IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
- Module 4.1 Buildings must be used once for every building or every sample taken from a group of
buildings.
- Module 4.2 Cabling must generally be applied once per building or sample of buildings (in
addition to module 4.1). However, it may be that certain areas, for example the server room or
control room, have special cabling requirements, in which case it may be advisable to apply
module 4.2 to those parts of the building separately.
- Module 4.3.1 Office must be applied to all rooms or samples of rooms in which information
technology is used but to which none of modules 4.3.2, 4.3.3 or 4.3.4 is being applied.
- Module 4.3.2 Server Room must be applied to every room or sample of rooms in which servers or
PBXs are operated. Servers are IT systems which make services available on the network.
- Module 4.3.3 Data Media Archives must be applied to every room or sample of rooms in which
data media are stored or archived.
- Module 4.3.4 Technical Infrastructure Room must be applied to every room or sample of rooms
in which technical devices which require little or no human intervention to run are operated (e.g.
distribution cabinet or standby power supply system).
- Module 4.4 must be applied to every protective cabinet or sample of cabinets once. Protective
cabinets can serve as an alternative to a dedicated server room.
- Module 4.5 must be applied once to every working place at home or sample of the same (if
corresponding groups have been defined).
Tier 3: Security of the IT systems
This tier is concerned with security aspects relating to IT systems, i.e. to server and client computers,
hosts, terminals etc. Tier 3 is covered by modules from Chapters 5 to 9 of the IT Baseline Protection
Manual.
By analogy with the area "Security of the infrastructure", the modules relating to the area of "Security
of the IT systems" may be applied either to individual IT systems or to samples from groups. This is
assumed below although no further specific reference to it is made.
- Module 5.1 DOS-PC (single user) must be applied to every stand-alone computer or client on
which the DOS operating system is installed.
- Module 5.2 UNIX System must be applied to every stand-alone computer or client which runs
under the UNIX operating system.
- Module 5.3 Laptop PC must be applied to every mobile computer (laptop).
- Module 5.4 PCs with a Non-Constant User Population must be applied to every stand-alone
computer or client on which different users work at different times.
NB it may not be necessary to apply module 5.4 to IT systems which are being modelled using
modules 5.5, 5.6 or 5.9. These modules specifically address security aspects of situations where IT
assets are used at different times by different users.
- Module 5.5 PC under Windows NT must be applied to every stand-alone computer or client
which runs under Windows NT.
- Module 5.6 PC with Windows 95 must be applied to every stand-alone computer or client which
runs under Windows 95.
- Module 5.99 Stand-alone IT systems must be applied to every IT system for which there is no
operating system-specific module in the IT Baseline Protection Manual.
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000