IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
clients in the HR Department. They have access to server S1 in the HR Department in Bonn. C2 and
C3 represent the 10 clients in the Administration Department and the 75 clients in the end-user
departments in Bonn. The only differences here are in relation to the application programs used.
Finally, group C4 represents the clients in end-user departments in Berlin. These differ from
groups C1 to C3 in the environmental infrastructure and their integration into the overall network.
Collecting information about the IT systems
The next step relevant to the assessment of protection requirements and modelling of the IT assets to
be subsequently performed is to prepare a list of the existing and planned IT systems in tabular form.
The term "IT system" refers here not only to computers in the narrower sense, but also to other active
network components such as network printers, private branch exchanges (PBX) etc. The focus here is
on the technical implementation of an IT system, e.g. stand-alone PC, Windows NT server, PC client
under Windows 95, UNIX server, PBX. At this point, only the system as such (e.g. UNIX server)
should be recorded, rather than the individual elements which make up the IT system (i.e. CPU,
keyboards, monitors etc. should be omitted).
Both networked and non-networked IT systems should be recorded, i.e. in particular, any IT systems
which are not already included in the network plan previously considered. IT systems which have been
grouped together as part of the exercise of simplifying the network plan can be viewed from now on as
a single object. Again, the IT systems which are not included on the network plan should be checked
to see whether it would be logical to group some of them together. For example, this might be possible
if there is a large number of stand-alone PCs which satisfy the conditions stated as being necessary for
grouping in the "Reducing complexity by identifying groups of similar assets" section above.
When collecting the data, the following information which will be needed at subsequent stages should
be noted down:
- a unique name for the IT system,
- description (type and function),
- platform (e.g. hardware architecture/operating system),
- number of IT systems included in each group,
- installations site of the IT-system,
- status of the IT system (operational, in test stage, in planning stage)
- user/administrator of the IT system.
Example: Bundesamt für Organisation und Verwaltung (Federal Agency for Organisation and
Administration, BOV) - Part 2
As an example, the table below shows an excerpt from the list of IT systems in the BOV. (The
complete list is included in the auxiliary aids provided on the CD-ROM.)
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000