IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
whether these IT systems and this information are very important,
important or less important to task performance.
1.2 Assessment of the captured IT systems and the information to be
handled
This stage involves determining the maximum damage which could
be sustained in the event of loss of the three basic parameters of
availability, integrity and confidentiality by every IT system and by
the information handled thereon. The potential damage can be
classified into various damage scenarios.
These might include:
- violation of laws, regulations or contracts
- impairment of informational self-determination,
- physical injury,
- impaired performance of duties,
- negative consequences for the image and
- financial consequences
Based on the amount of potential damage and the consequences of
this, a distinction is made between two protection requirements
categories:
- basic to moderate
- high to very high
2. Capture of information relating to the current security situation
To determine the current security situation it is necessary to examine the IT
systems in-depth. This should entail collecting information both about
existing security measures and also about security shortcomings
(comparison between planned and actual situation).
3. Selection of IT baseline protection safeguards
For all the IT systems and information under investigation, irrespective of
the protection requirements category to which they have been assigned, the
recommended safeguards contained in the present manual should now be
implemented.
4. Supplementary security analysis
There are a number of reasons for carrying out an IT security analysis. For
example, this can be appropriate where the protection requirement for an
IT system and the information to be handled on it is "high" or "very high",
or where the IT systems concerned have not yet been covered in the IT
Baseline Protection Manual so that no IT baseline protection safeguards yet
exist for them.
In addition to penetration testing and vulnerability analysis for selected
areas, risk analysis is another possible procedure for such an IT security
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000