IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
- Zone model
The BSI has developed a zone model which takes account of the
propagation conditions of compromising emanations in relation to
particular conditions in certain buildings and on certain sites. The
attenuation of the radiation on its way from the originating IT device to the
potential receiver is determined by metrological means. Depending on the
circumstances at the place of use, it may be possible to use devices to
which only minor interference suppression measures have to be applied, or
no measures at all.
- Emanation suppression at source
Emanation suppression at source is particularly valuable when developing
new IT products. This involves suppressing the compromising emanations
at their place of origin within the device, or modifying them in such a way
that they can no longer be utilised. This method might also allow the use of
low-cost plastic housings, for example, with a negligible impact on the
batch production price.
- Set of radiation criteria
The purpose of a detailed set of radiation criteria is the graduated testing of
IT devices and systems The rationale behind this concept is to adapt the
scope of the protection measures as closely as possible to the threat
situation assumed to exist by the user, so as in that way to achieve an
optimum of emission security with the minimum of cost.
- Accelerated measurement procedures
Devising accelerated measurement procedures and manipulation test
procedures enables emission security to be ensured at as low a cost as
possible after maintenance, repair or potentially unauthorised access.
- Use of low-emission or emission-protected equipment
Manufacturers of PC monitors often make use of the term "low-emission"
according to MPR II, TCO or SSI in their advertising material. However,
these guidelines only take account of the possible damaging effects to
health of radiation from equipment. The measuring techniques and limit
values for radiation are therefore entirely unsuited to producing evidence of
compromising emanations and do not allow any assessment to be made of
security against the unauthorised interception of data via compromising
emanations.
In addition, special emission-protected IT systems are also offered by some
suppliers. There are numerous levels of emission protection provided in
this field. In order to allow the classification of IT systems with high
protection requirements, in particular, the BSI developed a set of criteria
known as TEMPEST (Temporary Emission and Spurious Transmission)
criteria. Whether a manufacturer includes emission protected devices
conforming to the TEMPEST criteria in its range of products should be
clarified by asking the manufacturer or the BSI, or by checking the official
product overview in BSI 7206. The statement that a device has been
awarded TEMPEST approval should always be accompanied by indication
of the level of approval.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000