IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- CMIP requires roughly ten times as much system resources as SNMP. For
this reason, it needs to be operated on powerful hardware which is only
offered by a small number of active network components. The OSI
protocol stack, which consumes additional resources, also needs to be
implemented in general. CMOT constitutes an exception here.
- Due to the complexity of this protocol and the corresponding
implementations, CMIP is potentially more susceptible to errors than
SNMP implementations.
- Very few implementations of CMIP are presently available; except for in
the area of telecommunications, this protocol is encountered very
infrequently in practice.
In each individual case, a detailed examination is required as to which
network management protocol is suitable for the applications involved. In this
context, the security requirements for the network management system need to
be formulated and co-ordinated. If the TCP/IP protocol stack is already being
used in the local network and the security requirements are low, it is advisable
to employ SNMPv1. However, high security requirements could also call for
the use of SNMPv2 or CMIP here. If the CMIP protocol is used, a
consideration is required as to which protocol stack it should be used on, i.e.
either the OSI stack (CMIP) or the TCP/IP stack (CMOT).
Furthermore, it must be noted that CMIP and CMOT are presently not
supported by all active network components and network management
systems. Before a CMIP protocol is employed, a detailed check is therefore
required as to whether the components and clients in use are CMIPcompatible.
Additional controls:
- Have the security requirements for the network management system been
formulated and documented?
- Have the active network components and clients been checked for
compatibility with the selected SNMP version or CMIP?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000