APP.2.1 General Directory Service

Introduction

A data network's directory service provides information on various types of objects in a defined manner. Associated attributes can be stored in an object—the first and last name, personnel number, and the name of the IT system pertaining to a particular user ID, for example. This data can then be used by various applications. A directory service and its data are normally administered from a central location.

Some typical areas of application of directory services include:

Administration of address books, e.g. for telephone numbers, e-mail addresses, and certificates for electronic signatures
Resource administration, e.g. for IT systems, printers, scanners, and other peripheral devices
User administration, e.g. for user accounts and user authorisations
Authentication, e.g. for logging into operating systems or applications

Directory services are optimised for read-only access because data is typically retrieved. Write access for creating, changing, or deleting entries is needed less often.

This type of directory service is especially useful in networks where the number of clients used in the network makes local administration difficult, for example. Without a directory service, it would no longer be possible to ensure that local settings, such as those pertaining to security policies, are being configured reliably due to the considerable effort involved. Administrative tasks within a network—changing passwords, creating accounts, and assigning access rights, for instance—can also be performed more efficiently using a directory service.

Objective

The objective of this module is to ensure the secure operation of general directory services and the appropriate protection of information processed using such services.

Scoping and Modelling

Module APP.2.1 General Directory Service must be applied to all directory services used.

This module examines general security aspects of directory services. The IT-Grundschutz Compendium includes additional modules for product-specific security aspects that should also be applied to the particular directory service in use. Modules on the server operating systems on which directory services are usually operated can be found in the layer SYS.1 Servers.

Directory services should always be included as part of the modules ORP.4 Identity and Access Management, OPS.1.1.3 Patch and Change Management, CON.3 Backup Concept, OPS.1.2.2 Archiving, OPS.1.1.5 Logging, and OPS.1.1.2 Proper IT Administration.

Useful Resources

No further information is available for module APP.2.1 General Directory Service.

