OPS.1.1.2 Proper IT Administration

It MUST be ensured that only appointed deputies can access the IT systems to be supported. Emergency users with administrative rights should be set up for emergencies.

If employees assume administrative tasks within an IT environment, they MUST be trained, particularly in terms of the IT architecture and the IT systems and applications for which they are responsible. Administrators MUST be made familiar with the security provisions that apply in their organisation and are relevant to their work.

If administrators are relieved of their tasks, all their assigned personal administration credentials MUST be withdrawn. The passwords still known to employees who are being relieved of duties MUST be checked and these passwords MUST be changed.

Furthermore, whether employees being relieved of their duties have been appointed as contact persons for third parties (e.g. in contracts or as an Admin-C entry for Internet domains) MUST be checked. If this is the case, new contact persons MUST be specified and the third parties advised. The users of the IT systems and applications concerned MUST be informed that the previous administrator has left.

An organisation MUST be able to prove which administrator has carried out which administrative activities at any time. For this purpose, each administrator SHOULD have their own user ID. Administrator deputies SHOULD also receive their own user IDs.

Each login by an administrator ID MUST be logged.

Administrators MUST authenticate themselves through appropriate procedures before performing actions with administrative privileges.

Actions and activities that do not require elevated privileges MUST NOT be performed with administrative privileges.

Organisations MUST ensure that only administrators have access to administrative interfaces and functions. In particular, organisations MUST ensure that only administrators can make security-relevant changes to IT systems and applications.

Administration MUST be performed using secure protocols. The option to set up a separate administration network SHOULD be considered.

The competencies, tasks, and obligations of administrators SHOULD be defined in a binding manner in a work instruction or policy. The tasks allocated to different administrators SHOULD be distributed in such a way that overlapping responsibilities are avoided, but all the tasks to be performed are still assigned. These regulations SHOULD be updated at regular intervals. In particular, their specifications SHOULD prevent administrators from making unauthorised changes within the information domain in question, provided that the changes go beyond the tasks explicitly assigned to them and are not necessary to prevent a security incident or failure.

The basic requirements mentioned in this module SHOULD also be implemented consistently for employees with administrative tasks for individual specialised applications. The division of tasks between application and system administration SHOULD be clearly defined and documented in writing. Interfaces SHOULD be defined between the persons in charge of system administration and those in charge of specialised application administration.

If there is an administrative intervention in the operation of an application, this SHOULD be coordinated in advance with the department in question. The needs of the department SHOULD be taken into account.

Sufficient personnel and material resources SHOULD be provided in order to properly handle the administrative tasks at hand. This SHOULD take into account the fact that appropriate capacities must also be available for unforeseeable tasks.

Resource planning SHOULD be reviewed regularly and adapted to the current requirements.

Administrators SHOULD take part in training and further education measures. This SHOULD also consider technical developments that are not currently used, but may become important to a given organisation in the foreseeable future. Training activities SHOULD be supported by a training plan. This training plan SHOULD take into account the whole team in question so that all the necessary qualifications are covered by multiple members.

Administrators SHOULD regularly obtain information regarding the security of the applications, IT systems, services, and protocols they support, especially in connection with current threats and security safeguards.

System changes SHOULD be documented in an appropriate and transparent form. This documentation SHOULD include:

• which changes have been performed
• when the changes were performed
• who performed the changes
• the basis and reasons for the changes

Security-relevant aspects SHOULD be explained and highlighted in a transparent way.

IT systems SHOULD be maintained at regular intervals. The security aspects to be observed during maintenance and repair work SHOULD be regulated. The persons responsible for the maintenance or repair of equipment SHOULD also be specified. The maintenance tasks carried out SHOULD be documented.

There SHOULD be an overview of all the devices in use at a given organisation that could have an impact on information security. In addition to IT systems and ICS components, devices pertaining to the Internet of Things (IoT) SHOULD also be considered. Appropriate testing and approval procedures SHOULD be carried out before the devices are put into operation for the first time. The overview SHOULD be kept up to date and correspond with the documentation of administrative activities.

In situations involving increased protection needs, administrators SHOULD be subject to additional security vetting.

Different administration roles SHOULD be created for partial tasks. When differentiating among tasks, the type of data involved and the system architecture in place SHOULD be taken into consideration.

Access to administrative interfaces SHOULD be technically restricted with filtering and separation measures. Interfaces SHOULD not be accessible to persons outside the responsible administration teams. Administrative access to IT systems in other protection zones SHOULD only be established via a jump server in the respective administrator's current security zone. Access attempts from other systems or other security zones SHOULD be rejected.

For particularly security-critical IT systems, access to credentials with administrative authorisations SHOULD be implemented in a way that always requires two employees. In other words, one administrator SHOULD perform the administrative tasks at hand under the supervision of a second administrator.

Administrative activities SHOULD be logged. For particularly security-critical IT systems, all administrative access attempts SHOULD be logged consistently and completely. Executing administrators SHOULD not have authorisation to change or delete the recorded log files. The log files SHOULD be retained for an appropriate period of time.

Administrators SHOULD analyse which of the IT systems and networks they support are subject to high-availability requirements. For these areas, they SHOULD make sure that the components and architectures used, as well as the related operating processes, are appropriate for fulfilling these requirements.