IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
If these two criteria do not lend themselves to a suitable division of the full network (for example
because some of the resulting subnetworks are too large or too small), as an alternative the division
into subnetworks may proceed at the organisational level. Under this approach, the subnetworks are
defined so that they correspond to discreet areas of responsibility of the different administrators or
teams of administrators.
It is not possible to make a definite recommendation as to how best to subdivide the complete network
into subnetworks, as the requirements stated above might be incompatible with the existing IT assets.
Instead, a decision should be made in the individual case as to what is the most practical way of
splitting up the complete network, bearing in mind the modules of the IT Baseline Protection Manual
which are to be used.
- Module 6.7 Heterogeneous Networks must generally be applied to every subnetwork. However, if
the subnetworks are small and several subnetworks fall within the responsibility of the same team
of administrators, it may be sufficient to apply module 6.7 only once to all of these subnetworks.
- Module 6.8 Network and System Management must be applied to every network or system
management system used on the IT assets under consideration.
- Module 7.2 Modem must be applied to every IT system equipped with a modem or to each
corresponding sample thereof.
- Module 7.3 Firewall must be applied to every external connection to third party IT systems or
networks where IT systems in the internal network which have a high protection requirement can
be accessed over this external connection. This applies also if no firewall system is in use there yet.
Examples here are Internet connections, remote access facilities and links to networks owned by
business partners.
- Module 7.6 Remote Access must be applied once wherever remote access to the internal network
is possible by a route other than over a dedicated leased line (e.g. telework, linking of staff working
out in the field over analogue dial-up lines, ISDN or mobile phone).
- Module 8.4 LAN integration of an IT system via ISDN must be applied to all external
connections which are implemented over ISDN.
Tier 5: Security in applications
The lowest tier entails modelling of the applications. Modern applications are seldom limited to a
single IT system. In particular, core applications used across an entire organisation are generally
implemented as client/server applications. In many cases servers themselves access other servers
downstream, e.g. database systems. The security of the applications must therefore be considered
independently of the IT systems and networks.
- Module 7.1 Exchange of Data Media should be used once for every application which serves as a
source of data for an exchange of data media or processes data received by this route.
- Module 7.4 E-Mail must be applied to every e-mail system (internal or external) of the IT assets
under consideration.
- Module 7.5 WWW Server must be applied to every WWW service (e.g. Intranet or Internet) of the
IT assets under consideration.
- Module 8.5 must be applied to every fax server or to every sample of the same from a
corresponding group.
- Module 9.2 Databases should be used once for every database system or sample of the same.
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000