Operations

Introduction

The ongoing administration of IT systems and components is fundamental to IT operations. System administrators configure IT systems and applications, monitor operations, and take measures in response to maintain the functionality and capability of their IT landscapes. They also adapt IT systems to changed needs. In so doing, system administrators fulfil some tasks in the field of security. Besides ensuring that IT systems remain available, they implement security safeguards and monitor their effectiveness. To this end, they have comprehensive authorisations, which is why it is very important for the security of an information domain that system administration itself be protected against unauthorised access.

Objective

The objective of this module is to show how the security requirements of IT applications, systems, and networks can be met by means of proper IT administration.

By implementing this module, an organisation can ensure that the activities required to secure its information domain are performed properly and systematically in system administration. At the same time, the organisation can react to the special threats that inevitably result from working with administrative privileges and being able to access sensitive areas of the organisation.

Scoping and Modelling

Module OPS.1.1.2 Proper IT Administration must be applied once to the entire information domain under consideration.

This module covers the overarching requirements that the administration process itself must fulfil. For the remote administration of IT systems using external interfaces, as well as for remote maintenance performed by the respective manufacturers or suppliers on devices and components, module OPS.1.2.5 Remote Maintenance should also be used.

The other modules of the OPS.1.1 Core IT Operation layer describe aspects of IT operations that are also relevant alongside this module. They should thus also be considered and modelled as a complement to this module.

The proper administration of users and rights is of particular relevance to the security of an organisation. As a consequence, this subject is also addressed in a separate module (see ORP.4 Identity and Access Management).

The requirements described in this module must also be applied if administrative tasks are performed on IT systems, applications, or platforms by third parties. Particular requirements for such cases are also described in the modules OPS.2.1 Outsourcing for Customers and OPS.3.1 Outsourcing for Service Providers.

Module OPS.1.1.2 Proper IT Administration refers to normal operations. In exceptional situations, particularly in the event of a possible IT attack and compromised IT systems, deviating requirements must be observed that are described in the corresponding modules of DER.2 Security Incident Management.

Aspects of patch and change management are not covered in this module either; they can be found in module OPS.1.1.3 Patch and Change Management.

Useful Resources

In the ISO/IEC 27001:2013 standard, the International Organization for Standardization (ISO) provides specifications for proper IT administration, particularly in the SY System Management area.

The BSI has published the four-volume High Availability Compendium.

Introduction

Updating an organisation's information technology components in a proper and timely manner poses a major challenge. In practice, existing vulnerabilities or operational disruptions are often traced back to inadequate patches and changes (or a lack thereof). Neglecting the subject of patch and change management therefore quickly leads to potential points of attack.

In general, the task of patch and change management is to design all the changes made to applications, infrastructure, documentation, processes, and procedures so that they are manageable and controllable.

Objective

This module shows how to design functional patch management in an organisation and how the corresponding process can be controlled and optimised.

Beyond patch management, however, the module also includes some core aspects of change management that are relevant to information security. Change management refers to the task of planning and controlling changes.

Scoping and Modelling

Module OPS.1.1.3 Patch and Change Management must be applied to the entire information domain under consideration.

The descriptions in this module focus on IT operations, and in particular on patch management, which is used to update software. The individual modules of the SYS IT Systems and APP Applications layers contain more specific requirements related to patch and change management.

Rather than addressing the entire subject of change management, this module only deals with the core aspects that pertain to information security. In larger organisations, it makes sense to structure change management systematically. Standards such as the change management process of the IT Infrastructure Library (ITIL) can be used for this purpose. Change management such as this need not be limited to IT; it can also encompass business processes and specialised tasks.

Requirements for testing and releasing patches and software are also not dealt with in detail in this module. They can be found in OPS.1.1.6 Software Tests and Approvals.

Useful Resources

The International Organization for Standardization (ISO) provides specifications relevant to patch and change management in the ISO/IEC 27001:2013 standard (section 12.1.2, "Change Management").

The IT Infrastructure Library (ITIL) provides guidance on setting up a change management process.

Introduction

Malware refers to programs that perform harmful functions on an IT system, usually without the knowledge or consent of the user. These harmful functions can have a wide range of purposes, ranging from potential espionage and extortion (using ransomware) to the sabotage and destruction of information, or even devices.

In principle, malware can be implemented on all operating systems and IT systems. In addition to traditional IT systems such as clients and servers, this includes mobile devices such as smartphones. Today, network components like routers and industrial control systems—and even IoT devices such as networked cameras—are also frequently threatened by malware.

