IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.163 Determining the factors influencing
cryptographic procedures and products
Initiation responsibility: IT Security Management
Implementation responsibility: Administrators; staff responsible for the
individual IT applications
Before a decision can be taken as to which cryptographic procedures and
products are to be used, details of a number of influencing factors need to be
ascertained. The system administrators and staff responsible for the various IT
systems and IT applications can be interviewed for this purpose. The results
are to be comprehensibly documented.
The following influencing factors must be determined for all storage locations
and transmission links specified in S 2.162 Determining the need to use
cryptographic procedures and products:
Security aspects
- What are the protection requirements or what security level is it considered
necessary to achieve?
- Which cryptographic functions are necessary for this (encryption,
protection of integrity, authenticity and/or non-repudiation)?
- Potential of intruders: what type of intruders are to be expected (time
available, financial resources, technical skills)?
The answers to these questions are derived from S 2.162 Determining the need
to use cryptographic procedures and products.
Technical aspects
Operating heavily branched IT infrastructures with their large numbers of
individual components and special equipment (network nodes, servers,
databases, etc.) means that security systems must also be heavily branched,
with several functional units (security management, security servers, security
application components, etc.). Generally speaking the systems have to be
examined with a view to not only the functionalities per se but also structural
and organisational aspects. It is also necessary to differentiate in respect of the
specific technical placement of security components and their integration into
non-security components, because this has a direct influence on the
implementation of the security functions, on the support required from the
operating systems, on expenditure and the cost factor, and not least on the
attainable level of security. The geographical localities and the levels of the
protocol stack at which the respective security services are implemented and
the way in which they are incorporated in the processes of the IT system being
protected are quite crucial for the security evaluation. The following questions
thus arise:
- Protection offered by the environment: what protection does the
environment offer (in terms of infrastructure (access), organisation, staff,
technical facilities (protection by operating system, ...))?
- IT system environment: what technology is used, which operating systems,
etc.?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000