IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
Step 4: Determine implementation sequence
If the existing budget or staffing resources are not sufficient to be able to implement all the missing
safeguards immediately, the sequence in which these measures will be implemented must be
determined. When determining the sequence, the following aspects should be considered:
- The priority of a safeguard should be viewed as a guide to the order in which it should be
implemented. Safeguards which have been assigned a priority 1 should be implemented first.
- With some safeguards a time sequence is suggested naturally by the logical inter-relationship of the
measures concerned. Thus, for example, safeguards S 2.25 Documentation of the System
Configuration and S 2.26 Appointment of an Administrator and his Deputy are both important, but
without an Administrator it is not practical to implement S 2.25.
- Many of the safeguards have a significant effect in broad areas, whereas others have only a limited,
local effect. Often it is advisable to start with the safeguards which have a broad effect.
- Some modules have a bigger impact on the aspired-to security level than others. Safeguards
contained in such modules should be given preference, especially where their implementation will
result in the elimination of weaknesses in areas having a high protection requirement. Thus, for
example, the server should always be protected first (e.g. through implementation of module 6.2
UNIX Server) and only then the clients that are connected to it.
- Modules in respect of which there is a particularly large number of missing safeguards represent
areas in which security is particularly weak. Preference should likewise be given to these.
Step 5: Assign responsibilities
Once the sequence in which the safeguards will be implemented has been determined, it is then
necessary to specify who is responsible for implementing which safeguards and by when. Unless this
is done, experience indicates that implementation of safeguards tends to be delayed and in some cases
never takes place. Care must be taken here to ensure that the person to whom responsibility is assigned
possesses the skills and authority necessary to implement the safeguards and that the resources he
needs are made available to him.
Similarly, someone must be allocated responsibility for overseeing implementation. This person must
also be notified when implementation of individual safeguards has been completed. Typically it is the
IT Security Officer who is notified. Progress in the matter of implementation should be checked at
regular intervals to ensure that the implementation work does not drag on.
The implementation plan which should now be complete should contain the following information as a
minimum:
- description of the target operational environment
- number of module to be considered
- names and description of the safeguards
- implementation schedule
- budgetary framework
- person responsible for implementation
- person responsible for overseeing implementation
Step 6: Measures to accompany implementation
It is also important to specify any measures which need to take place in parallel to implementation and
to plan them into the implementation. In particular, such measures include measures designed to
inform members of staff who will be affected by the new IT security measures of their necessity and
consequences and to make them aware of the importance of IT security.
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000