IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- Computer viruses are not disseminated further via servers. They can,
however, be spread on the terminals if files are exchanged between them
directly (for example on floppy disk).
Disadvantages:
- This method is susceptible to error: in some circumstances, e-mail
attachments may not all be recognised. Often scanning programs only
check for the presence of attachments within the first few lines of an e-mail
or in the mail header. It can also happen that the procedure with which the
attachment has been processed (e.g. uuencode) is not supported by the
virus scanning program. This is possible with MIME, for example:
problems may arise if one or more files encoded with uuencode are simply
inserted into the body of the e-mail.
- Detrimental effect on performance, because all communication content has
to be checked.
- Only a minimal operating system should be installed on all communication
servers, in other words only the most essential services (see also S 4.??
Minimal operating system).
- In order to avoid denial-of-service attacks, a computer virus scanning
program should never be installed on a firewall – at most on a proxy, if at
all.
Data hygiene and central checking of files
All incoming and outgoing files and data media are checked at a central point
by a computer virus scanning program. In addition, there is a rule that the IT
users must not use any files, programs or data media of doubtful origin.
Advantages:
- The number of licences for computer virus scanning programs that need to
be purchased is considerably reduced.
Disadvantages:
- If external data media are used frequently, central checking for computer
viruses takes up a great deal of time and delays operational procedures. It is
impossible to rule out infection by a computer virus entirely, because
checking of a data medium may be forgotten by mistake.
- All computers which do not have a computer virus scanning program must
be checked for infection by a computer virus at regular intervals.
Regardless of which strategy is chosen for providing protection against
computer viruses, there is always a residual risk that computer virus scanning
programs will only detect those computer viruses that were known at the time
when the program was developed. This means that new viruses may not be
detected and could cause damage.
The choice of correct strategy, which must also be appropriate from the cost
point of view, is dependent on the particular IT environment in each case.
However, in view of the fact that the cost per licence is usually greatly
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000