Bauhaus-Universität Weimar: BSI protection on ZDM computers

Processes in research and teaching as well as in administration are increasingly dependent on the secure functioning of information and communication technology. At the same time, the number of potential threats is increasing by leaps and bounds. Bauhaus-Universität Weimar is taking this development into account by implementing the recommendations of the Federal Office for Information Security (BSI). The BSI is the federal government's cyber security authority.

Why BSI protection?

»The BSI's basic IT protection is a proven methodology for raising the level of information security in public authorities and companies of all sizes. The offerings of basic IT protection are considered the benchmark in administration and business when it comes to securing information and setting up an information security management system (ISMS). In this context, basic IT protection is also internationally respected due to its compatibility with ISO 27001.«

The recommendations of the BSI serve to protect against damage and are binding for all processes in which data with a high or very high protection requirement are processed. This also results in changes and restrictions to familiar programs and processes, which we would like to explain to you here.

Main implemented features

A so-called TPM chip is installed in BSI-compliant, administered computers. A Trusted Platform Module (TPM) is a microchip on computers or in electronic devices. It provides basic security functions on a hardware basis and can generate cryptographic keys, store them securely or control their use.
BitLocker encryption: BitLocker is a hard disk encryption that is used on the University's individual computers. BitLocker starts before the operating system and accesses the TPM chip by default.
Add-in protection for Microsoft Office programs: Only defined add-ins can be used in Office products. Add-ins are ready-made functions or macros that can be included in programs and fully integrated into the main program.
Encryption specifications for Microsoft Office programs were implemented according to the specifications of the BSI.
Message format set in Outlook: E-mails are sent and received in plain text by default.

Changes to Microsoft Office programs

General

ActiveX controls disabled

The developer tools are not displayed in Excel, Word and Outlook

Unsigned macros cannot be executed in Microsoft Office programs

Quick launch menu bar and ribbon interface cannot be customised in Office programs

Action	Keyboard shortcut
New empty document	[STRG]+N
Open document	[STRG]+O
Save document	[STRG]+S
Preview and print	[STRG]+P
Spellchecker	[F7]
Show macros	[ALT]+[F8]

Creating forms in Word

Changes to Microsoft Office programs in detail

Word

Excel

Access

E-mails and Outlook

Receive and send mail in »plain text« format

Many e-mails today are sent in HTML format (colored, different fonts, embedded graphics). Malicious code can be hidden in the source code of an HTML-formatted e-mail, which is already executed on the recipient's computer when the e-mail is opened, without having to click on an attachment. Therefore, the SCC has implemented the BSI's recommendation and configured Outlook to send and receive emails in plain text format by default.
For individual e-mails, you can change these default settings as follows.

Show received mails in HTML

Incoming e-mails receive the following notice. (both in the preview and when displayed in the separate window):

If you click on this hint, you can switch to the HTML view:

Sending mails in HTML

If you want to send an HTML e-mail, you can use the key combination »[ALT]-x-ö« (inside the e-mail in Outlook) to change the formatting from plain text to HTML.

Notice: Whether your message is displayed in HTML_ or plain text format depends on the individual settings in the receiving person's mail program.

Alternatively, use the menu on the »Format Text« tab within the e-mail:

Links in received mails are not displayed clickable as URL link

With the conversion of the display of e-mails to text-only format, links to e-mail and Internet addresses (URLs) are also no longer clickable. To access a link, you must copy and paste it into the address bar of your browser. Alternatively, switch the view to HTML as described above.

Exception: In self-composed mails, a URL is linked in the usual way, i.e. with a blue background and clickable.

Publish calendar on the Internet not possible

You can only publish a calendar within your own Exchange structure, i.e. with members of Bauhaus-Universität Weimar. Publishing on other platforms, like a WebDAV server etc., is inactive.

You can still share or even send your calendar via Outlook as well as OWA.

Mails with expired certificates are no longer displayed in Outlook

A digital signature lets you sign documents digitally. A digital signature is an authentication tool that confirms that messages come from a known source and have not been altered during transmission. When a digital signature is properly implemented, the receiving person can assume that the message was sent by the specified sender(s).

If you receive an e-mail with an invalid signature, this message will not be displayed at first, but you will see an empty preview window with the following warning:

If you still want to read the email, double-click the corresponding message (in the list) and another message will be displayed:

Click on »Show message« the mail will be opened for reading.

Blocking mail attachments with potentially dangerous content

Potentially dangerous attachments from external senders are no longer delivered via email. You, as the recipient, will receive the original email, but the system will automatically delete the »suspicious« attachments and attach a txt file informing you of the reason for the deletion.

Potentially dangerous attachments include older Microsoft Office formats (MS Office 2003 or older). With these file types, it is not directly recognizable whether they may contain harmful macros. More information and a list of blocked file formats can be found on the SCC pages under »Blocking e-mail attachments«.

If, in exceptional cases, you need to exchange such files with known, trusted partners*, we recommend using the university cloud at cloud.uni-weimar.de

Changes in Adobe Acrobat products

PDF documents are opened in protected mode

Adobe Acrobat DC: When you need to edit PDFs

Questions, support and contact persons

Do you have any questions or need further information? Please contact us via the SCC user service by mail, phone or ticket.

BSI protection on centrally administered computers (Windows)