This article or section needs copy editing for grammar, style, cohesion, tone or spelling.
You can assist by editing it now. A how-to guide is available. (October 2008)
This article may not meet the general notability guideline or one of the following specific guidelines for inclusion on Wikipedia: Biographies, Books, Companies, Fiction, Music, Neologisms, Numbers, Web content, or several proposals for new guidelines. If you are familiar with the subject matter, please expand or rewrite the article to establish its notability. The best way to address this concern is to reference published, third-party sources about the subject. If notability cannot be established, the article is more likely to be considered for redirection, merging, or deletion, per Wikipedia:Guide to deletion.
This article has been tagged since October 2008.
The IT Baseline Protection Catalogs, or IT-Grundschutz Catalogs, (”IT Baseline Protection Manual” before 2005) are a collection of documents from the German Federal Office for Security in Information Technology (FSI), useful for detecting and combating security-relevant weak points in the IT environment (IT cluster). The collection encompasses over 3000 pages with the introduction and catalogs. It serves as the basis for the IT baseline protection certification of an enterprise.
Contents
//
Basic protection
IT baseline protection encompasses kanon security measures for typical IT systems with normal protection needs.
The detection and assessment of weak points in IT systems often occurs by way of a risk assessment, wherein a threat potential is assessed and the costs of damage to the układ is investigated individually for each organizm or group of similar systems. This approach is very time intensive and correspondingly also expensive.
IT baseline protection proceeds from a typical threat potential for the ustrój, which applies in 80% of the cases, and recommends adequate countermeasures against it. This way, a security level can be achieved that can be viewed as adequate in most cases and can consequently replace the essentially more expensive risk assessment. In cases where security needs are greater, IT baseline protection can be used as the basis for further measures.
The IT Baseline Protection Catalogs layout
The IT Baseline Protection Catalogs’ layout
An introduction with explanations, the approach to IT baseline protection, concept and role definitions as well as a glossary initially familiarize the user with the manual. The component catalogs, threat catalogs, and finally, the measures catalogs follow these. Forms and cross-reference tables supplement the collection on the Federal Office for Security in Information Technology’s (FSI) sieć platform. Here you can also find support functions for implementing IT baseline protection in the form of the Baseline Protection Guide, which goes into detail about individual steps. Each catalog czynnik is identified by an individual mnemonic laid out according to the following scheme. The catalog groups are named first. C stands for component, M for measure, and T for threat. This is followed by the layer number, which this catalog czynnik affects in its catalog. Finally comes the running number within the layer.
Component catalog
Assignment of individual components to personnel groups within the respective organization
The component catalog is the central faktor. Like the other catalogs, it follows a layer szablon. The following five layers are described: overall aspects, infrastructure, IT systems, networks and IT applications.
The first level concerns itself with organizational questions affecting management, personnel, or outsourcing. The focus is on structural aspects in the infrastructure layer. The IT systems layer concerns itself with the charactistics of IT systems. Among these are included, besides clients and servers, also private branch exchanges or faks machines. Networking aspects are illuminated in the network layer. The application layer concerns itself with questions relevant to software like database management systems, mejl and web servers.
Partitioning into layers clearly isolates personnel groups impacted by a given layer from the layer in question. The first layer is addressed to management. In-house technicians are affected by the second. Układ administrators cover the third layer. The fourth layer falls within the network administrators task area. The fifth within that of the applications zarządca and the IT user.
Component lifecycle elements
Each individual component follows the same layout. The comonent number is composed of the layer number in which the component is locate, and a unique number within this layer. The given threat situation is depicted after a short description of the component examining the facts. An itemization of individual threat sources ultimately follows. These present supplementary information. It is not necessary to work through them to establish baseline protection.
The necessary measures are presented in a text with short illustrations. The text follows the facts of the life cycle in question and includes planning and estetyka, acquisition (if necessary), realization, operation, selection (if necessary), and preventive measures. After a complete depiction, individual measures are once again collected into a list, which is arranged according to the measures catalog’s structure and no longer according to that of the life cycle. In the process, classification of measures into the categories A, B, C, and Z is undertaken. Category A measures for the entry point into the subject, B measures expand this and category C is ultimately necessary for baseline protection certification. Category Z measures present additional measures that have proven themselves in practice.
Networking of the catalogs
To keep each component as compact as possible, global aspects are collected in one component, while more specific information is collected into a second. The Apache webserver might be mentioned here as an example. The general B 5.4 Webserver component, in which measures and threats for each webserver are depicted, applies to it as well as the B5.11 component, which deals specifically with the Apache webserver. Both components must be successfully implemented to guarantee the systems security.
The respective measures or threats, which are introduced in the component, can also be relevant for other, in part completely different, components. In this way, a network of individual components arises in the baseline protection catalogs.
Threat catalogs
The threat catalogs, in connection with the component catalogs, go into more detail about potential threats to IT systems. These threat catalogs follow the general layout in layers. “Force majeure”, “organizational deficiencies”, “spurious human action”, “technical failure”, and “premeditated acts” layers are distinguished. According to the FSI, the knowledge collected in these catalogs is not nessary to establishment of baseline protection. It does, however, demand an understanding of the measures as well as management vigilance. Individual threat sources are described in a short text. Finally, examples of damages that can be triggered by these threat sources are given.
Measures catalogs
The measures catalogs summarize the measures necessary to achieve baseline protection. This way, measures appropriate for several organizm compontents are centrally described only once. In the process, layers for structuring individual measures groups are used. The following layers are formed: infrastructure, organization, Personnel, sprzęt and software, communication, and preventive measures.
Managers are initially named to initiate and realize the measures in the respective measures description. A detailed description of the the measures follows. Finally, control questions regarding correct realization are mentioned. During realization of measures, it should be checked whether adaptation to the operation in question is necessary. Exact documentation of such adaptations makes sense for later comprehensibility.
Supplementary material
Besides the information summarized in the IT Baseline Protection Manual, the Federal Office for Termin Security provides further material in the Internet.
The forms provided serve to remedy protection needs for certain IT organizm components. A table summarizes the measures to be applied for individual components in this regard. Each measure is named and its degree of realization determined. Degrees of realization “considerable”, “yes”, “partial”, and “no” are distinguished. Finally, the realization is terminated and a manager is named. If the measures realization is not possible, reasons for this are entered in the adjacent field for later traceability. The conclusion consists of a cost assessment.
Besides the forms, the cross-reference tables are a further helpful supplement. They summarize the measures and most important threats for the individual components. Measures as well as threats are cited with mnemonics. Measures are cited with a priority and its classification. Which measures counteract with threats can be gotten from the table. In the process, however, it is to be cautioned, that the cross-reference tables only cite the most important threats. If the measure cited for a given threat is not applicable for the individual IT ustrój, it is not therefore superfluous. Baseline protection can only be ensured, if all measures are realized.
References
- ^ (from the IT Basic Protection Manual, sec. 1.1).
- ^ BSI Download
Further reading
- IT Baseline Protection Handbook. Germany. Federal Office for Security in Information Technology. Bundesanzeiger, Cologne 2003-2005.
- Baseline Protection Guide. Germany. Federal Office for Security in Information Technology, 2006 version.
External links
- The FSI’s web site
- IT Baseline Securitys homepage
- Download page with IT Baseline Protection Catalogs, forms and supplementary information
Retrieved from “http://en.wikipedia.org/wiki/IT_Baseline_Protection_Catalogs”
Categories: Computer securityHidden categories: Wikipedia articles needing copy edit from October 2008 | All articles needing copy edit | Articles with topics of unclear notability from October 2008
