IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- Who can communicate with whom with or without cryptographic
protection?
- Who is allowed to assign certain rights, etc.?
On this basis and in accordance with the basic systems engineering conditions
regarding
- the data volume under consideration and time dependence
- availability requirements and the risk situation
- the type and frequency of applications to be protected etc.
suitable implementation options can be analysed and a conception drawn up
and technical design finalised for specific fields of use, such as a PC
workstation, within a LAN or in connection with a PBX system. A holistic
approach of this nature is essential in order to assemble the fundamental data
and conditions needed to take decisions about cryptographic products if their
application and use is both appropriate from a security point of view and is
economically justifiable. It should be pointed out, however, that the
subdivision described above is by no means obligatory or of fundamental
significance, but is at best helpful. The only key factor is that the scope of the
questions must consistently reflect the starting scenario after the situation has
been clarified as comprehensively as possible. In practice, of course, there are
reciprocal effects and dependencies between certain questions and answers,
but in general these contribute to completing the overall picture.
The various influencing variables affecting the use of cryptographic
procedures must be established and must be documented in a comprehensible
form (see S 2.163 Determining the factors influencing cryptographic
procedures and products). Subsequently, a suitable course of action must be
developed and documented for their use. Finally, implementation must be
arranged by the agency or company management.
The results should be recorded within the crypto concept in a form which can
be updated and expanded as required. An example of a crypto concept is
shown in the following table of contents:
Crypto concept: Table of contents
1. Definitions
- Cryptographic procedures
- ...
2. Threat scenario as motivational background
- Dependence of the institution on the data stock
- Typical threats such as ...
- Causes of damage specific to individual institutions
- In-house cases of damage
3. Specifying the organisation’s internal security policy
- Specification of responsibilities
- Objective, security level
4. Influencing factors
- Identification of the data to be protected
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000