6.1 Server-supported network

Description

Here, we deal with a local network with at least one server. The clients can be PCs with or without a hard disk (as described in chapter 5.1), also Unix-workstations or terminals. This chapter offers an overview of the typical threats and IT security safeguards for a local network. However, the overview does not take the network operating system or the client's operating system into account. In this context, please refer to the supplementary chapters of the IT-baseline protection manual (e.g. chapter 6.2 Networked Unix systems).

Threat Scenario

The following typical threats (T) are assumed as regards IT baseline protection of a server-supported network:

Force Majeure:

• T 1.1 Loss of personnel
• T 1.2 Failure of the IT system
• T 1.4 Fire
• T 1.5 Water
• T 1.8 Dust, soiling

Organisational Shortcomings:

• T 2.7 Unauthorised use of rights
• T 2.9 Poor adjustment to changes in the use of IT
• T 2.32 Inadequate line bandwidth

Human Failure:

• T 3.2 Negligent destroying of equipment or data
• T 3.3 Non-compliance with IT security measures
• T 3.5 Inadvertent damaging of cables
• T 3.6 Hazards posed by cleaning staff or outside staff
• T 3.8 Improper use of the IT system
• T 3.9 Improper IT system administration
• T 3.31 Unstructured data organisation

Technical Failure:

• T 4.1 Disruption of power supply
• T 4.6 Voltage variations / overvoltage / undervoltage
• T 4.7 Defective data media
• T 4.8 Discovery of software vulnerabilities
• T 4.10 Complexity of access possibilities to networked IT systems

Deliberate Acts:

• T 5.1 Manipulation/destruction of IT equipment or accessories
• T 5.2 Manipulation of data or software
• T 5.4 Theft
• T 5.7 Interception of lines
• T 5.8 Manipulation of lines
• T 5.9 Unauthorised use of IT systems
• T 5.18 Systematic trying-out of passwords
• T 5.19 Abuse of user rights
• T 5.20 Misuse of administrator rights
• T 5.21 Trojan Horses
• T 5.23 Computer viruses
• T 5.24 Replay of messages
• T 5.25 Masquerade
• T 5.26 Analysis of the message flow
• T 5.27 Repudiation of a message
• T 5.28 Denial of services
• T 5.43 Macro viruses

Recommended Countermeasures (S)

For the implementation of IT baseline protection, selection of the required packages of safeguards ("modules") as described in chapters 2.3 and 2.4, is recommended.

In the following, the safeguard group "Server-supported Network" is presented.

It is required that the server be located in either a server room (see chapter 4.3.2) or a protective cabinet (see chapter 4.4). The safeguards to be implemented for the network operating system are contained in the supplementary chapters of the manual. This also applies to connected clients.

In addition, the following measures will have to be taken:

Infrastructure:

• S 1.28 (2) Local uninterruptible power supply [UPS] (optional)
• S 1.29 (3) Adequate siting of an IT system (optional)
• S 1.32 (1) Adequate siting of the consoles, devices with exchangeable data media, and printers

Organisation:

• S 2.3 (2) Data media control
• S 2.4 (2) Maintenance/repair regulations
• S 2.9 (2) Ban on using non-approved software
• S 2.10 (3) Survey of the software held
• S 2.13 (2) Correct disposal of resources requiring protection
• S 2.22 (2) Escrow of passwords
• S 2.25 (1) Documentation on the system configuration
• S 2.26 (1) Designation of an administrator and his deputy
• S 2.30 (2) Provisions governing the designation of users and of user groups
• S 2.31 (2) Documentation on authorised users and on rights profiles
• S 2.32 (3) Establishment of a restricted user environment (optional)
• S 2.34 (2) Documentation on changes made to an existing IT system
• S 2.35 (2) Obtaining information on security weaknesses of the system
• S 2.38 (2) Division of administrator roles in PC networks
• S 2.138 (2) Structured data storage

Personnel:

• S 3.4 (1) Training before actual use of a program
• S 3.5 (1) Education on IT security measures
• S 3.10 (1) Selection of a trustworthy administrator and his substitute
• S 3.11 (1) Training of maintenance and administration staff

Hardware/Software:

• S 4.1 (1) Password protection for IT systems
• S 4.2 (1) Screen lock
• S 4.3 (2) Periodic runs of a virus detection program
• S 4.7 (1) Change of preset passwords
• S 4.15 (2) Secure log-in
• S 4.16 (2) Restrictions on access to accounts and/or terminals
• S 4.17 (2) Blocking and erasure of unneeded accounts and terminals
• S 4.24 (2) Ensuring consistent system management
• S 4.44 (2) Checking of incoming data for macro viruses

Communications:

• S 5.6 (1) Mandatory use of a network password
• S 5.7 (1) Network management
• S 5.8 (1) Monthly security checks of the network
• S 5.9 (2) Logging at the server
• S 5.10 (1) Restrictive granting of access rights
• S 5.13 (1) Appropriate use of equipment for network coupling

Contingency Planning:

• S 6.20 (2) Appropriate storage of backup data media
• S 6.21 (3) Backup copy of the software used
• S 6.22 (2) Sporadic checks of the restorability of backups
• S 6.25 (1) Regular data backup
• S 6.31 (2) Procedural patterns following a loss of system integrity
• S 6.32 (1) Regular data backup