IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- Access rights to management information
- Documentation of the management system
- Drafting or adjustment of emergency plans to deal with the failure of the
management system or individual components
The response to violations of security policies in the field of system
management should also be determined in advance. In much the same way as
in other fields of IT, a security policy must be defined for the field of system
management or the company’s or agency’s existing security policy must be
applied to the field of system management. As a management system interacts
with important network and system components and administers and monitors
their operation, violations of the security policies in this sphere are to be
viewed particularly seriously. In particular, provisions and procedures must be
defined which will be deployed in the event of any such security violation.
These are on the one hand technical (for example assigning new passwords for
all users after compromising of the management console), but also of an
organisational nature.
Auditing, data privacy officers and IT security management should become
involved during the planning phase. After the management system is
introduced, the duties incumbent upon them in relation to the management
system must be clear. Example: the data privacy officer can pay attention to
the observance of the privacy protection guidelines during the planning phase,
for example monitoring which user information is intended to be or allowed to
be recorded as part of the system management process. After the system is
introduced, the privacy officer must also be in a position to check the
observance of the guidelines. Much the same applies to the areas of
responsibility of the auditor and the IT security officer.
Determining the boundary conditions for selecting the management
system product
The introduction of a system management system calls for extensive and
careful planning. Parts of the system management strategy are also dependent
on whether or not they can be implemented with a specific product.
Consequently the drafting of the management strategy and the selection (or
preselection) of a product must be reexamined.
The following points should be taken into consideration when drawing up the
system management strategy:
- Is more than one management domain needed? If so: how are they to be
formed? Management domains allow the components of the administered
system to be divided into groups. The individual groups can be
administered separately from each other. Breaking a system down into
various management domains is not obligatory for small or medium-sized
systems, but it does encourage structured system management. For large
systems, dividing the system into various management domains is
generally a necessity. The planning of the management regions is
dependent on a number of factors:
- Network topology
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000