8.3 Answering machine

Description

This chapter deals with answering machines which, in addition to telephones, can be connected to the local telephone network in the building. They normally serve to record incoming calls or messages in the form of speech in case the called party is not personally available. These devices differ in terms of recording techniques: fully analogue, fully digital and a combination of analogue/digital. Particularly the currently widespread remote inquiry feature makes it recommendable to consider answering machines as IT systems and carries considerable threat potential.

Threat Scenario

The following typical threats are assumed for answering machines as part of IT baseline protection:

Force Majeure:

• T 1.8 Dust, soiling

Organisational shortcomings:

• T 2.1 Lack of, or insufficient, rules
• T 2.5 Lack of, or inadequate, maintenance
• T 2.6 Unauthorised admission to rooms requiring protection

Human Failure:

• T 3.15 Improper use of answering machines

Technical Failure:

• T 4.1 Disruption of power supply
• T 4.18 Discharged or fatigued emergency power supply in answering machines
• T 4.19 Information loss due to exhausted storage medium

Deliberate Acts:

• T 5.36 Deliberate overloading of answering machines
• T 5.37 Determining access codes
• T 5.38 Misuse of remote inquiry

Recommended Countermeasures (S)

For the implementation of IT baseline protection, selection of the required packages of safeguards ("modules") as described in chapters 2.3 and 2.4, is recommended.

The safeguards package for an "Answering Machine" is presented in the following.

Infrastructure:

• S 1.23 (3) Locked doors (optional)
• S 1.29 (3) Adequate siting of an IT system (optional)

Organisation:

• S 2.4 (3) Maintenance/repair regulations (optional)
• S 2.11 (2) Provisions governing the use of passwords (security codes in this case)
• S 2.54 (1) Procurement/selection of suitable answering machines
• S 2.55 (1) Use of a security code (optional)
• S 2.56 (1) Avoidance of confidential information on answering machines
• S 2.57 (2) Regular playback and deletion of recorded messages
• S 2.58 (3) Limitation of message time (optional)

Personnel:

• S 3.16 (2) Briefing personnel on the operation of answering machines

Hardware/Software:

• S 4.38 (1) Deactivation of unnecessary service features
• S 4.39 (3) Deactivation of answering machines for periods of absence (optional)

Contingency Planning:

• S 6.40 (3) Regular battery checks/replacements (optional)