Concepts and Procedures

Introduction

Cryptography is widely used as a means of ensuring confidentiality, integrity, and authenticity in information security. Cryptographic procedures are used to encrypt information so that its content cannot be read without the corresponding key. These can be symmetrical procedures, where the same key is used for encryption and decryption, or asymmetrical procedures, where one key is used for encryption and another for decryption.

In a heterogeneous environment, both the data an organisation stores locally and that which it transfers can be effectively protected by cryptographic procedures and techniques.

Further safeguards are needed at the organisational and procedural levels. The use of cryptographic procedures alone is not sufficient to guarantee the confidentiality, integrity, and authenticity of encrypted information.

Within the framework of a crypto concept, all the cryptographic procedures used and the associated safeguards are considered together. Only a holistic view of this subject enables effective protection through cryptography.

Crypto modules are a special feature that can be used for cryptographic procedures to meet increased protection requirements. The term "crypto module" refers to a product that offers the security function specified in a given crypto concept. Such products may consist of hardware, software, firmware, or a combination thereof. In addition, components such as memory, processors, buses, and power supplies are necessary to implement crypto processes. A crypto module may be used in a wide variety of IT or telecommunication systems in order to protect sensitive data and information.

Objective

This module describes how a crypto concept can be created and how information in organisations can be cryptographically secured.

Scoping and Modelling

Module CON.1 Crypto Concept must be applied once for the entire information domain under consideration. This module covers general requirements, organisational framework conditions, and procedures for cryptographic products and methods. The core IT tasks associated with the operation of crypto modules are not addressed here. In this regard, the requirements of the modules of layer OPS.1.1 Core IT Operation must be met.

Ways to cryptographically secure individual IT systems (e.g. laptops) or communication links at the application level (e.g. encryption or hashing of passwords in a database) are not included in this module either. These topics are covered in the corresponding modules of the APP Applications, SYS IT Systems and NET Networks and Communication layers.

Useful Resources

The International Organization for Standardization (ISO) deals with the topic of cryptography in ISO/IEC 27001:2013 (annex A.10) on the basis of two guidelines.

The BSI has produced “Leitfaden Erstellung von Kryptokonzepten” [Guidelines for Creating Crypto Concepts] and a "Musterkryptokonzept" [Crypto Concept Model], which can support organisations in creating their own crypto concepts.

The BSI Technical Directive “BSI-TR-02102: Crytographic Mechanisms: Recommendations and Key Lengths” should be observed when selecting encryption methods and key lengths.

The Information Security Forum (ISF) has developed requirements for crypto concepts in “The Standard of Good Practice for Information Security” (area TS2, "Cryptography”).

Introduction

The aim of data protection is to protect individuals so that the use of their personal data by third parties does not affect their fundamental rights. The constitution of the Federal Republic of Germany includes citizens' fundamental right to decide how their personal data is used. The federal and state data protection laws refer to this when they emphasise the protection of the right to informational self-determination. In Article 8, the EU Charter of Fundamental Rights directly describes the right to protection of personal data (paragraph 1), highlights the necessity of a legal basis for data processing (paragraph 2), and prescribes the monitoring of compliance with data protection regulations by an independent body (paragraph 3). The General Data Protection Regulation (GDPR) provides more details on the requirements of the Charter of Fundamental Rights. Article 5 of the GDPR, which states the basic principles for processing personal data (and specifies some of them as protection goals), is of central importance in this regard. The German Standard Data Protection Model (SDM) offers a method of systematically monitoring the required implementation of data protection regulations on the basis of seven data protection goals.

Objective

The aim of this module is to show how the requirements of the German Standard Data Protection Model relate to IT-Grundschutz.

Scoping and Modelling

Module CON.2 Data Protection is intended for users in Germany as a basic guide to identifying components that process or otherwise use personal or person-related data as part of the effort to determine protection needs. Each organisation should then assess whether the module should be applied not just to individual information domains or procedures, but to its entire undertaking.

