IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
hierarchy by the application of established criteria. The information security
authorities of several countries have each set up a national certification
scheme according to these criteria.
The use of a certified product provides a guarantee that the security
functionality of the product has been independently tested and does not fall
below the standard specified in the evaluation level (see also S 2.66
Consideration of the contribution of certification to procurement).
Imported products
In several countries, especially in the USA, the export of strong cryptography
is at present (still) subject to severe restrictions. In particular, the strength of
essentially strong encryption products is artificially diminished (by reducing
the number of possible keys). These artificially weakened procedures do not
generally reach the mechanism strength necessary for medium-level protection
requirements.
In Germany and most other countries, cryptographic products are not subject
to any restrictions when used within the national boundaries. When imported
products are used, attention should always be paid to whether they provide the
full range and scope of capabilities.
Transnational use
Many companies and agencies are increasingly faced with the problem that
they also want to secure their international communications, for example with
overseas subsidiaries, by cryptographic means. First it is necessary to examine
the following points:
- Whether restrictions on the use of cryptographic products have to be
observed in the countries concerned
- Whether any export or import restrictions applying to products under
consideration have to be observed
Security against improper use and malfunctions
The dangerous aspect of cryptographic products is that they lull users into a
(sometimes false) sense of security: no problem: it’s all encrypted"! This is
why measures against being compromised as a result of operating errors or
technical failure are particularly important, because their consequences cannot
be limited to a simple defect but may immediately lead to a security breach.
However, there is a large range in terms of redundant system design and
additional monitoring functions - and hence equipment costs - so that in this
regard the measures have to be determined in each individual case, in
accordance with requirements.
Implementation in software, firmware or hardware
Cryptographic algorithms can be implemented in software, firmware or
hardware. Software implementations are usually controlled by the operating
system of the respective IT system. The term firmware covers programs and
data which are permanently stored in hardware in such a way that the stored
contents cannot be dynamically altered, nor can they be modified during
execution. Hardware solutions entail the implementation of cryptographic
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000