On classic IT systems, malware is distributed mainly via e-mail attachments, manipulated web pages (drive-by downloads), or storage media. Smartphones are usually infected via the installation of malicious apps, but drive-by downloads are also possible. Furthermore, open network interfaces, incorrect configurations, and software vulnerabilities are frequent points of entry on all IT systems.

This module uses the term “virus protection program”. Here, “viruses” are a synonym for all types of malware. A virus protection program therefore refers to a program for protecting against any type of malware.

Objective

This module describes the requirements that must be met and implemented to protect an organisation effectively against malware.

Scoping and Modelling

Module OPS.1.1.4 Protection Against Malware must be applied once to the entire information domain under consideration.

This module describes the general requirements for protection against malware. Specific requirements for protecting particular IT systems in an organisation against malware are included in the relevant modules, particularly in the SYS layer IT Systems. If identified malware results in a security incident, the requirements of module DER.2.1 Security Incident Handling should be considered. The requirements of module DER.2.3 Clean-Up of Extensive Security Incidents help in removing identified malware and re-establishing a cleaned state.

The virus protection programs used within the framework of this module should also be taken into account in patch and change management (OPS.1.1.3 Patch and Change Management). Furthermore, the topic of protection against malware should be taken into account in the context of the modules ORP.3 Information Security Awareness and Training and CON.3 Backup Concept.

Useful Resources

The International Organization for Standardization (ISO) provides guidelines for protection against malware in the standard ISO/IEC 27001:2013, in particular in annex A, A.12.2 (“Protection from Malware”).

The Information Security Forum (ISF) provides guidelines for protection from malware in “The Standard of Good Practice for Information Security”, in particular in area TS1 ("Security Solutions").

Introduction

To ensure reliable IT operations, IT systems and applications should automatically log all (or at least some specific) events that are relevant to operations and security and make them available for analysis. Logging is used in many organisations as a means of promptly identifying hardware and software problems and resource bottlenecks. However, security problems and attacks on network services can also be traced on the basis of log data. Through forensic examination, evidence can be secured from such data after an attack on IT systems or applications has come to light.

In each information domain, log data is locally generated by a multitude of IT systems and applications. To get a complete overview of a given information domain, the event logs generated by various IT systems and applications can be sent to a dedicated logging infrastructure for central storage. Only then can the log data be selected, filtered, and analysed systematically in one central location.

Objective

The aim of this module is to ensure the secure collection of all relevant data so that it can be stored and provided in a suitable form for evaluation. This in turn facilitates the logging of as many security-relevant events as possible.

Scoping and Modelling

OPS.1.1.5 Logging must be applied once to the entire information domain at hand.

This module only considers overarching aspects that are required for appropriate logging. Logging for specific IT systems or applications is not dealt with here; it is described in the relevant modules of the IT-Grundschutz Compendium.

In many operating systems or applications, logging functions are already present or can be integrated through additional products. To safeguard these functions and stored log data, the underlying operating systems must be protected. However, this is not covered in this module.

Operating-system-specific modules such as SYS.1.2.2 Windows Server 2012 must be implemented.

Before implementing logging of security-relevant events, it is important that the related responsibilities and competencies be clearly defined and assigned. Particular attention should be paid to the principle of separation of duties. This topic is also not part of this module; it is covered in module ORP.1 Organisation.

In addition, this module must be distinguished from the detection of security-relevant events (see DER.1 Detecting Security-Relevant Events) and responses to security incidents (DER.2.1 Security Incident Handling). At most, these aspects are only addressed in passing in the present module.

The evaluation of log data and the secure, unchangeable, and reproducible long-term storage of such information is also described elsewhere (see DER.1 Detecting Security-Relevant Events or OPS.1.2.2 Archiving).

Finally, specifications on how to handle personal data are described in module CON.2 Data Protection.

Useful Resources

The Federal Office for Information Security (BSI) regulates the logging and detection of security-relevant events in “Mindeststandard des BSI zur Protokollierung und Detektion von Cyber-Angriffen” [BSI Minimum Standard for Logging and Detection of Cyber Attacks].

The International Organization for Standardization (ISO) specifies logging requirements in the ISO/IEC 27001:2013 standard (section A.12.4, “Logging and Monitoring”).

The Information Security Forum (ISF) provides guidelines for logging in “The Standard of Good Practice for Information Security” (section TM1.2, "Security Event Logging").

