IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
Assessment of protection requirements
The aim of the assessment of protection requirements is to ascertain what protection is adequate and
reasonable for the information and the IT assets used. For each application and the information
processed within it the potential damage which could occur as a result of loss of confidentiality,
integrity or availability is considered. A realistic assessment of the possible consequential damage is
also important here. It has proved useful to distinguish three protection requirements categories, "basic
to moderate", "high" and "very high". Explanations and practical advice on the assessment of
protection requirements are to be found in Section 2.2.
Security concept
It is customary today in both the public and private sectors to network large numbers of IT assets. It is
therefore generally expedient when performing an IT security analysis or drawing up an IT security
concept to consider the IT assets as a whole rather than individual IT systems. To make this task
manageable, it is useful to break down the IT assets into logically distinct parts and to consider each
part separately. Before the IT Baseline Protection Manual can be applied to a set of IT assets, detailed
documentation regarding its structure must be available. This can be obtained, for example, through
performing the IT structure analysis mentioned above. The IT Baseline Protection Manual modules
must then be mapped onto the various components which make up the IT assets in a modelling stage.
Section 2.3 of this manual describes how to model the IT assets using modules of the manual.
Section 2.4 describes how to then gather information about existing IT protection using a basic
security check.
Basic security check
The basic security check is an organisational tool which provides a rapid overview of the existing IT
security level. Interviews are used to establish the status quo of an existing set of IT assets (assuming
IT baseline protection) in relation to the extent to which the security safeguards contained in the IT
Baseline Protection Manual have been implemented. The outcome of this check is a catalogue in
which the implementation status of each of the relevant safeguards is classified "Unnecessary", "Yes",
"Partially" or "No". By identifying safeguards which have not yet been implemented or have only
been partially implemented it is possible to identify where there is scope for improving the security of
the IT assets concerned. Section 2.4 describes an action plan for performing a basic security check.
This takes into account both the organisational aspects and also the technical requirements during
project implementation.
IT security audit
The security safeguards contained in the IT Baseline Protection Manual can also be used to carry out
an audit of IT security. By way of example, checklists based on the modules
- 3.1 Organisation
- 3.2 Personnel
- 5.5 PC under Windows NT
- 5.6 PC with Windows 95
have been developed which are intended to support IT security management in reviewing the IT
security implemented in the agency/company. Checklists are contained on the CD-ROM which comes
with the IT Baseline Protection Manual (see Annex: Additional Aids). The current versions of the
checklists should not be viewed as definitive; they merely serve as the basis for discussions and
exchanges of experience with users of the IT Baseline Protection Manual. Comments and suggestions
for improvement can be forwarded by e-mail to itbpm@bsi.de.
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000