IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components Crypto-concept
_________________________________________________________________________________________
3.7 Crypto-concept
Description
This module describes a process with which, in a
heterogeneous environment, both the data stored locally and
the data to be transmitted can be protected effectively through
cryptographic procedures and techniques. For this purpose,
0100011101001000
the module explains how and where in a heterogeneous
environment cryptographic procedures and the corresponding
components can be used. As a large number of influencing
factors should be taken into account when using cryptographic procedures, a crypto-concept should be
created.
This module describes how to create a crypto-concept. It starts by determining the requirements and
influencing factors, then goes on to the selection of suitable cryptographic solutions and products, and
ends with raising the awareness of and training the users as well as crypto contingency planning.
This module can also be consulted when only a cryptographic product is to be selected for one of the
possible areas of use. In this case, it is possible to leave out several of the steps described in the
following and only perform those that are relevant for the particular area of use.
In order to implement this module, it is necessary to have a basic understanding of the fundamental
cryptographic mechanisms. An overview of basic cryptographic terms can be found in S 3.23
Introduction to basic cryptographic terms.
Threat Scenario
Cryptographic procedures are used to guarantee
- confidentiality,
- integrity,
- authenticity and
- non-repudiation.
Therefore, the following threats to cryptographic procedures are primarily taken into account for IT
baseline protection:
- T 4.33 Poor-quality or missing authentication
- T 5.85 Loss of integrity of information that should be protected
- T 5.27 Repudiation of a message
- T 5.71 Loss of confidentiality of classified information
If cryptographic procedures are used, the following threats should also be taken into account for IT
baseline protection:
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000
A B C
A B C