IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.184 Development of a RAS concept
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Head of IT Section, Administrator
Establishment of a RAS system requires that a RAS concept is developed after
the requirements analysis has been performed (see safeguard S 2.183
Performing a RAS requirements analysis) and prior to technical
implementation of the system. Essentially the concept specifies what RAS
system architecture should be chosen and what rules should apply to use of the
RAS system for all those concerned. The concept can be roughly broken down
into three sub-areas.
1. The organisational concept. This covers all matters which are of interest to
the organisation in relation to the RAS system. Care should be taken to
ensure that the RAS system is integrated into existing organisational
processes so that their homogeneity and consistency are preserved.
2. The technical concept. This specifies the technical implementation of the
RAS system. The technical concept should cover the requirements which
have been identified during the requirements analysis and, as far as is
implementable, it should accommodate all the access scenarios that will be
necessary. With regard to technical planning, the existing technical
situation must be considered in order to avoid any technical
incompatibilities.
3. The security concept. This covers the security-relevant aspects of the RAS
system. As security can generally only be assured through a combination of
organisational and technical safeguards, the security concept should be
specified separately and not just constitute a subsection within the
organisational and technical concepts.
The essential questions which need to be answered in connection with each of
the sub-areas are listed below. Depending on the particular situation, there
may be a special, additional need for co-ordination that is tailored to the
particular organisational and technical circumstances.
The organisational concept should address the following points:
- The various responsibilities for the RAS system should be specified
(installation, administration, review, monitoring). Depending on the
organisational structure, this will either require the responsibilities
associated with existing roles to be extended or new roles to be created (see
also safeguard S 2.1 Specification of responsibilities and of requirements
documents for IT uses).
- Binding rules as to which users should be allowed remote access over the
RAS system should be specified. It is recommended that different groups
with different access authorisations should be defined for RAS access as
well. The groups to which individual users may belong should be
controlled through an appropriate requirements profile which determines
what conditions must be satisfied in order to acquire membership of a
group. These conditions might include necessity (teleworkers, staff
working out in the field), length of service and approval from the line
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Organisation
Technology
IT Security
Definition of
responsibilities
Authorisation concept