IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- How can I tell if a security-relevant incident has occurred and what should
I do?
- How can I educate and inform myself in matters of IT security?
Depending on the type and depth of IT use, additional topics should be
included for particular target groups, for example:
- secure electronic communication,
- security aspects of particular IT systems and applications,
- secure software development and
- drawing up and audit of IT security concepts.
In each case it is necessary to check which subjects can be handled by inhouse
staff and which ones would be better dealt with through external
courses. External courses are especially necessary for fields of work where IT
penetration and complexity are high, and for the training of staff who will be
responsible for IT security, whose training is particularly critical.
Due to the speed at which IT changes, knowledge previously acquired rapidly
becomes out of date. New IT systems, and also new threats, vulnerabilities
and possible defensive measures make it imperative that knowledge of IT
security matters is continually refreshed and extended. Training provision on
these matters should therefore not be directed solely at new staff but refresher
and supplementary courses should be provided at regular intervals for
experienced IT users as well. With this in mind, it is important that the
training concepts are updated regularly and modified to new circumstances as
necessary.
To keep training knowledge constantly updated it is important to closely coordinate
training courses and measures aimed at promoting awareness of IT
security issues (see also S 2.198 Making staff aware of IT security issues).
Thus, for example, training courses should refer to existing information
sources and especially to the possibilities available for further private study
(self-study courses, books etc). An example of a target group-specific training
concept will be found on the CD-ROM (see appendix on Additional Aids, in
German only).
Additional controls:
- Are written IT and IT security training concepts available for all IT user
groups in the organisation?
- Is the IT Security Management Team involved in the planning and delivery
of IT training?
- Do update plans exist for training concepts and are these adhered to?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Specific content
Selection of suitable
lecturers
Updating of knowledge
Training and security
awareness