IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
Due to the steady drop in the price of data media and continuing technological
advances, the above figures can only be used for rough orientation. Currently
applicable prices are to be established during the actual selection of the data
media.
The following factors are of significance here:
Availability requirements:
The higher the availability requirements, the faster the required access to
data media for backup purposes, and the shorter the required time for reimporting
the relevant data from the data media.
For reasons of availability, it must be ensured that the data media are still
usable for restoration even if a reading device fails. A compatible and fully
operational replacement for this reading device must be obtainable at short
notice.
Data and modification volumes:
With an increasing data volume, use is generally made of economical,
tape-data media like magnetic tapes or cassettes (data cartridges).
Deadlines:
If erasure deadlines are to be maintained (e.g. in the case of person-related
data), the selected storage medium must allow this erasure. Data media for
which erasure is impossible or difficult (e.g. WORM) should be avoided
here.
Data confidentiality and integrity requirements:
If the confidentiality and integrity requirements of the original data are
high, the same is applicable to the data media used for backing up this data.
If encrypted data backup is not possible, consideration should be given to
selecting data media whose design and transport characteristics would
allow their storage in appropriate cabinets or safes.
Knowledge of IT users:
The knowledge and data processing capabilities of IT users are
instrumental in determining whether the selected procedure should allow
IT users to personally and manually perform data backups, whether
different, qualified persons should perform decentralised backup, or
whether automatic data backup would be more practical.
Responsibility for data backup
One of three groups can be assigned the responsibility to carry out data
backups: IT users (usually chosen for decentralised and non-networked
systems), system managers or administrators intended specially for data
backup. Parties responsible for data backups not performed by IT users must
be committed to keeping these data confidential and encryption should be
considered.
Persons responsible for organising data restoration must also be appointed, in
addition to persons authorised to access backup data media, particularly if
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000