IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- The crypto products must be pre-configured by the administrator for the
users so as to automatically achieve the maximum possible degree of
security.
- If the crypto products are relatively complex, suitable manuals must be
available.
- The crypto modules must be securely installed and subsequently tested (for
example whether they encrypt correctly and whether they can be operated
by the users).
- The demands on the usage environment must be determined; if necessary,
supplementary measures may have to be taken in the IT environment. The
security-related requirements applicable to the IT systems on which the
cryptographic procedures are used are shown in the respective systemspecific
modules, for example Chapter 5 for clients (including laptops) and
Chapter 6 for servers.
- It must be determined who has to maintain the crypto modules, and how
often.
Various specifications also have to be laid down in relation to key
management (see S 2.46 Appropriate key management):
- Specifications on the generation and selection of keys
- Specifications on the secure storage of cryptographic keys
- Stipulation of the key change strategy and intervals
Additional controls:
- Have regulations been defined for the use of cryptographic procedures?
- Is the crypto concept up to date?
- Who is responsible for answering users' queries concerning the use of
crypto modules?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000