to fulfil additional security
requirements, use should be made of SNMPv2u or SNMPv2* with user-based
authentication, or of CMIP. In principle, aspects related to confidentiality and
authenticity are evidently supported to a greater extent by more recent
versions of SNMP, although this advantage is accompanied by losses in
bandwidth.
CMIP
In contrast to SNMP, CMIP is based on an implemented OSI protocol stack
(OSI layers 1 to 3 are implemented as a protocol stack) and is thus also
connection-oriented. This restricts the use of CMIP to components which
fulfil hardware-related and software-related requirements for the
implementation of a complete OSI stack. Due to the high demands placed by
this implementation, a "CMIP Over TCP/IP" (CMOT) was also defined (RFC
1189). This allows CMIP to be operated in pure TCP/IP networks too.
One of the objectives of the CMIP concept was to develop an object-oriented
management system. Accordingly, CMIP has a consistently object-oriented
design. A CMIP machine (CMIPM) performs the tasks which are assigned to
the manager under SNMP. This CMIPM, which consists of a software
program like the SNMP manager, receives service requests from the agents of
the objects to be managed to perform various operations; in response, the
CMIPM sends CMIP messages to these agents. In accordance with objectoriented
principles, the objects are managed via several trees which exhibit
different mutual relations and are characterised by different types of access.
Due to its object-oriented design, CMIP is a very powerful and complex
protocol. However, this protocol contains relatively few operations which
allow full management on the basis of the above-mentioned object-oriented
structure.
The essential advantages and disadvantages are:
+ Due to its object-oriented design, CMIP offers many more possibilities
than SNMP, including the execution of actions and the management of
instances of management objects.
+ CMIP offers more security than SNMP, particularly through the
availability of mechanisms for access control, user authentication and
auditing.
+ The CMIP protocol is defined by OSI, thus constituting an official,
international standard, whereas SNMP is only regarded as a de-facto
standard based on a RFC.
+ CMIP does not have the afore-mentioned shortcomings of SNMP.
- CMIP is a very complex protocol, whose diverse features are rarely
required or capable of being used in its entirety. Due to the large number of
possible settings, an elaborate configuration of this protocol is very
difficult, and requires a great deal of know-how on the part of the
administrator.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000