G 0.30 Unauthorized Use or Administration of Equipment and Systems

Without appropriate mechanisms for access control, entry control, and authorization control, unauthorized use of equipment and systems can practically not be prevented or detected. For IT systems, the fundamental mechanism is the identification and authentication of users. But even with IT systems that have strong identification and authentication functions, unauthorized use is conceivable if the appropriate security credentials (passwords, smart cards, tokens, etc.) fall into the wrong hands. Many errors can also be made in the allocation and maintenance of authorizations, for example, if authorizations are too extensive or granted to unauthorized persons or not updated in a timely manner.

Unauthorized persons can access confidential information, carry out manipulations, or cause disruptions through unauthorized use of equipment and systems.

A particularly important special case of unauthorized use is unauthorized administration. If unauthorized persons change the configuration or operating parameters of hardware or software components, this can result in serious damage.

Example:

• While reviewing log data, IT operations discovered initially unexplained events that had occurred on different days but often in the early morning and afternoon. Upon closer investigation, it turned out that a WLAN router was insecurely configured. Waiting persons at the bus stop in front of the company building had used this access to surf the Internet with their mobile devices while waiting.