IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
Annexes
The last section of the manual contains supplementary aids, forms, brief descriptions of tools covering
all aspects of IT baseline protection and a list of registered users of the manual.
Interpretation of the manual
The modules, which all have the same structure, form the most important part of the IT Baseline
Protection Manual. Each module starts with a brief description of the component, procedure or IT
system under consideration.
This is followed by a description of the threat scenario. The threats here are divided into the
aforementioned categories of Force Majeure, Organisational Shortcomings, Human Error, Technical
Failure and Deliberate Acts.
To make it easier to see which modules are relevant and to avoid redundancies, in each case only a
reference is provided to the text in which the threat is described in more detail. An example is
provided below as to how a threat would be cited within a module:
- T 4.1 Disruption of power supply
In the code T x.y, the letter "T" stands for threat. The number x before the decimal point refers to the
Threats Catalogue (in this case T 4 = Technical Failure) and the number y after the decimal point is
the serial number of the threat within the catalogue concerned. This is followed by the name of the
threat. It is recommended that the user then reads the text of the threat referenced for the sake of
gaining awareness and understanding the safeguards which apply, but it is not absolutely essential to
read this text in order to be able to draw up an IT security concept on the basis of the IT Baseline
Protection Manual.
The recommended safeguards which are listed after the section on the threat scenario constitute the
major part of a given module. Brief information is presented first of all on the safeguard package
concerned. In some modules these statements contain, for example, information on the recommended
sequence to follow in implementing the necessary safeguards.
As was done with the threats, the safeguards themselves are grouped according to the headings in the
Safeguards Catalogues, i.e. in this case, under the headings Infrastructure, Organisation, Personnel,
Hardware & Software, Communications and Contingency Planning. The same procedure is followed
as in the handling of threats, i.e. in each case only a reference is provided to the relevant safeguard. An
example is provided below as to how a recommended safeguard would be cited within a module:
- S 1.15 (1) Closed windows and doors
In the code S x.y, "S" refers to a safeguard, and the number x before the decimal point refers to the
Safeguards Catalogue (in this case S 1 = Infrastructure). The number y after the decimal point is the
serial number of the safeguard within the relevant catalogue.
The number in brackets - in this case (1) - assigns a priority to each safeguard. This is extremely
important when drawing up a plan for the implementation of safeguards which have not previously
been implemented or have only partially been implemented. In practice, it is during this phase that
problems in finding sufficient financial or staff resources and/or with timescales frequently occur. If
these would mean that full implementation of all the necessary safeguards would have to be delayed,
then the starting point in determining the sequence to be followed in implementing any missing
safeguards should be the priority assigned to each of the various safeguards in the modules. The
following priority levels have been assigned:
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000