IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.34 Documentation of changes made to an
existing IT system
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
In order to ensure smooth operation, the Administrator must have, or be able
to obtain, an overview of the system. In the event of an unforeseen absence of
the Administrator, such an overview must also be available to his deputy. It is
also essential to have an overview when making checks of the system (e.g. for
problematic settings, consistency in changes).
Therefore, the changes made by Administrators to a system should be
documented. If possible this should be automated. This applies, in particular,
to changes made to system directories and files.
When installing new operating systems or in case of updates, the changes
made should be documented especially carefully. Activation of new, or
modification of existing, system parameters may also fundamentally change
the behaviour of the IT system (especially security functions).
Under UNIX, executable files to which users other than the owner also have
access, or whose owner is root, must be approved and documented by the
System Administrator (cf. also S 2.9 Ban on the use of non-approved
software). In particular, lists of the approved versions of these files, which in
addition must as a minimum contain the creation date, the size of each file and
information on any s bit settings, must be kept. They are the prerequisite for
regular security checks and for investigations following a loss of integrity.
Additional controls:
- Are log books kept of system changes?
- Are the records up-to-date and complete?
- Can the administration functions be continued on the basis of those
records?
- Have the records been protected against unauthorised access?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Overview of the system
New operating systems
or updates
Approval and
documentation of
executable files