IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- With regard to data preservation, files to be deleted after
compression must only be deleted by the compression program if
compression has been performed successfully.
- Before a file is decompressed, its integrity must be checked so that
bit errors in the compressed file can be detected, for example.
Desirable security features:
- Password protection of compressed files
Appointment calendar:
Necessary security features:
- Reliable identification and authentication of the users must take
place, e.g. using passwords.
- Access control for the appointment calendars of the various
employees is required.
- It must be possible to assign separate access rights for individuals,
groups and superiors.
- It must be possible to differentiate between read and write access.
Desirable security features:
- Automatic backup of data in an encrypted form should be possible.
Travel expenses calculation system:
Necessary security features:
- Reliable identification and authentication of the users must take
place, e.g. using passwords.
- Access control must be in place and available for individual data
records.
- It must be possible to assign separate access rights for the user,
administrator, auditor, and data privacy officer. It must be possible
to separate the functions of administrator and auditor.
- Data backups must be performed in such a way that they are stored
in an encrypted form and can only be accessed by authorised
persons.
- Detailed logging functions must be in place.
Desirable security features:
- An optional integrity check for payment-related data should be
available.
Example of an assessment scale:
A specialist department intends to purchase a compression program for data
backup purposes. After a Requirements Catalogue has been drawn up, the
features specified in the catalogue could be assessed as follows:
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000