The conference of the independent federal and state data protection agencies (also known as the Data Protection Conference, or DSK) developed the German Standard Data Protection Model as a concept that systematises the technical and organisational safeguards stated in the German and European legal regulations on the basis of data protection goals. On the one hand, the model is used by the bodies responsible for processing to systematically plan and implement required safeguards. It thus promotes the data protection-compliant design and organisation of information technology processes and applications. On the other hand, the model offers the data protection agencies a way to render a transparent, comprehensible, and robust overall assessment of a given method and its components using a uniform system. As a method, the SDM is suitable for regularly checking and professionally evaluating the effectiveness of the technical and organisational safeguards of a given data processing system on the basis of and in accordance with the criteria of the GDPR.

For the selection of appropriate technical and organisational safeguards, the SDM adopts the perspective of data subjects in asserting their fundamental rights, which is why it differs significantly from the viewpoint of IT-Grundschutz, which focuses primarily on information security and seeks to protect data-processing organisations. In the SDM, safeguards are selected based on the impairment that data subjects must accept as a result of a given organisation’s data processing activities.

Against this background, a distinction must be made between the selection of safeguards to ensure information security for organisations and the selection of safeguards to ensure data subjects’ rights. The IT-Grundschutz methodology primarily promotes information security; the SDM is meant to preserve data subjects' rights.

The SDM thus seeks to fulfil the following standards:

• it transfers requirements under data protection law into a catalogue of data protection goals
• it divides the considered methods into three components: data, IT systems, and processes
• it factors in the categorisation of data into three levels of information security requirements—“normal”, “high”, and “very high”—and supplements this classification with corresponding considerations at the level of processes and IT systems
• it offers a catalogue with standardised protective safeguards

Useful Resources

EU General Data Protection Regulation: “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)”, imposes fundamental, Europe-wide legal requirements for data protection compliance.

“The Standard Data Protection Model – A method for Data Protection advising and controlling on the basis of uniform protection goals” from the technology working group (AK Technik) of the Independent Data Protection Supervisory Authorities at the federal and state levels provides a method for implementing the requirements of data protection law.

Introduction

Organisations are storing ever increasing amounts of data and becoming increasingly dependent on it at the same time. If data is lost due to defective hardware, malware, or inadvertent deletion, for example, this may result in serious damage. Conventional IT systems such as servers or clients can be affected. However, routers, switches, and IoT devices can also store sensitive information, such as configurations. In this module, the term “IT system” therefore includes all forms of IT components that store sensitive information.

The effects of data loss can be minimised through regular data backups. A data backup is a means of ensuring that IT operations can be resumed quickly with a redundant copy of an organisation's data if some of the actively used data is lost. An organisation's data backup concept thus also plays a central role in contingency planning. The essential requirements of contingency planning, such as the maximum permissible data loss (recovery point objective, RPO), should be taken into account in backup concepts.

In addition to the creation of backups as a preventive measure, a comprehensive data protection concept should consider how completed backups will be restored on the original system. A wide variety of solutions can be used for backups, such as:

• Storage systems
• Tape drives
• Mobile removable media (USB pen drives or external hard disks)
• Optical storage media
• Online solutions

This module refers to such solutions collectively as "storage media for backups". In contrast, data mirroring via RAID systems is not considered a backup because the mirrored data is changed at the same time. This means that data mirroring via a RAID system can prevent a failure due to a hardware defect in individual storage media, but it cannot protect against unintentional overwriting or malware infections.

Objective

The aim of this module is to show how organisations can create a data protection concept and use it to adequately secure their data against loss.

Scoping and Modelling

CON.3 Backup Concept must be applied once for the entire information domain under consideration.

The module describes basic specifications that help ensure an appropriate backup concept. Requirements for the long-term storage and maintenance of electronic documents are not addressed. These are included in module OPS.1.2.2 Archiving.

This module also does not cover any system- or application-specific properties of backups. The backup concept requirements of this kind are covered in the corresponding modules of the NET Networks and Communication, SYS IT Systems, and APP Applications layers.

For deleting and destroying backups, module CON.6 Deleting and Destroying Data and Devices must be taken into account.

Useful Resources

The International Organization for Standardization (ISO) specifies requirements for backup concepts in ISO/IEC 27002:2013 (“12.3 Backup”).

