IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.170 Requirements to be met by a system
management system
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
The purpose of a system management system is to provide support to an
administrator of a local network (or virtual local network). A system
management system therefore has to satisfy certain prerequisites in order to be
able to give the administrator appropriate support. The requirements that any
such system has to meet, however, are substantially dependent on the planned
use (see S 2.169 Developing a system management strategy) and on the
chosen architecture of the system management system (see S 2.171 Selection
of a suitable system management product).
A system management system should provide the following functions:
- User management
This includes adding, changing and deleting user accounts and group
accounts.
- Policy management
It should be possible to manage access rights both for access to and from
the local network and for access to and from the Internet.
- Software management
The system management system should allow the addition, deletion and
updating of software components.
As well as this, the automatic detection of installed software may be
important, especially during the introductory phase. Although the
administration of software licenses would be desirable, this is rarely
supported by today’s systems (see also application management below.
Exception: licenses may be available in the form of files, so it may be
possible to manage the license files within the framework of the file
distribution mechanisms of a management system).
- Determination, modification and administration of system configuration
data
- Administration of application data
It must be possible to manage files in a database system or configuration
files belonging to an application so as to allow the distribution of a new
version of a database, for example, or the distribution of new configuration
files.
- Monitoring of system components
This may also make sense for external components which are not subject to
an administration system of their own, for example for the router of an
Internet service provider (ISP) via which an Internet connection is
implemented.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000