IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
The staff concerned must also receive training as to how to implement and apply the new IT security
safeguards correctly. If this training is left out, it is possible that the safeguards might not be
implemented and/or that they might fail to achieve the desired effect. Another consequence would be
that staff would feel inadequately informed, and this in turn often results in a negative attitude towards
IT security.
After the new IT security measures have been implemented, the IT Security Officer should check to
ensure that staff have fully accepted them. Should it turn out that the new measures have not gained
acceptance, they are doomed to failure. The causes of the lack of acceptance should be investigated
and, if necessary, those concerned should be given an additional briefing.
Example:
Excerpts from a fictitious example are provided below in order to illustrate the steps listed above in
more detail. The table below shows the consolidated list of safeguards to be implemented, together
with estimates of the associated costs, which is generated as a result of steps 1 to 3.
Target object Mod
ule
Entire organisation 3.1 S 2.11 Provisions Governing the
Use of Passwords
Server room R 3.10 4.3.2 S 1.24 Avoidance of Water
Pipes
Server room R 3.10 4.3.2 A1 Installation of metal sheets
to take water away, with
monitoring via a water alarming
device which alerts the porter.
Server S4 6.5 S 1.28 Local Uninterruptible
Power Supply
C1 group of clients 5.5 A2 Smart card-supported
authentication plus local
encryption of hard disks
...
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000
Safeguard Priority Costs Notes
1 2 3
P a) euro 0
b) 2 working days
c) euro 0 p.a.
d) 0 working days
p.a.
X a) euro 20,000
b) 12 working days
c) euro 0 p.a.
d) 0 working days
p.a.
a) euro 4,000
b) 3 working days
c) euro 0 p.a.
d) 0 working days
p.a.
X a) euro 1,000
b) 1 working day
c) euro 0 p.a.
d) 0 working days
p.a.
a) euro 1,400
b) 2 working days
c) euro 0 p.a.
d) 2 working days
p.a.
Key:
- Safeguard
A1 = additional measure 1 (additional to the IT baseline protection safeguards)
- Priorities
P = partially implemented, X = missing, has not been implemented
- Costs:
a) = one-off investment cost
This safeguard is not costeffective
to implement.
Instead, safeguard A1 will be
implemented.
Replaces safeguard S 1.24.
This additional measure
replaces safeguard S 4.1.