1. Ħarsa ġenerali

Titlu	Standard
APP.2.1.A1 Creation of a Security Policy for Directory Services (B)	A security policy MUST be drawn up for the directory service. This policy SHOULD be in agreement with the organisation’s overall security concept.
APP.2.1.A2 Planning the Use of Directory Services [Data Protection Officer, Process Owner] (B)	The use of directory services MUST be planned carefully. The specific use of the directory service MUST be defined. It MUST be ensured that the directory service and all applications using it are compatible. In addition, a model consisting of object classes and attribute types MUST be developed that meets the requirements of the intended types of use. When planning the directory service, Employee Representatives and the Data Protection Officer MUST be involved. A needs-based access control policy MUST be designed for the directory service. In general, the planned directory service structure SHOULD be fully documented. Safeguards SHOULD be planned to prevent the unauthorised collection of data from the directory service.
APP.2.1.A3 Setting Up Access Authorisations for Directory Services [Process Owner] (B)	The tasks pertaining to the administration of the directory service itself and to the actual data administration MUST be clearly separated. The administrative tasks SHOULD be delegated such that overlap is avoided whenever possible. All administrative task areas and authorisations SHOULD be sufficiently documented. The data access rights of the user and administrator groups MUST be configured and implemented based on the established security policy. If several directory service trees are merged, the resulting effective rights MUST be verified.
APP.2.1.A4 Secure Installation of Directory Services (B)	An installation concept MUST be drawn up in which administration and access authorisations will already be configured when installing the directory service.
APP.2.1.A5 Secure Configuration and Configuration Changes in Directory Services (B)	The directory service MUST be configured securely. In addition to the server, the clients (IT systems and programs) MUST be included in the secure configuration of a directory service infrastructure. If the configuration of the connected IT systems is to be changed, users SHOULD be informed in good time about the corresponding maintenance work. Backups SHOULD be performed for all affected files and directories prior to any changes to the configuration.
APP.2.1.A6 Secure Operation of Directory Services (B)	The security of the directory service MUST be maintained constantly during operation. All policies, regulations, and processes related to the operation of a directory service system SHOULD be documented. The workstations of directory service administrators MUST be sufficiently secured. Normal users MUST be prohibited from accessing any administration tools.
APP.2.1.A7 Drawing Up a Security Concept for the Use of Directory Services (S)	The directory service security concept SHOULD specify rules for all the relevant topic areas. The security policies developed on this basis SHOULD be documented in writing and communicated to directory service users.
APP.2.1.A8 Planning of Partitioning and Replication in the Directory Service (S)	The availability and protection needs of the directory service SHOULD be taken into account during partitioning. The partitioning of the directory service SHOULD be documented in writing so that it can be reconstructed manually. Sufficient bandwidth SHOULD be made available to perform replication in a timely manner.
APP.2.1.A9 Selection of Suitable Components for Directory Services [Process Owner] (S)	Suitable components SHOULD be selected for the use of a directory service. A catalogue of criteria SHOULD be drawn up and used as a basis for selecting and acquiring components for the directory service. As part of the planning and design of the directory service, requirements for its security SHOULD be formulated in accordance with its intended use.
APP.2.1.A11 Setting Up Access to Directory Services (S)	Access to a directory service SHOULD be configured according to the security policy at hand. If the directory service is used as a server on the Internet, it SHOULD be protected accordingly by a security gateway. If anonymous users are to be granted extended access rights to individual sub-areas of the directory tree, a separate user account (known as a proxy user) SHOULD be created for anonymous access. The access rights for this proxy user SHOULD be assigned in a sufficiently restrictive manner. They SHOULD also be removed completely if the account is no longer needed. To avoid inadvertently releasing sensitive information, the search function of the directory service SHOULD be appropriately limited in accordance with its intended purpose.
APP.2.1.A12 Monitoring Directory Services (S)	Directory services SHOULD be monitored and logged together with the server on which they are running.
APP.2.1.A13 Protection of Communications with Directory Services (S)	All communications with a directory service SHOULD be encrypted using SSL/TLS. The communication endpoint of the directory service server SHOULD NOT be reachable from the Internet. Exchanges of data between clients and the directory service server SHOULD be secured. The data that may be accessed SHOULD be defined. To protect the service entries in a service registry in the case of a service-oriented architecture (SOA), all requests sent to the registry SHOULD be checked to see if the user is valid.
APP.2.1.A14 Orderly Decommissioning of a Directory Service [Process Owner] (S)	When decommissioning a directory service, it SHOULD be ensured that the required rights and information continue to be sufficiently available. All other rights and information SHOULD be deleted. Furthermore, the users affected SHOULD be informed when a directory service is being decommissioned. When decommissioning individual partitions of a directory service, it SHOULD be ensured that no other partitions will be affected.
APP.2.1.A15 Migration of Directory Services (S)	In the event of a scheduled migration of directory services, a migration concept SHOULD be drawn up beforehand. The changes that have been made to a directory service scheme SHOULD be documented. Any extensive authorisations that were used to perform the directory service migration SHOULD be reset. The access rights for directory service objects on the systems that were updated to a new version or were obtained from other directory systems SHOULD be updated.
APP.2.1.A16 Creation of a Business Continuity Plan for Directory Service Failure (H)	Within the framework of contingency planning, there SHOULD be a need-based business continuity plan for directory services. Business continuity plans SHOULD be in place in case important directory service systems fail. All contingency procedures for the overall system configuration of directory service components SHOULD be documented.

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti
Sors	Rekwiżit

3. Regolamenti relatati

Regolamenti
Sors	Regolamentazzjoni

Kwistjonijiet marbuta

Links
Tip ta’ link	Kwistjoni
includes	APP.2.1.G1. Inadequate Planning of the Use of Directory Services
includes	APP.2.1.G2. Inadequate Planning of Partitioning and Replication in the Directory Service
includes	APP.2.1.G3. Inadequate Planning of Directory Service Access
includes	APP.2.1.G4. Incorrect Administration of System and Data Access Rights
includes	APP.2.1.G5. Errors in the Configuration of Directory Service Access
includes	APP.2.1.G6. Failure of Directory Services
includes	APP.2.1.G7. Infiltration of Directory Services due to Unauthorised Access
includes	APP.2.1.G8. Improper Configuration of Directory Services

BSI -
Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)