IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.110 Data privacy guidelines for logging
procedures
Initiation responsibility: Head of IT Section, data privacy officer
Implementation responsibility: Administrators, data privacy officer
In terms of data security, logging as part of IT-systems operation constitutes
the manual or automatic generation of records which make it possible to
determine ”who accessed or performed what, when, using which resources.”
These records should also indicate system states, i.e. ”who had which access
rights for which period of time.”
The nature and scope of logging depends on general data privacy laws as well
as locally applicable guidelines.
The logging of administrative activities is equivalent to system monitoring,
while the logging of user activities serves essentially as process monitoring.
Accordingly, requirements concerning the nature and scope of systemoriented
logging originate primarily from general data privacy laws, while
process-oriented logging is defined mainly by locally applicable guidelines.
Examples of process-oriented logging guidelines are registration laws, police
laws and constitutional laws.
Minimum requirements for logging
The following activities must be logged fully during the administration of IT
systems:
- System generation and modification of system parameters
As system-controlled logs are usually not generated on this level, detailed
manual records corresponding to the system documentation are required
here.
- Configuration of users
Complete records must be maintained as to which rights to use an IT
system were granted by whom to which people for which periods of time.
Long-term retention periods must be specified for these logs, as they form
the basis for practically every method of review.
- Preparing rights profiles
One important logging task as part of user administration is to maintain a
record of the people who issued instructions to configure individual user
rights (also refer to S 2.31 Documentation on authorised users and on
rights profiles).
- Installation and modification of application software
Logs in this context indicate the outcome of releasing programs and
processes.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000