Germany's digital association, Bitkom, has produced a guide to carrying out backups in the publication “Leitfaden Backup / Recovery / Disaster Recovery”.

Section “SY2.3 Backup” of “The Standard of Good Practice for Information Security” published by the Information Security Forum (ISF) provides guidelines for backups.

The National Institute of Standards and Technology details requirements for backups in NIST Special Publication 800-53 (“CP-9 Information System Backup”).

Introduction

The deletion and destruction of data and devices is a fundamental part of the lifecycle of information on storage media. In this module, the term "storage media" refers to analogue storage media such as paper or films, as well as digital storage media such as hard disks, SSDs, or CDs.

If storage media are discarded, the information contained on them could be disclosed if the media have not been securely deleted or completely destroyed. In addition to clients and servers, this can affect all IT systems (including IoT devices such as smart TVs) that purportedly only store insignificant information. IoT devices are often connected via a WLAN and store the access data this requires. This can be sensitive data that should not be disclosed to unauthorised persons.

Ordinary deletion processes based on operating system functions do not usually delete information in a secure way that prevents the data from being reconstructed. Special procedures are therefore required to securely delete information. However, storage media can only be deleted securely and effectively in their entirety, and this is usually only possible to a limited extent with individual files.

In addition, there are legal provisions (such as the German Commercial Code or data protection laws) that have far-reaching consequences for the deletion and destruction of documents. On the one hand, such laws call for retention periods that prohibit the early deletion of business transactions, balance sheets, or contracts, for example. On the other, legal entitlements to the secure and prompt deletion of data result from these legal provisions when, for example, personal data is affected.

Objective

This module describes how information in organisations can be securely deleted and destroyed and how a corresponding holistic concept can be created.

Scoping and Modelling

Module CON.6 Deleting and Destroying Data and Devices must be applied once to the entire information domain under consideration. It includes general process-related, technical, and organisational requirements for deletion and destruction. This module only covers the secure deletion and destruction of complete storage media, as the secure deletion of individual files is usually only possible to a limited extent.

Useful Resources

In the ISO/IEC 27001:2013 standard (annex A, “A.8.3 Media handling”), the International Organization for Standardization (ISO) provides guidelines for the handling of media and information, including on deletion and destruction.

The ISO has also produced publications on the destruction of storage media in the series of standards ISO/IEC 21964 (“Information technology – Destruction of data carriers”), which builds on the standard DIN 66399 ("Office and data technology – Destruction of data carriers”):

• Part 1: Principles and definitions
• Part 2: Requirements for equipment for destruction of data carriers
• Part 3: Process of destruction of data carriers

The National Institute of Standards and Technology provides guidelines for deletion and destruction in NIST Special Publication 800-88, “Guidelines for Media Sanitization”.

Introduction

Work-related travel is now part of everyday life in many organisations. To be able to continue working outside the normal work environment, people need to travel with both hard-copy documents and information technology such as laptops, smartphones, tablets, removable hard drives, or USB pen drives. For business trips, particularly those abroad, there are a multitude of threats and risks to information security that do not exist during normal business operations.

Each trip must be assessed separately since there is always a different threat level—depending on the combination of the purpose of the trip (e.g. a business meeting, conference, congress, or seminar), the duration, and the destination—which also affects the protection of business-critical information.

The threat landscape is particularly critical when travelling due to factors such as public networks that are not under the control of a given employee's organisation. This means that risks the organisation has already addressed may become relevant again. Depending on the destination country, the risks one faces on foreign trips is also often significantly higher than on domestic trips.

When employees are constantly travelling to different destinations with varying regulatory and legal requirements, it is not always easy to protect operational information. Legal requirements and border control checks can become stricter, for example, and thereby affect the preservation of data confidentiality. This leads to special information security requirements that depend on the type and duration of a given trip, as well as the destination. Specific political, societal, religious, geographical, climatic, legal, and regulatory considerations play a significant role in this regard.

