IT Baseline Protection Manual - The Information Warfare Site

Networked Systems Server-Supported Network
_________________________________________________________________________________________
Infrastructure:
- S 1.28 (2) Local Uninterruptible Power Supply (UPS)
- S 1.29 (3) Adequate Siting of an IT System (optional)
- S 1.32 (1) Adequate siting of the Consoles, Devices with Exchangeable Data Media, and Printers
Organisation:
- S 2.3 (2) Data Media Control
- S 2.4 (2) Maintenance/Repair Regulations
- S 2.9 (2) Ban on Using Non-Approved Software
- S 2.10 (3) Survey of the Software Held
- S 2.13 (2) Correct disposal of resources requiring protection
- S 2.22 (2) Escrow of Passwords
- S 2.25 (1) Documentation of the System Configuration
- S 2.26 (1) Appointment of an administrator and his deputy
- S 2.30 (2) Provisions governing the configuration of users and of user groups
- S 2.31 (2) Documentation on authorised users and on rights profiles
- S 2.32 (3) Establishment of a restricted user environment (optional)
- S 2.34 (2) Documentation of changes made to an existing IT system
- S 2.35 (2) Obtaining information on security weaknesses of the system
- S 2.38 (2) Division of administrator roles in PC networks
- S 2.138 (2) Structured data storage
- S 2.204 (1) Prevention of insecure network access
Personnel:
- S 3.4 (1) Training before actual use of a program
- S 3.5 (1) Education on IT security measures
- S 3.10 (1) Selection of a trustworthy administrator and his substitute
- S 3.11 (1) Training of maintenance and administration staff
Hardware and software:
- S 4.1 (1) Password protection for IT systems
- S 4.2 (1) Screen lock
- S 4.3 (2) Periodic runs of a virus detection program
- S 4.7 (1) Change of preset passwords
- S 4.15 (2) Secure log-in
- S 4.16 (2) Restrictions on access to accounts and/or terminals
- S 4.17 (2) Blocking and deletion of unnecessary accounts and terminals
- S 2.138 (2) Ensuring consistent system management
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000