IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
Multiple protection on various OSI layers
There is no objection to multiple protection of the transmitted information on
different layers of the OSI model, provided certain rules are observed. In
products that conform to the relevant standards, though, this is implicitly
guaranteed. Especially with regard to encryption, it is necessary to apply
bracket rules, familiar from school. Accordingly, encryption corresponds to
opening a bracket, and decryption to closing a bracket. Between these brackets
it is possible, in turn, to apply additional security mechanisms.
Multiple protection can also have a detrimental effect, in that data throughput
may be reduced as a result of additional operations or that the amount of user
data that can be transmitted is smaller, for the same reason, or that additional
data has to be transmitted in order to increase redundancy (for example
cryptographic checksums). Multiple protection is also obtained implicitly if
data is secured by means of crypto systems before it is transferred, for
example in the case of digitally signed documents. This increases the security
of the data transfer with respect to the security services used.
Often it is only possible to ensure the security of an entire system by
combining several security protocols or security products. If, for example,
application-oriented security solutions are available but the trustworthy
implementation of these solutions has not been (independently) scrutinised
(e.g. by evaluation according to ITSEC or CC), and at the same time there are
trustworthy transport-oriented security products available for protecting
insecure network sections between remote properties, it may be possible to
create an overall security solution to satisfy the requirements by combining
the safeguards. Usually the increased administration expenditure and/or higher
procurement costs prove disadvantageous in such cases.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000