IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components Crypto-concept
_________________________________________________________________________________________
Organisational shortcomings:
- T 2.1 Lack of, or insufficient, rules
- T 2.2 Insufficient knowledge of requirements documents
- T 2.4 Insufficient monitoring of IT security measures
- T 2.19 Inadequate key management for encryption
Human Failure:
- T 3.1 Loss of data confidentiality/integrity as a result of IT user error
- T 3.32 Violation of basic legal conditions for the use of cryptographic procedures
- T 3.33 Improper use of cryptomodules
Technical Failure:
- T 4.22 Software vulnerabilities or errors (here: poor encryption methods)
- T 4.34 Failure of a cryptomodule
- T 4.35 Insecure cryptographic algorithms
- T 4.36 Mistakes in encoded data
Deliberate Acts:
- T 5.81 Unauthorised use of a cryptomodule
- T 5.82 Manipulation of a cryptomodule
- T 5.83 Compromising cryptographic codes
- T 5.84 Forged certificates
Recommended Countermeasures (S)
For the implementation of IT baseline protection, selection of the required packages of safeguards
("modules"), as described in chapters 2.3 and 2.4, is recommended.
For cryptographic procedures essentially the following additional steps have to be taken:
1. Develop a crypto-concept (see S 2.161)
The use of cryptographic procedures is determined by a large number of influencing factors. These
factors include the IT system, the volume of data, the desired level of protectionn and the demands
on availability. For this reason, a concept should first be developed which takes into account all
influencing factors and criteria which determine the choice of a particular cryptographic procedure
and the corresponding products. At the same time, this concept should be economically feasible.
2. Determine the requirements that the cryptographic procedure has to meet
A requirement catalogue must be created which describes the influencing variables and the
decision criteria on which the use of cryptographic procedures are based (see S 2.162 Determining
the need to use cryptographic procedures and products and S 2.163 Determining the factors
influencing cryptographic procedures and products). Cryptographic procedures can be used on the
various layers of the ISO/OSI model. According to the specified demands or threats, it is
recommended to use the procedure on particular layers (see also S 4.90 Use of cryptographic
procedures on the various layers of the ISO/OSI reference model).
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000