IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
the target versus actual comparison as being inadequate or missing and those identified for IT assets
which are still at the planning stage.
To map a generally complex set of IT assets to the modules in the manual it is recommended that the
IT security aspects are considered as groups arranged according to particular topics.
Tier 1
Tier 2
Tier 3
Tier 4
Tier 5
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000
Universally applicable aspects
Infrastructure
IT systems
Networks
IT applications
Figure: Tiers in the IT baseline protection model
The IT security aspects of a set of IT assets are assigned to the individual tiers as follows:
- Tier 1 covers all the general IT security aspects which apply equally to all or large numbers of the
IT assets, particularly any universally applicable concepts and the procedures derived therefrom.
Typical Tier 1 modules include IT Security Management, Organisation, Data Backup Policy and
Computer Virus Protection Concept.
- Tier 2 is concerned with architectural and structural factors, in which aspects of the infrastructural
security are brought together. This concerns especially the Buildings, Rooms, Protective Cabinets
and Working Place at Home (Telecommuting) modules.
- Tier 3 concerns the individual IT systems in the set of IT assets which may be grouped together.
The IT security aspects considered here relate not only to clients but also to servers and stand-alone
systems. Thus, for example, the modules UNIX System, Laptop PC, Windows NT Network and
Telecommunications System (Private Branch Exchange) fall within Tier 3.
- Tier 4 considers the networking aspects of the IT systems, which refer to the network connections
and communications rather than to particular IT systems. The modules which are relevant here
include, for example, Heterogeneous Networks, Network and System Management and Firewalls.
- Finally Tier 5 is concerned with the actual IT applications which are used on the IT assets. In this
tier, the modules used for modelling purposes could include E-Mail, WWW Server, Fax Servers and
Databases.
Using this tier approach has the following advantages.
- The complexity of the IT security is reduced because the individual aspects are divided up in a
meaningful manner.
- As higher order aspects and common infrastructural issues are considered separately from the IT
systems, duplication of effort is avoided as those aspects only need to be dealt with once and not
repeated for every IT system.
- The various tiers have been defined so that responsibilities for the aspects under consideration are
grouped. Tier 1 is concerned with fundamental issues relating to the use of IT, Tier 2 with site
technical services, Tier 3 with matters that concern administrators and IT users, Tier 4 with matters