IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.156 Selection of a suitable computer virus
protection strategy
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Head of IT Section
In order to implement computer virus protection it is necessary to deploy
human and financial resources, which must be in reasonable proportion to the
actual potential threat. Details of the following influencing factors must be
collected for all of the identified IT systems potentially threatened by
computer viruses:
- How often does a data transfer that could lead to an infection or the
dissemination of computer viruses take place via the existing interfaces?
- What consequences can be expected in the event of an actual infection if
no protective measures are taken?
- How reliably do the IT users perform IT security measures which need to
be initiated periodically?
- How much time can the IT users be expected to spend on computer virus
protection measures?
Given knowledge of the frequency of computer virus infections derived from
the data collected as described above and from technical publications, and
knowledge of the possible consequential damage, a decision has to be taken in
conjunction with management as to which financial resources have to be made
available for necessary measures and which human resources will be made
available.
Once it is known which financial and human resources are available to
provide protection against computer viruses and which IT systems have been
identified as being potentially threatened, strategies for achieving suitable
protection can be chosen.
A number of possible strategies are described in the following.
Computer virus scanning programs on every terminal
The use of an up-to-date resident computer virus scanning program (i.e. a
program that runs permanently in the background) in an IT system ensures
that an infected program cannot be executed or a file with a macro virus
cannot be loaded. Checking of the interfaces on the terminal is taken care of
by the resident scanning program. This ensures that no viruses are transferred
to the IT system. It is not advisable to rely solely on the exclusive use of nonresident
computer virus scanning programs (which are only activated when the
program is explicitly started by the user). There is no significant financial
advantage to be obtained from this nowadays, but the disadvantages on the
part of the IT users are considerably increased because they must be relied
upon to activate the program on a regular basis.
If all terminals are equipped with a resident computer virus scanning program,
it can be guaranteed that computer viruses will be identified immediately after
they appear and that they will not be disseminated from the terminal. In
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000