IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.63 Establishing Access Rights
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Person-in-charge of the various IT
applications, Administrator
If a system is operated by several users, the access rights must be administered
in such a way that the users can only operate the IT system in accordance with
their tasks.
This assumes that the access authorisations for the various functions have
been stipulated by the persons-in-charge (c.f. S 2.7 Granting of
(system/network) access rights and S 2.8 Granting of (application/data) access
permissions). The users of the IT system are then allocated to the various
functions. The results should be in writing.
The Administrator must then configure the IT system in such a way that these
users receive access to the IT system and are only able to conduct their tasks
with the access authorisation allocated to them. If the IT system offers no
possibility of assigning access rights (e.g. a DOS-PC with multiple users) a
supplementary product will have to be used (c.f. S 4.41 Use of a suitable PC
security product).
If the IT system permits, the report functions should be activated by the
Administrator for the purpose of providing evidence. This may be successful
and unsuccessful log-on / log-off processes, system errors, attempts to access
the system without authorisation.
In the event of substitution, the Administrator must check that his substitute is
authorised by the superior. Only then may he establish the access
authorisations in the case of substitution.
Additional controls:
- Are the site authorisations assigned by the administrator randomly
checked?
- Does documentation exist which shows the authorisation structure in the IT
system?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000