IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 6.19 Data backup on PCs
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: IT-users
The requirements of S 6.32 Regular data backup should generally be
observed. The following example demonstrates effective data backup on a PC.
Under the three-generations principle (three different data backups are made
before the first is overwritten), all application data and the configuration data
of the used software is saved at weekly intervals on externally storable or
externally held data media (floppy disks, removable hard disks, streamer
tapes, server). If the data stock to be saved is too voluminous, data backup can
be confined to files whose content has changed since the last data backup
(incremental backup). However, it is still necessary to back up the entire data
stock (full backup) every third data backup.
Data backup must be documented; as a minimum, the designation of the data
medium and the date of the backup should be recorded. the name of the data
medium and the date of the backup is to be recorded, for instance:
"BP940518" = backup of 18.05.94. In addition, the parameters selected for
data backup must be documented (for documentation, cf. S 2.24 Introduction
of a PC Checklist Booklet).
Data backup must comply with any established data backup policy (cf. S 6.13
Development of a data backup policy).
If no products are available for easy data backup, system applications such as
the DOS command BACKUP can be used. If the program used allows the data
backup to be password-protected, use should be made of this option. In this
case, the password must then be deposited safely (cf. S 2.22 Depositing of
passwords).
Additional controls:
- Is all computer data backed up?
- Are completed data backups documented?
- Does the data backup procedure comply with existing data backup policy?
Note: this safeguard is no longer used by any of the components covered in
the IT Baseline Protection Manual. The contents of this safeguard have
already been added to the text for S 6.32 Regular data backups.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000