IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
requirement. The values decided on should be documented in the security concept in an appropriate
manner.
Step 2: consider of damage scenarios
Starting from the assumption that a loss of confidentiality, integrity or availability of an IT application
or the related information occurs, the maximum damage and consequential damage are considered. On
the basis of the question
"What if ... ?"
realistic damage scenarios are developed from the user's point of view and the expected material or
non-material damage is described. The extent of this possible damage ultimately determines the
protection requirements of the IT application. The persons responsible for the IT applications under
consideration and their users must be asked for their personal opinions. They will normally have a
good idea of what damage could occur and should be able to provide a useful input into the data
collected.
To simplify calculation of the possible damage, a set of questions is presented below for each of the
damage scenarios mentioned, as a tool for drawing out the possible effects. These suggestions do not
claim to be complete; they are merely intended as a guide. In every case it is necessary to consider the
specific work and the situation of the agency/company, and the questions provided in this manual must
be supplemented accordingly.
Working through the damage scenarios listed below, including the related questions, is recommended
for each of the IT applications recorded. Once this has been done, the tables above should be used to
determine the protection requirement with regard to confidentiality, integrity and availability by
assigning each IT application to a protection requirement category.
Damage scenario „Violation of laws, regulations or contracts“
Such violations can result from the loss of confidentiality, integrity or availability. The severity of the
ensuing damage will often depend on the specific legal implications for this agency/company.
Examples of relevant German legislation are:
The Constitution, the Civil Code, the German Penal Code, the Federal Data Privacy Act and the
data privacy legislation of the individual Länder, the Social Security Code, the German
Commercial Code, the Staff Representation Act, the Employees’ Representation Act, the Copyright
Act, the Patents Act, the Information and Communication Services Act (IuKDG), the Control and
Transparency in Business Act (KonTraG).
Examples of relevant regulations are:
Administrative regulations, ordinances, and service regulations.
Examples of contracts:
Service contracts in the area of data processing, contracts for the safeguarding of
business/industrial secrets.
Questions:
Loss of confidentiality
Is confidentiality of the data required by law?
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000