OPS.1.1.7 System Management

Requirements for system management infrastructure and processes MUST be specified. In so doing, all the essential elements of system management MUST be taken into account. The security aspects of system management MUST also be considered from the start.

In addition, the interfaces of the IT systems to be managed MUST be documented, in part to ensure the compatibility of the system management solution at hand and the system(s) to be managed.

A system management solution and its underlying infrastructure MUST be planned appropriately. At minimum, planning MUST include the following:

• A detailed requirements analysis
• A meaningful rough concept
• A comprehensive implementation plan
• Milestones for quality assurance and acceptance

All the issues mentioned in the corresponding requirements specification and role and access control policy MUST be considered. The following aspects MUST be considered at minimum:

• Separation into appropriate areas for system management
• Access options to and by the system management solution
• System management authorisations on the systems to be managed
• Network connections for access to and by the system management solution
• Protocols for user access to the system management solution
• Protocols for communication between the system management solution and the systems to be managed
• Requirements that management systems tools must fulfil
• Interfaces for forwarding collected event or alarm messages
• Logging (including the required interfaces to a centralised logging solution)
• Vendor and developer support over the planned deployment period
• The option to apply patches to the system management solution and the systems to be managed
• Reporting and interfaces to overarching solutions
• Corresponding requirements to be fulfilled by the systems to be managed

All the components of a system management solution, including the systems to be managed, MUST be synchronised. System time MUST be synchronised for each system to be managed and for the system management solution via appropriate protocols.

As soon as a system management solution and the systems to be managed communicate via productive infrastructure, secure protocols MUST be used for this purpose. If this is not possible, a dedicated administration network (out-of-band management) MUST be used (see NET.1.1 Network Architecture and Design). If this is also not possible, complementary security mechanisms MUST be used at another level (e.g. tunnel mechanisms via encrypted VPN or comparable solutions).

Authentication between a system management solution and the systems to be managed MUST be two-way in nature. Authentication MUST be integrated into an overarching authentication concept. Authentication MUST be performed using secure protocols.

User access to a system management solution MUST be secured through:

• Secure and appropriate authentication and authorisation of the user
• Secure encryption of transmitted data

An appropriate authentication method MUST be selected. The selection process MUST be documented. The strength of the cryptographic methods and keys used MUST be regularly reviewed and adjusted as needed.

The system management solution MUST use an authorisation component to ensure that users can only perform actions for which they are authorised.

For system management, a security policy SHOULD be drawn up and continuously maintained. All persons involved in system management SHOULD be familiar with the policy. The security policy SHOULD be integral to their work. Regular and transparent reviews SHOULD be conducted to ensure that the policy requirements are being implemented. The results SHOULD be documented.

At minimum, the security policy SHOULD specify the following:

• The areas of system management that are to be realised via central management tools and services
• The system management tasks that are to be realised in an automated manner
• Configuration management for the data managed by the system management solution, e.g. versioning of configurations
• Specifications for network separation
• Specifications for access control
• Logging specifications
• Quality assurance specifications for the use of automation functions, e.g. scripts
• Specifications for protecting communication
• The basic operational rules for system management
• Specifications for coordination with network management, e.g. assignment of IP addresses or DNS names

Based on the security policy drawn up for system management, a system management concept SHOULD be established and continually maintained. In doing so, the following minimum aspects SHOULD be taken into account as required:

• Methods, techniques, and tools for system management
• Protection of access and communication
• Protection at the network level, in particular the assignment of system management components to security zones
• Scope of monitoring and alerting for each system to be managed
• Logging
• Automation, in particular the central distribution of configuration files to the systems to be managed
• Specifications for the development and testing of automation functions
• Reporting chains in the event of malfunctions and security incidents
• Provisioning of system management information for other areas of the organisation in question
• Integration of system management into contingency planning
• Required network transmission capacity of the system management solution

Detailed and implementation planning SHOULD be drawn up for system management solutions. It SHOULD consider all the items addressed in the respective security policy and system management concept.

Based on the security policies and the system management concept at hand, a concept SHOULD be drawn up for the secure operation of the system management solution and the underlying infrastructure.

The manner in which the performance of other operative units can be integrated and controlled SHOULD also be checked.

