IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
- Backup copies should always be made of long-lived keys, for example
keys that are used for the archiving of data or for generating session keys.
Backing up encrypted data
Particular care needs to be taken when backing up encrypted data or when
using encryption during a backup procedure. If errors occur at such times, it
usually means that all of the data will be unusable, not just a few records.
The long-term storage of encrypted or signed data is associated with many
additional problems. It is not only necessary to see to it that the data media are
regularly refreshed and that the technical components for processing these
media are available at all times, it must also be ensured that the cryptographic
algorithms and the key lengths still represent the state of the art. As far as the
long-term archiving of data is concerned, it may therefore make more sense to
store the data unencrypted and instead store it in an appropriately secure
location, for example in a safe.
As a precaution, the crypto modules should always be archived because
experience shows that even after a number of years data may crop up which
has not been stored in the archive.
Backing up the configuration data of the products used
When using relatively complex crypto products, it is important not to forget to
back up their configuration data (see also S 4.78 Careful modifications of
configurations). Once chosen, the configuration should be documented so that
it can be set up again quickly after a system failure of if reinstallation becomes
necessary.
Additional controls:
- Are there any stipulations within the company or agency regarding the
safekeeping of copies of keys?
- How is it ensured that data stored in encrypted form can still be accessed
even after a long period of time?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000