Objective

This module describes ways to protect the confidentiality, integrity, and availability of all types of information which is taken on trips abroad, whether in electronic or physical form. The confidential information all travelling employees take with them in the form of knowledge is also the subject of this module. Furthermore, it outlines appropriate regulations and safeguards for handling sensitive information and data when travelling abroad. Areas to consider include basic framework conditions relating to IT, data protection and the law.

This module highlights the risks and requirements of specific scenarios that are directly related to the secure use of information technology, information, and devices when travelling abroad.

It is designed to be used by the persons in charge in an organisation as a guide to establishing appropriate security safeguards in the context of information security on such trips. It indicates the fundamental principles that should be taken into account in this regard. Many of these threats also apply when travelling domestically or, more fundamentally, when processing information in environments that are not under the control of the organisation in question.

Scoping and Modelling

Module CON.7 Information Security on Trips Abroad must be applied once to the information domain under consideration if employees are to carry or process sensitive information when travelling or temporarily working abroad.

The module encompasses the fundamental requirements which contribute to the appropriate protection of information on such trips. Protecting the confidentiality and integrity of sensitive information is just as important in this regard as it is at an organisation’s headquarters.

Threats and requirements relating to the local information domain in question are not taken into consideration here.

Since the process-related, technical, and organisational requirements that are specific to working while travelling are the focus of module CON.7 Information Security on Trips Abroad, the requirements in the layers NET Networks and Communication, SYS IT Systems, and APP Applications are not considered. All the necessary modules, especially SYS.2.1 General Client, NET.3.3 VPN and SYS.3.2.2 Mobile Device Management (MDM), must be considered separately.

The requirements of modules INF.9 Mobile Workplace and OPS.1.2.4 Teleworking, which cover similar topics, should also be considered and implemented.

The present module also overlaps with other modules and topic areas that are not taken into consideration here, including:

• fulfilment of data protection requirements
• preventive measures for the protection of information (including technical demands placed on portable IT systems with regard to emission or eavesdropping protection, for example)
• personal security

Useful resources

The “Initiative Wirtschaftsschutz” information portal provides further information on security on business trips on its website (https://www.wirtschaftsschutz.info).

Introduction

Many organisations face challenges they cannot adequately solve with ready-to-use software products. They need software solutions that are adapted to their individual requirements. Examples include highly specific software solutions for industry specialists (such as for controlling production plants) or IT applications that are adapted to an organisation's business processes (such as content management or identity management systems). That said, legacy systems that are no longer maintained by the original manufacturer can also be custom-developed for such purposes.

This individual software can be developed by an organisation itself or a third party. Software development plays a central role in this process when program code is developed or adapted to meet an organisation's requirements. It is essential that information security be taken into account throughout the software development process and not just at a later stage. This is the only way to guarantee the long-term information security of the resulting software solutions.

Software can be developed within the framework of traditional, self-contained projects or as a continuous activity without a fixed end point. In both cases, project management tools are often used in practice to coordinate and control software development. For this reason, the term "project" is used more frequently in this module and no distinction is made between project-based and continuous development, as the associated procedures and tools are similar.

Objective

This module deals with all the relevant security aspects that organisations must consider when developing software. It covers how an organisation can prepare and execute software development while identifying corresponding hazards and formulating requirements.

Scoping and Modelling

Module CON.8 Software Development must be applied once to each development project in the information domain at hand.

Software is often developed in a client-contractor relationship. This is reflected in two modules of IT-Grundschutz: APP.7 Development of Individual Software, which deals with the client side, and CON.8 Software Development, which covers the contractor side. The present module therefore covers the requirements to be met by contractors. The requirements relevant to software development (functional and non-functional requirements, including for secure procedures and security profiles) are dealt with from the client perspective within the framework of module APP.7 Development of Individual Software.

The present module does not provide complete instructions or general procedures for software development; instead, it focuses on the relevant aspects of information security in connection with software development. The module also does not cover aspects of patch and change management. For these subjects, please refer to module OPS.1.1.3 Patch and Change Management.

The acceptance of software that is commissioned or developed in-house, as well as the tests associated with this process, are covered in module OPS.1.1.6 Software Tests and Approvals. Further aspects of testing in the context of software development are dealt with in this module, CON.8 Software Development.

