7.6 Remote Access

Description

Remote access enables a user to log on from a local computer to a remote computer network and use its resources as if a direct LAN link existed. The services used here are known as Remote Access Service (RAS). RAS ensures that remote users can access the network resources.

In general, RAS is used in the following situations:

• to link individual stationary workstations (e.g. so that individual staff can work from home as telecommuters),

• to link mobile computers (e.g. to support staff working in the field or on business trips),

• to link entire LANs (e.g. to link up local networks of remote locations or branch offices),

• management access to remote computers (e.g. for remote maintenance).

RAS offers a simple solution in such scenarios: the remote user establishes a connection with the corporate network e.g. over the telephone network using a modem. This direct connection can exist for as long as is necessary and can be viewed as a leased line which is only active on demand.

Figure: Remote Access to Resources

Establishment of a RAS connection generally requires three components as follows:

1. A computer within the corporate network on which RAS software has been installed and which is ready to accept RAS connections. This is known as the RAS server or access server.

2. A remote computer on which RAS software has been installed and which initiates the RAS connection. This is known as the RAS client.

3. The communication medium over which the RAS connection is established. In most scenarios the RAS client uses a telecommunications network to establish the connection. The very minimum that is required, therefore, is a telephone line and a modem to go with it. Depending on the RAS architecture, different connection technologies can be used server-side.

RAS is implemented as a client/server architecture: the RAS client can be configured so that it automatically establishes the RAS connection when corporate network resources are required by dialling the phone number of the computer on which the RAS server software is installed. Alternatively, the RAS connection can be initiated manually by the user. Some operating systems, e.g. Windows NT, also allow the RAS to be activated immediately following system logon.

There are two basic ways of establishing a connection to the remote LAN (see Safeguard Selection of a suitable RAS system architecture):

1. Direct dial-up to the access server, which in this case is part of the remote LAN;

2. Dial-up to an access server of an Internet Service Provider (ISP) and access to the remote LAN over the Internet.

From the point of view of security, the following security objectives apply to RAS access:

1. Access security. The remote user must be uniquely identified by the RAS system. The identity of the user must be established through an authentication mechanism every time that a connection is established to the local network. In the context of system access, additional control mechanisms must be employed to ensure that system access by remote users is properly controlled (e.g. restricting access to certain times or to permitted remote connection points only).

2. Access control. Once the remote user has been authenticated, the system must be able to restrict the interactions of the user with the system. This requires that the authorisations and restrictions which have been specified for local network resources by authorised administrators are also enforced for remote users.

3. Security of communications. Where local resources are accessed remotely, user data have also to be transmitted over the established RAS connection. In general the security requirements which apply in the local network with regard to protection of communications (confidentiality, integrity, authenticity) must also be implementable for data which is transmitted over RAS connections. However, protection of RAS communications is especially critical since communications can be transmitted using a number of communications media which cannot generally be assumed to be under the control of the operator of local network.

4. Availability. Where remote access is used for mainstream business activities, the availability of RAS access is particularly important. The smooth flow of business processes may be impaired in the event of total failure of RAS access or if connections have insufficient bandwidth. This risk can be reduced to a certain extent through the use of alternative or redundant RAS connections. This applies especially where the Internet is used as the communications medium, as here there are generally no guarantees of either connection or bandwidth.

Threat Scenario

The client/server architecture of RAS systems means that both the RAS client and the RAS server are exposed to specific risks due to the type of operational environment and the manner of use.

• RAS clients do not have to be stationary (e.g. home PC), but can also be mobile (laptops). However, the client location will normally not be under the control of the LAN operator so that, especially where the client is mobile, it must be assumed that the environment is insecure and is exposed to specific threats. In particular, the threats which have to be considered here include physical threats, such as theft or damage. Sections 4.5 Working place at home (telecommuting), 5.3 Laptop PCs and 9.3 Telecommuting should be considered here.

• RAS servers are generally part of the LAN to which remote users wish to log on. They are under the control of the LAN operator and can therefore be covered by the security provisions which apply locally. As the main task of the RAS server is to ensure that only authorised users can access the connected LAN, the threats to which the RAS server is exposed should be viewed as falling within the area of attacks where the objective is unauthorised access to the LAN.

At this point we advise against considering the dangers to the client and server completely separately since, for example, if a RAS client were to be compromised, the RAS server would automatically be endangered. Moreover it should be borne in mind that, for example in the Windows environment, every RAS client can also be operated as a RAS server, so that the threats which apply to RAS servers apply equally to a RAS client.

The following typical threats are assumed for the IT baseline protection of a RAS system:

Force Majeure

Organisational Shortcomings

Human Error

Technical Failure

Deliberate Acts

Recommended Countermeasures (S)

To implement IT baseline protection, selection of the required packages of safeguards ("modules"), as described in Sections 2.3 and 2.4, is recommended.

A RAS system consists of several components which from the outset should be protected as individual components. Quite apart from the RAS functionality, these should be viewed as normal IT systems or network switching elements which need to be protected according to the suggestions made in the relevant safeguard modules. RAS servers are computers which are normally fully under the control of an organisation and perform the important task of controlling access to the internal network. The RAS functionality is generally superimposed on an operating system which in most cases offers additional services as well. Hence the security of RAS access also depends on there being no security weaknesses either at operating system or service level.

As well as protecting the RAS system components, however, it is also necessary to draw up a RAS security policy which must be integrated into the existing security policy. At the same time as implementing existing security requirements, the RAS system requires that new, RAS-specific security rules are defined.

A RAS system will generally be used in the environment of other systems which serve to control access to the internal network from outside. Examples of other systems with which a RAS system has to work are firewall systems and remote maintenance systems. For this reason, when implementing the RAS-specific safeguards, the safeguards from the relevant modules of the affected systems must also be considered. The modules which should be considered include:

• 4.5 Working place at home (telecommuting)

• 7.3 Firewalls

• 8.1 Private branch exchanges

• 9.3 Telecommuting

Secure RAS access depends on a series of safeguards being taken, starting at the design stage, and then moving on to procurement and operation. The steps involved here and the safeguards which should be considered at each of the steps are listed below.

The safeguards package for the "Remote Access" module is presented below.

Infrastructure

Organisation

Personnel

Hardware and software

Communication

Contingency Planning