IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.165 Selection of a suitable cryptographic product
Initiation responsibility: IT Security Management
Implementation responsibility: IT Security Management
The spectrum of cryptographic applications is very wide, ranging from simple
programs for file encryption on a single-user PC through firewall computers
with crypto functions for protecting a local network to the real-time hardware
encryption of video conferences. Given this range, it is plain that
recommendations on the selection of cryptographic products have been kept to
generalities.
Before a selection is made, the user should determine all requirements that the
product is expected to meet. The selected product should cover the user’s
requirements to as great an extent as possible.
Functionality
The selected product must exhibit the functionality specified by the user; in
particular, it must:
- perform the required basic cryptographic services
- satisfy any special requirements imposed by the application environment
(e.g. single-user/multi-user PC, LAN environment, WAN link)
- exhibit the required technical performance characteristics (e.g. throughput
rates)
- offer the required security functionalities; in particular the cryptographic
mechanisms used must be of the required strength
Interoperability
The selected product is generally incorporated into an existing IT
environment. It must be as interoperable as possible within that environment.
It is essential to observe internal standards in order to ensure interoperability
with the IT system and system components already in place. The use of
international standards for cryptographic techniques should be a matter of
course; among other things it makes it easier to evaluate the security of the
cryptographic component.
Cost-effectiveness
The selected product should be as cost-effective as possible. Procurement
costs, the quantities required and the costs of maintenance and product
updating must be taken into account, but also the savings made through any
rationalisation effects.
Certified products
Over the past decades, an internationally recognised methodology for
evaluating IT security products has become established: the European ITSEC
(Information Technology Security Evaluation Criteria) and the subsequent
development, CC (The Common Criteria for Information Technology Security
Evaluation). The ITSEC and CC provide a framework within which the
security functionalities of an IT product can be fitted into a precisely specified
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000