IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- In Netware version 4.11 and higher, the auditor must receive the necessary
right to the corresponding NDS audit file objects.
- Activate the network auditing function. The person who creates the NDS
audit file object receives the supervisor right for the NDS audit file object
and the right Write for the access control list property. This user also
receives the rights Read and Write for the audit policy property and the
right Read for the audit contents property. The creator of this NDS audit
file object is therefore able to administrate and evaluate the auditing.
- The allocation of a auditor password in the utility
SYS:PUBLIC\AUDITCON.EXE in order to become independent from the
administrator (Netware 4.10 and for reasons of compatibility also in
Netware 4.11).
In Netware version 4.11 and higher, the auditor should be made
independent from the administrator through the allocation of NDS rights. It
can also be determined whether a particular auditor is allowed to view
audit files and/or manage the auditing.
If, for carefully considered reasons, it is not desirable or possible to configure
the role of an independent auditor, the log files can also be evaluated by the
administrator. Should this be the case, it should be pointed out that the
Administrator's activities are difficult to monitor. Consequently, the results of
evaluation should be presented at least to the IT security officer, IT in-charge,
or another specially appointed staff member.
Additional controls:
- Who evaluates the auditing files?
- Can the activities of the administrator be monitored to a sufficient extent?
- Is the IT security management notified of irregularities?
- Has a limit been imposed on the maximum size of the log files in order to
prevent memory shortages?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000