IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
should be noted that little prior knowledge is needed to implement the
methodology used to establish baseline IT protection. On the other hand, a
high level of specialist knowledge is needed for detailed risk analyses, and
especially to identify vulnerabilities and safeguards that will protect against
them.
The BSI therefore recommends that any baseline IT protection safeguards
which are not already in place should be implemented for all IT systems and
that, in parallel, a detailed security analysis should be performed for those
elements which require a high level of protection. In this way, a
comprehensive level of IT security can be achieved in a relatively short time,
so that even during the transition period up to the point where the detailed
security analyses have been completed any IT systems which have a high
protection requirement will have a certain degree of protection.
The procedure to be followed in drawing up a security concept is described in
detail in S 2.195 Drawing up an IT security concept.
Step 5: Implementation of IT security measures
The implementation of the IT security measures identified during the process
of drawing up the IT security concept must be organised and specified in an
implementation plan. This will serve as a planning tool when it comes to coordinating
implementation of the measures and as a control instrument to be
used during actual implementation. All the actions and responsibilities
necessary to update or implement security measures should be specified in
writing in this plan.
Once implementation is complete, it is necessary to establish in every case
whether all the measures have been implemented in accordance with plan and
"work" as intended. During testing of the effectiveness of these measures, it
may be sufficient to perform spot checks in previously determined areas.
The procedure to be followed in preparing an implementation plan for IT
security measures and their implementation is described in S 2.196
Implementation of the IT security concept in accordance with an
implementation plan.
Step 6: IT security in ongoing operations
In order that an IT security concept can be effective in everyday operations, it
is necessary that all employees of a company or agency correctly implement
the measures which affect them, identify any remaining vulnerabilities and
play an active role in eliminating these. This requires that all staff receive
adequate training on IT security issues and that steps are taken to ensure that
their awareness of the risks and of the possibilities for improvement during
ongoing operations is built up and continually enhanced. These points are also
essential to staff acceptance of the IT security measures.
Safeguards S 2.197 Drawing up a training concept for IT security and
M 2.198 Making staff aware of IT security issues present principles and
possible approaches for achieving this objective.
Step 7: Maintaining secure operations
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000