ORP.5 Compliance Management must also be considered, as it describes how legal and organisation-internal requirements (and those pertaining to the customer) should be taken into account.

If a software development process includes cryptographic aspects, the relevant requirements from module CON.1 Crypto Concept must be considered.

Useful Resources

The International Organization for Standardization (ISO) sets requirements for software development in the following standards, among others:

• ISO/IEC 27001:2013, appendix A.14.2, “Security in Development and Support Processes”
• ISO/IEC 25000:2014, “Systems and Software Quality Requirements and Evaluation – Guide to SQuaRE” (a general overview of the SQuaRE series of standards)
• ISO/IEC 25001:2014, “Planning and Management”
• ISO/IEC 25010:2011 "System and Software Quality Models" (requirements and guidelines)

The Information Security Forum (ISF) sets out requirements for secure software development in "The Standard of Good Practice for Information Security" (section "SD System Development").

The National Institute of Standards and Technology provides requirements for secure system design in Special Publication 800-160, "Systems Security Engineering, Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems".

The Special Interest Group "Process Models for Operational Application Development” of the German Informatics Society provides an overview of current information on application development in its publications.

Further information on threat modelling can be found in the scientific article "Threat Modelling in Software Development". This article was published for the conference “Sicherheit 2010: Sicherheit, Schutz und Zuverlässigkeit” [Security 2010: Safety, Security, and Reliability] of the German Informatics Society.

Introduction

Information is transmitted between senders and recipients through communication channels as various as personal conversations, telephone calls, letters, removable media, and data networks. Rules on the exchange of information ensure that confidential information is only passed on to authorised persons. Such rules are particularly necessary when information is transmitted via external data networks.

Objective

The objective of this module is to secure the exchange of information between various communication partners. This module can help establish a concept for secure information exchange.

Scoping and Modelling

Module CON.9 Information Exchange must be applied once to the entire information domain under consideration if information is to be exchanged with communication partners outside of the information domain.

The protection of network connections is dealt with in other modules of the IT-Grundschutz Compendium; see layer NET Networks and Communication. Requirements for removable media (see module SYS.4.5 Removable Media) and further processing in IT systems outside of an information domain are not considered in this module.

Useful Resources

The International Organization for Standardization (ISO) describes requirements for the exchange of information in its standard ISO/IEC 27001:2013, section 13.2.

Introduction

Web applications provide users with particular functions and dynamic (changing) content. For this purpose, web applications make documents and user interfaces available on a server (e.g. in the form of input masks) and deliver them on request to corresponding programs on clients such as web browsers. Web applications are usually developed on the basis of frameworks. Frameworks are reusable program templates for frequently recurring tasks. Frameworks are also available for security components.

Web applications must implement security mechanisms that ensure the protection of the information they process and prevent it from being misused. Some typical security components or mechanisms include authentication, authorisation, input validation, output encoding, session management, error handling, and logging.

Developers must be familiar with the relevant security mechanisms of their web applications. For this reason, the development process has a crucial influence on the security of software.

Objective

The aim of this module is to ensure the secure development of web applications and protect the information they process.

Scoping and Modelling

This module must be applied to any development project involving web applications in a given information domain.

It considers the specific hazards and requirements relevant to the development of web applications. Requirements for the secure use of web applications are not considered here. These can be found in module APP.3.1 Web Applications. General requirements for secure software development are also not covered here. These are addressed in module CON.8 Software Development.

Useful Resources

On its website, the Open Web Application Security Project provides guidance on securing web applications.

The Federal Office for Information Security (BSI) provides guidance on the use of cryptographic procedures in the document “Cryptographic Mechanisms: Recommendations and Key Lengths: BSI TR-02102”.

The Federal Office for Information Security (BSI) provides guidance on developing secure web applications in the document “Entwicklung sicherer Webanwendungen” [Development of Secure Web Applications].

The Federal Office for Information Security (BSI) provides companies with guidance on developing secure web applications in “Leitfaden zur Entwicklung sicherer Webanwendungen” [BSI Guide for the Development of Secure Web Applications].