IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Measures for IT systems with non-resident virus checking
In IT systems on which no resident computer virus scanning program is
installed, as an alternative it is necessary to stipulate the regular use of a
computer virus scanning program (cf. S 4.3 Periodic runs of a virus-detection
program), checking for viruses when data media are exchanged and data is
transferred (cf. S 4.33 Use of a virus scanning program on exchange of data
media and during data transfer) and checking for macro viruses when
incoming files are received (cf. S 4.44 Checking incoming files for macro
viruses) in order to ensure the rapid detection of computer viruses and to
prevent their being spread further.
Reporting of computer viruses
It must be stipulated to whom the discovery of a computer virus must be
reported without delay. The form of the report (form sheet) and the means of
communication (by telephone, in person, in writing, by e-mail) must also be
regulated (see S 2.158 Reporting computer virus infections).
Regulation of responsibilities
The tasks, authorities and responsibilities for protection against computer
viruses must be laid down for the following:
- The contact person for computer viruses
- The administrator of network servers
- IT users of terminals
- IT security management
Updating the computer virus protection concept
When changes are made to IT systems, when new IT systems are installed and
when networking changes are made, the computer virus protection concept
must be updated and adapted (cf. S 2.34 Documentation of changes made to
an existing IT system).
These arrangements must be made known to those people affected. The
observance of these arrangement should be checked from time to time in order
to ensure that the computer virus protection concept is consistently
implemented.
Additional controls:
- When was the last check made? Have the results been documented?
- How are the people concerned informed of the relevant arrangements?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000