IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
The Information Security Policy must be made available to all the staff
affected by it in a suitable form. By this means, Management can ensure that
there is full visibility of the importance of IT security to the organisation.
Full details of this task are provided in S 2.192 Drawing up an Information
Security Policy.
Step 2: Selection and establishment of an appropriate organisational
structure for IT security
If a functioning IT security process is to be established, it is essential that an
appropriate organisational framework is created and that the relevant
responsibilities are delegated. The choice of such an organisational structure
must reflect the size of the agency or company. This should entail
establishment in a suitable manner of an IT Security Management Team
and/or appointment of an IT Security Officer. In addition, responsibilities,
tasks and authorities must be assigned in a systematic manner and notified.
This subject is described in more detail in S 2.193 Establishment of a suitable
organisational structure for IT security.
Step 3: Preparing a schedule of existing IT systems
It is absolutely critical for the IT security concept, which is created in Step 4,
that there is a complete schedule of the IT systems employed in the company
or agency, the IT applications run on them and the data handled thereby. If
such a schedule does not already exist, then it must be drawn up at this stage.
A list of the information that is absolutely essential to the creation of the IT
security concept will be found in S 2.194 Drawing up a schedule of existing IT
systems.
Step 4: Definition of the procedure for drawing up the IT security
concept
To raise IT security to an appropriate level, it is necessary to identify existing
vulnerabilities and to select and implement appropriate IT security measures.
A number of possible procedures for ascertaining vulnerabilities and selecting
appropriate measures are available. These include:
- baseline protection analysis following the recommendations contained in
this manual,
- performing a risk analysis based on the IT Security Manual,
- performing vulnerability analysis in selected areas (e.g. networking) and
- penetration testing.
As well as deciding on the methodical approach, a decision must be made as
to the sequence in which existing IT provision will be examined and to what
extent.
In general it should be noted that standard security measures consistent with
IT baseline protection are also essential to IT systems with a high protection
requirement. A further consideration is that where high security systems are in
use, any standard security measures employed are likely to need to be
supplemented by more stringent measures. When selecting the approach, it
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000