IT Baseline Protection Manual - The Information Warfare Site

Threats Catalogue Deliberate Acts Remarks
____________________________________________________________________ .........................................
T 3.1 Loss of data confidentiality/integrity as a
result of IT user error
Through inappropriate actions, it is possible for IT users to cause or enable a
loss of data confidentiality or integrity. The extent and nature of the damage
induced will depend on the sensitivity of the data involved. Examples of such
inappropriate actions are as follows:
- Printouts containing person related data are accidentally left lying on the
network printer.
- Floppy disks are sent out without data previously stored on them being
physically deleted.
- Due to incorrectly administered access rights, a staff member is able to
modify data without being able to assess the critical impact of such a
violation of integrity.
- New software is tested using non-anonymous data, giving unauthorised
staff members access to protected files or confidential information. It is
also possible that third parties could gain access to this information if the
disposal of "test printouts" is not handled correctly.
- Data stored on partially intact file systems can fall into unauthorised hands
when hard disks are dismounted, lent, sent for repair or taken out of
service.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000