IT Baseline Protection Manual - The Information Warfare Site

Networked Systems
_________________________________________________________________________________________
Force majeure
- T 1.1 Loss of personnel
- T 1.2 Failure of the IT system
Organisational shortcomings:
- T 2.59 Opertion of non-registered components
- T 2.60 Strategy for the network system and management system is not laid down or
insufficient
- T 2.61 Unauthorised collection of personal data
Human Failure:
- T 3.34 Unsuitable configuration of the management system
- T 3.35 Disabling the server while in operation
- T 3.36 Misinterpretation of events
Technical Failure:
- T 4.38 Failure of components of a network management system or system management
system
Deliberate Acts:
- T 5.86 Manipulation of management parameters
Recommended Countermeasures (S)
For the implementation of IT baseline protection, selection of the required packages of safeguards
("modules") as described in chapters 2.3 and 2.4, is recommended.
The system to be managed consists of individual computers, gateways and the physical network. Each
of these components presents a potential security risk for the whole system. These risks cannot be
eliminated entirely through the implementation of management software. This is due to the fact that it
is not usually possible to include all systems in a management system to the same extent. The basic
requirements for the security of the system are the definition and implementation of a security policy
for the whole enterprise. In the case at question, this policy must be expressed particularly in the
configuration of hardware and software. For this reason, particular attention should be paid to the
safeguards of the modules listed in chapter 6. Module 6.7 can be used as a starting point.
As management systems are designed with a centralist structure, the management station is of
particular importance for security considerations, and a particular effort must therefore be made to
protect it. Thus, important components of a management system should be set up in rooms which
correspond to the requirements for a server room (see chapter 4.3.2). If no server room is available,
they can alternatively be set up in a server cabinet (see chapter 4.4 Protective Cabinets).
In order to successfully set up a network and system management system, a series of measures should
be taken, starting with the design, then going on to the purchase and operation. The steps and measures
involved are described below:
1. Creation of a management concept based on the requirements which result from the existing IT
system.
1.1 Requirement analysis (see S 2.168 IT system analysis before the introduction of a system
management system)
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000