The IT Operation Department SHOULD regularly check the extent to which the data, configurations, and scripts managed by the system management solution correspond to the target state. At minimum, the following aspects SHOULD be checked in the gap analysis:

• The configuration of the system management solution
• The configuration of the systems to be managed
• The automation functions or scripts used

In the process, whether the aspects listed still meet the security policy and requirements specification SHOULD be reviewed. A comparison SHOULD also be made to determine whether the software version of the system management solution is up to date.

Actions performed by a system management solution on the systems managed SHOULD be triggered exclusively by the system management solution. For this purpose, only those management functions of the system management solution and the systems to be managed that are actually needed SHOULD be activated.

Management access to systems to be managed SHOULD only be obtained through the designated interfaces of the respective system management solution. If direct access is necessary to the systems to be managed (e.g. after a failure of one of these systems), both the direct access and all changes made in this context SHOULD be documented and entered into the system management solution to the extent necessary.

Software and configuration data for systems to be managed SHOULD be consistently managed in a configuration management system that provides versioning and change tracking. The associated documentation for configuration management SHOULD be complete and up to date at all times. The documentation required for this SHOULD be securely available from a central point and integrated into backup processes. The central configuration management used for this purpose SHOULD be maintained continuously and audited regularly.

All interfaces between the system management solution and other applications and services SHOULD be documented and fully managed in a configuration management solution. Functional changes to the interfaces SHOULD be coordinated between the relevant operational areas at an early stage and documented accordingly.

Configuration data for the systems being managed SHOULD be automatically distributed across the network, and it SHOULD be possible to install and activate it without interrupting operations.

The basic performance and availability parameters of a system management solution and the systems to be managed SHOULD be continuously monitored. For this purpose, the respective threshold values SHOULD be determined in advance (baselining). If defined threshold values are exceeded, the responsible personnel SHOULD be notified automatically.

For better error analysis, information from the status monitoring of other areas (e.g. from a separate “Networks” area) SHOULD also be considered to find the exact cause of disruptions.

Important events on systems to be managed and on the system management solution SHOULD be automatically transmitted to a central logging infrastructure and logged there (see OPS.1.1.5 Logging).

Important events SHOULD be defined for the following aspects at minimum:

• Failure or inaccessibility of systems to be managed
• Failure or inaccessibility of system management components
• Hardware malfunctions
• Login attempts on the system management solution
• Login attempts on systems to be managed
• Critical states or overload of the system management solution
• Critical states or overloads of systems to be managed

Event messages and logging data SHOULD be transmitted to a central logging system. Alarm messages SHOULD be transmitted as soon as they occur.

A system management solution SHOULD be integrated into its organisation’s contingency planning. To accomplish this, both the system management solution and the configurations of the systems being managed SHOULD be secured and integrated into restoration of service plans.

Communications between users and a systems management solution, as well as between the system management solution and the IT systems being managed, SHOULD be limited to strictly necessary connections using appropriate filtering techniques.

The consistency between a system's actual state and the state assumed by the corresponding system management solution SHOULD be checked regularly. If discrepancies are found, the state assumed by the system management solution SHOULD be restored.

System management communications between a system management solution and the systems to be managed SHOULD always be encrypted. The strength of the cryptographic procedures and keys used SHOULD be checked at regular intervals and adjusted as necessary.

A central system management solution SHOULD be operated in a manner that ensures high availability. To this end, the servers and tools used for the system management solution (including their network connections) SHOULD be designed redundantly.

An organisation's management network for system management SHOULD be physically separated from its functional (and especially its productive) networks.

The logging of security-relevant events in system management SHOULD be integrated into a security information and event management (SIEM). The events to be forwarded to the SIEM SHOULD be comprehensibly defined.

The requirements catalogue for selecting a system management solution SHOULD specify the necessary interfaces and transfer formats.

A system management solution SHOULD be monitored in an automated manner by a security vulnerability detection system.

Time synchronisation SHOULD be ensured for both an organisation's system management solution and the systems being managed across all its sites. A common reference time SHOULD be used for this purpose.

Security-relevant configurations of a system management solution and the systems to be managed SHOULD be regularly checked by suitable detection systems for deviations from the target state and for potential vulnerabilities.

Session content, particularly user activity on a system management solution and all instances of direct access to systems to be managed, SHOULD be continuously logged and regulated by a technical solution. Command-level activities (i.e. manual and automated commands) SHOULD be monitored and prevented if necessary.

During monitoring, alerts SHOULD be raised not only in the event of specific rule violations, but also in case of anomalies in user behaviour.

All administrative access to a system management solution SHOULD be secured through the use of jump servers.