IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
1 Finding Your Way Around the
IT Baseline Protection Manual
1.1 IT Baseline Protection: the Aim, Concept and Central Idea
The IT Baseline Protection Manual presents a set of recommended standard security measures or
"safeguards", as they are referred to in the manual, for typical IT systems. The aim of these IT baseline
protection recommendations is to achieve a security level for IT systems that is reasonable and
adequate to satisfy normal protection requirements and can also serve as the basis for IT systems and
applications requiring a high degree of protection. This is achieved through the appropriate application
of organisational, personnel, infrastructural and technical standard security safeguards.
To facilitate structuring and processing of the highly heterogeneous area of IT, including the
operational environment, the IT Baseline Protection Manual is structured in a modular fashion. The
individual modules reflect typical areas in which IT assets are employed, for example client/server
networks, buildings, communications and application components Every module begins with a
description of the typical threats which may be expected in the given area together with their assumed
probability of occurrence. This "threat scenario" provides the basis for generating a specific package
of measures from the areas of infrastructure, personnel, organisation, hardware, software,
communications and contingency planning. The threat scenarios are presented in order to create
awareness, and are not required any further for the creation of a security concept which affords IT
baseline protection. It is not necessary for users to perform the analysis work mentioned above, which
requires considerable effort, in order to attain the security level that is needed for an average
protection requirement. On the contrary, it is sufficient to identify the modules which are relevant to
the IT system or IT assets under consideration and to implement all the safeguards recommended in
those modules in a consistent manner.
Using the IT Baseline Protection Manual, it is possible to implement IT security concepts simply and
economically in terms of the resources required. Under the traditional risk analysis approach, first of
all the threats are identified and assigned a likelihood of occurrence, and the results of this analysis are
then used to select the appropriate IT security measures, following which the remaining residual risk
can be assessed. The approach adopted in the IT Baseline Protection Manual on the other hand
requires only that a target versus actual comparison is performed between the recommended measures
and those already implemented. The security shortcomings which need to be eliminated through
adoption of the recommended measures are defined in terms of those security measures identified
which are lacking and not yet implemented. Only where the protection requirement is significantly
higher is it necessary to also carry out a supplementary security analysis, weighing up the costeffectiveness
of implementing additional measures. However, it is generally sufficient here to
supplement the recommendations made in the IT Baseline Protection Manual with appropriate tailored
and more stringent measures.
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000
Info / Contacts
Objectives / Concepts
Application
Structure / Interpretation