Unauthorized Access; Unauthorized Tampering - Netscape DIRECTORY SERVER 6.1 - DEPLOYMENT Deployment Manual

About Security Threats
•

Unauthorized Tampering

• Denial of Service
The remainder of this section provides a brief overview of the most common
security threats to assist you with designing your directory's security policies.

Unauthorized Access

While it may seem simple to protect your directory from unauthorized access, the
problem can in fact be more complicated. There are several opportunities along the
path of directory information delivery for an unauthorized client to gain access to
data.
For example, an unauthorized client can use another client's credentials to access
the data. This is particularly likely when your directory uses unprotected
passwords. Or an unauthorized client can eavesdrop on the information
exchanged between a legitimate client and Directory Server.
Unauthorized access can occur from inside your company, or if your company is
connected to an extranet or to the Internet, from outside.
The scenarios described here are just a few examples of how an unauthorized client
might access your directory data.
The authentication methods, password policies, and access control mechanisms
provided by the Directory Server offer efficient ways of preventing unauthorized
access. Refer to "Selecting Appropriate Authentication Methods," on page 134,
"Designing a Password Policy," on page 139, and "Designing Access Control," on
page 146, for more information about these topics.
Unauthorized Tampering
If intruders gain access to your directory or intercept communications between
Directory Server and a client application, they have the potential to modify (or
tamper with) your directory data. Your directory is rendered useless if the data can
no longer be trusted by clients, or if the directory itself cannot trust the
modifications and queries it receives from clients.
For example, if your directory cannot detect tampering, an attacker could change a
client's request to the server (or not forward it) and change the server's response to
the client. SSL and similar technologies can solve this problem by signing
information at either end of the connection. For more information about using SSL
with Directory Server, refer to "Securing Connections With SSL," on page 154.
130 Netscape Directory Server Deployment Guide • August 2002