IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- Create (only for containers)
- Delete
- Rename
A user with these rights over another NDS object, for example another
user, is able to sequentially browse, create, delete or rename user accounts.
The Supervisor right includes all of the other four rights. The Browse,
Create, Delete and Rename rights do not include any object property rights
or file rights. One exception to this in this special case is the Supervisor
right to an object. This right also incorporates Supervisor rights to the
object properties.
- Object property rights
Object property rights control access by trustees to stored details
concerning an object, i.e. the object properties. No object rights are
required for this. With the exception of the object right Supervisor, rights
to object properties cannot be obtained with object rights. As can be seen in
the above figure, the object property rights are as follows:
- Supervisor
- Compare
- Read
- Write
- Add Self
The object property rights consist of the main rights Write and Read. The
right Read contains the right Compare and the right Write contains the
right Add Self. The supervisor right is the combination of these four rights
and does not have any other effects. With the right Read, object properties
such as the user's properties surname or even the log-in script can be read.
In order to make changes, the right Write is required. The right Compare
allows queries to be made to the NDS, such as if the surname of user XY is
Mustermann. The answer is then either "true" or "false". The right Add Self
is only useful for objects with which users are able to enter themselves in a
list, as is the case for a group. As an object often has numerous properties,
there are two ways of allocating object properties. In principle, it is
possible to allocate the same right for all properties. To do this, the option
All Properties must be selected in the area Property Rights. On the other
hand, it is also possible to allocate specific rights for particular object
properties. This is done using the option Selected Properties. It must be
noted that when the function Selected Properties is used, the rights that
were allocated with the option All Properties are overwritten.
Rights in the NDS must be allocated even more carefully than rights in the
file system. In the file system, an NDS object receives rights to a file or a
directory. In the NDS, however, an NDS object receives rights to another
NDS object. In the process, it must be carefully checked who is actually to
receive the right to who. For example, it may well happen that a user object
is supposed to receive rights to a container object, but the container object
is given rights to a user object.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000