IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
procedures directly in hardware, for example as a separate security module or
as a plug-in card.
It is not possible to offer any general recommendation on which type of
implementation should be chosen, because various factors have to be weighed
up before the decision is made:
- The protection requirements applying to the data to be protected by the
cryptographic procedure, or the security level aimed for
- The intended data throughput
- Economic considerations and constraints
- The operating environment and surrounding safeguards
- National classification of the data being processed, if applicable
Software solutions offer the advantage of being easily adaptable and low-cost.
Hardware implementations generally offer both greater resistance to
manipulation (and therefore greater security) and a higher throughput rate than
software implementations, but they are usually also more expensive.
Firmware solutions can be seen as a compromise between the two other
options. However, the advantages and disadvantages of each implementation
always relate only to local aspects (including key management, above all).
Once the data has been encrypted and is on the communication path, the way
in which the encryption came about is essentially no longer relevant.
One example of (relatively) inexpensive, transportable and user-friendly
crypto modules is chip cards, which can be used in the field of local
encryption as a secure storage medium for cryptographic keys or in the field
of authentication for password generation and encryption.
When all of the requirements to be met by the cryptographic product have
been defined, you have at your disposal a portfolio of requirements which can
then also be used directly in an invitation to tender, should one be necessary.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000