Background
The Libraries Australia Cataloguing Client is used by libraries around Australia to contribute records to the Australian National Bibliographic Database at the National Library of Australia. In 2005,the Client replaced a client which had been used since 1998. The Client uses a proprietary PICA3 protocol. A security assessment has been prepared for the National Library of Australia by a security expert to ensure that all security issues could be assessed and information provide to libraries. This document summarises the findings of the assessment.
Installation Information
1. Application Installation
The changes made to the user’s desktop/laptop computer during the Libraries Australia Cataloguing Client installation process are listed below:
1.1 File System Changes
The Libraries Australia Cataloguing Client installs files in the following locations:
- C:\Program files\LACC
- C:\Documents and Settings\%User%\Start Menu\Programs\Libraries Australia Cataloguing Client
The figure below shows the sub-directories created in the LACC directory: 
1.2 Registry Changes
The application adds and writes values to the following Registry Key locations:
- HKEY_CLASSES_ROOT\Interface\
- HKEY_CLASSES_ROOT\TypeLib\
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\
- HKEY_CURRENT_USER\Software\OCLCPica\WinIBW30\Settings
- HKEY_CURRENT_USER\Software\OCLCPica\WinIBW30\Software\Pica\WinIBW30
1.3 Uninstall the Application
The Libraries Australia Cataloguing Client has an Uninstall process and is used to remove the application from the file system and the registry.
2. Application Operation
2.1 File Access
The Libraries Australia Cataloguing Client accesses the following files:
- C:\Program Files\LACC
- C:\WinNt\Fonts
2.2 Registry Access
The Libraries Australia Cataloguing Client performs OpenKey and QueryValue registry operations. With the exception of the installation process, no functions performed SetValue or CreateKey operations.
2.3 Application Conflicts
The Libraries Australia Cataloguing Client does not conflict or impact with any other systems or applications running on the desktop. The Libraries Australia Cataloguing Client utilises minimal memory resources.
2.4 Exploits
The Libraries Australia Cataloguing Client does not open any inbound listening ports.
Assessment
The Libraries Australia Cataloguing Client was tested using the following methodology:
- Measurement of registry changes, file system changes and network activity when installing the client.
- Development of a test plan.
- Testing using the test plan.
- Measurement at each stage of the test plan.
- Analysis of data captured.
Assessment Findings
- Registry changes: The Libraries Australia Cataloguing Client did not conflict or impact with any other systems or applications running on the desktop. The Libraries Australia Cataloguing Client utilised minimal memory resources during the testing.
- Application installation, vulnerability assessment: Application installation of files was assessed as VERY LOW risk rating. Application addition of entries into the registry was assessed as VERY LOW risk rating.
- Network communication, client side communication: Application requires outbound TCP session to server on port 1521 (production system) and port 1840 (training system). This was assessed as LOW – MEDIUM risk rating. Three mitigation strategies were recommended: establishing an outbound firewall rule on port 1521 to192.102.239.210 (production) and port 1840 to 192.102.239.207(training); establishing this from specific workstations; and, maintaining a log of events. This was assessed as a LOW risk rating.
- The Application also requires an outbound session to {insert production URL/IP} on port 80. This was assessed as a LOW risk rating.
The National Library has ensured that all security risks for the Libraries Australia Cataloguing Client users are low and will ensure that risks are reviewed regularly by a qualified external organisation.
Any library which requires further information or discussion should contact the Help Desk.
