IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
that concern the network and system administrators and finally Tier 5 with matters that concern
those responsible for or who will run the IT applications.
- Breaking down the security aspects into tiers enables individual subject areas within the ensuing IT
security concepts to be updated and expanded more easily, without having a significant effect on
other tiers.
IT baseline protection modelling entails determining for the modules of a given tier whether and how
they can be used to map the IT assets. Depending on the module considered, the objects which are
mapped in this way may be of different kinds: individual components, groups of components,
buildings, property, organisational units etc. If the target object is a group, then representative samples
should be selected from it, and the relevant module should then be applied to those samples.
The IT baseline protection model, i.e. the assignment of modules to target objects, should be
documented in the form of a table containing the following columns:
- Number and title of the module.
- Target object or target group. For example, this could be the identification number of a component
or a group or the name of a building or organisational unit.
- Sample. If the target object is a group, then the number and names of the samples taken from this
group should be noted.
- Contact person. This column serves initially only as a place holder. The contact person is not
determined at the modelling stage, but only at the point when the target versus actual comparison in
the basic security check is being planned.
- NB incidental information and the reasoning behind the modelling can be documented in this
column.
The procedure for modelling a set of IT assets is described in detail in Section 2.3.1 below. Particular
importance here is attached to any constraints which apply, when it is appropriate to use a given
module and to which target objects it should be applied. Section 2.3.2 presents a shortened modelling
procedure for the special case of a single IT system or a single group.
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000