19.12.2012 Views

IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection Manual - The Information Warfare Site

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Safeguard Catalogue - Organisation Remarks<br />

____________________________________________________________________ .........................................<br />

etc.) are connected to the S0 bus or a small PBX is connected on the outgoing<br />

side. It should be possible to set up and operate all connections either with<br />

encryption or without, as required. <strong>The</strong> system configuration is shown in the<br />

illustration below.<br />

Telefon<br />

Fax<br />

Video<br />

PC<br />

Analog TA<br />

Telefon<br />

Fax<br />

Video<br />

PC<br />

S o -Bus<br />

Managment<br />

Station<br />

Analog TA<br />

____________________________________________________________________ .........................................<br />

<strong>IT</strong>-<strong>Baseline</strong> <strong>Protection</strong> <strong>Manual</strong>: Oktober 2000<br />

Int. Management<br />

ISDN-Sicherheitskomponente<br />

NT<br />

NT<br />

ISDN-Netz<br />

NT<br />

Int. Management<br />

ISDN-Sicherheitskomponente<br />

TK-Anlage<br />

NT<br />

NT<br />

V.24<br />

Chipkarte<br />

= Network<br />

Terminator<br />

V.24<br />

Chipkarte<br />

<strong>The</strong> chosen component is an ISDN crypto device that can be protected against<br />

unauthorised use with a chip card. Alternatively there is also a serial V.24<br />

interface available which allows the security component to be configured with<br />

the aid of a PC. <strong>The</strong> user or the end application can control encryption directly<br />

with the chip card or by preselection of a special code number. It is also<br />

possible to configure the ISDN security component in such a way that certain<br />

connections (numbers) are preset as being encrypted or unencrypted. A<br />

management station is connected at a central point of the ISDN network for<br />

the purpose of key management, i.e. the generation and distribution of key<br />

certificates. This ensures that the individual ISDN security components are<br />

registered throughout the network and can be supplied with up-to-date key<br />

material.<br />

<strong>The</strong> possibilities available for the secure transfer of information and data<br />

worth protecting in an ISDN network are varied and complex. Every relevant<br />

basic threat must be met by a specific security measure. In order to guarantee<br />

confidentiality, online encryption of the data stream being transferred is most<br />

effectively performed on the data link layer. To achieve this, the data is<br />

automatically encrypted by crypto hardware before it is transferred, and is<br />

decrypted again at the receiving end. Encryption is entirely transparent for the<br />

end user and for application programs. <strong>The</strong> crypto module that is used not<br />

only allows real-time processing, it also provides a higher level of protection<br />

against attempted attacks in comparison with file encryption (software

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!