IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- Modifications to file organisation
In view of the numerous possibilities of manipulation during the use of
standard file management systems, complete logging is of particular
importance here (for example, as regards database management).
- Implementation of data backup measures
As such measures (backup, restore) are related to the copying and
overwriting of data stocks, and are mainly required in exceptional cases,
logging is of special importance in this context.
- Use of administration tools
The usage of all administration tools must be protocoled to help ascertain
whether unauthorised people have subversively acquired system
administration rights.
- Attempts at unauthorised login and transgressions of rights
Given effective authentication procedures and an appropriate allocation of
rights, particular emphasis must be laid on maintaining a complete record
of all ”abnormalities” occurring during login and the use of
hardware/software components. System administrators are also to be
considered as users in this context.
During the processing of person related data, the following user activities must
be logged selectively or fully in accordance with the sensitivity of the
processes and information involved:
- Input of data
Input monitoring is always process-oriented (e.g. logging in files if these
are used, direct logging in the data stock if no files are used). Even if
transgressions of rights are assumed to be logged using a different
technique, complete logging of data inputs should be considered as a
standard procedure.
- Data transfer
Selective logging of data transfer can be considered sufficient only if
complete logging is not legally specified.
- Use of automatic retrieval procedures
Complete logging of retrieval and the reasons underlying them (procedure,
reference, etc.) is generally necessary to detect unauthorised handling
outside the scope of the access rights granted.
- Deletion of data
The deletion of data must be logged.
- Invocation of programs
It might be necessary to log the invocation of especially sensitive programs
which, for example, must only be used during certain periods or on certain
occasions. Complete logging is recommended in such cases. This also
makes it possible to exonerate authorised users (proof of exclusive right to
invoke a program).
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000