The National Institute of Standards and Technology (NIST) describes how logging can be used securely in Special Publication 800-92, “Guide to Computer Security Log Management”.

Introduction

The use of IT in organisations requires computerised data processing to be as error-free as possible, as the individual results can no longer be checked in most cases. Software of any kind must therefore be tested before it is put into operation. These tests must prove that software reliably provides the required functions and does not have any undesired side effects. When software is subsequently approved by the relevant organisational unit, basic permission is granted to use it in the respective organisation's production environment. At the same time, this organisational unit assumes responsibility for the IT process supported by the software.

Software can be tested at different stages of its lifecycle. For example, software tests can even become necessary during development, before approval for production operation, or within the scope of patch and change management. This applies to both custom and standardised software. Regression tests play a special role here because even if only minor aspects of software are changed, this can impact completely different characteristics and functions of the software. These effects are precisely what regression tests are designed to identify.

This module describes the testing and approval process for all types of software. The testing and approval process is characterised by the fact that it can be performed several times depending on the result.

Objective

This module is designed to ensure that software meets the technical and organisational requirements and the present protection needs of the entire organisation in question, or individual organisational units thereof. An essential aspect here involves systematically and methodically checking security-critical software for existing vulnerabilities.

Scoping and Modelling

OPS.1.1.6 Software Tests and Approvals must be applied once to the entire information domain under consideration.

Whilst module CON.8 Software Development refers to the software development process and the software tests it requires, this module describes the special requirements of test and approval management. In this context, test and approval management does not refer exclusively to software developed in-house or on behalf of a customer; it also includes the testing and approval of all the types of software described in APP.6 General Software, as well as all other software products covered by the APP Applications layer.

Software testing can also become part of patch or change management or software development. Corresponding requirements are specified in more detail in the modules OPS.1.1.3 Patch and Change Management and CON.8 Software Development.

Useful Resources

In ISO/IEC 27001:2013 (annex A.14, “System Acquisition, Development, and Maintenance”), the International Organization for Standardization (ISO) specifies requirements for secure system development (which also requires a test and approval process) and for test data. In addition, the ISO has published the standard ISO/IEC 29119-2:2013, “Software and Systems Engineering – Software Testing – Part 2: Test Processes”, which deals in detail with requirements for software testing.

The BSI has published the study “Durchführungskonzept für Penetrationstests” [Implementation Concept for Penetration Tests], which can be used as a basis for penetration tests, as well as the “BSI-Leitfäden zur Entwicklung sicherer Webanwendungen” [BSI Guidelines for the Development of Secure Web Applications], which also includes software tests.

In “The Standard of Good Practice for Information Security”, the Information Security Forum (ISF) lists aspects of testing and approval for all relevant requirements (areas).

The National Institute of Standards and Technology provides guidelines for software testing in NIST Publication 800-53, SA 11 ("Developer Security Testing and Evaluation").

The book The Art of Software Testing by Glenford J. Myers, Corey Sandler, and Tom Badgett can be consulted on the subject of software testing.

The Common Vulnerability Scoring System can be used as a scoring system to classify the severity of a vulnerability and thus present the results of software testing in terms of information security.

Introduction

Reliable system management is a basic requirement for operating state-of-the-art networked systems in a secure and efficient manner. To that end, system management activities must fully integrate all the relevant systems at hand. Appropriate safeguards must also be implemented to protect system management communication and infrastructure.

System management includes many important functions, such as system monitoring, system configuration, event handling, and logging. Another important function is reporting, which may be designed as a common platform for IT systems and network components. Alternatively, it may be implemented in a dedicated manner as a uniform platform or as part of individual system management components.

A system management solution consists of various system management components, such as agents that are operated on an underlying system management infrastructure. This solution is used to control the integrated systems to be managed via the corresponding interfaces of the respective information domain. Overall, system management consists of the combination of the solution, the underlying infrastructure, the systems to be managed, and corresponding operations.

Objective

The objective of this module is to establish information security as an integral part of system management. The module describes how system management can be set up and secured and how the associated communication can be protected.

Scoping and Modelling

OPS.1.1.7 System Management must be applied to the system management solution that is used in the information domain in question.

In order to create an IT-Grundschutz model for a specific information domain, all the modules must be considered in their entirety. As a rule, several modules must be applied to the topic or target object.

Among other topics, this module covers the following:

• The necessary system management components
• The conceptual tasks related to system management
• Logging from the point of view of system management
• Updating a system management solution

The following content is also significant, but dealt with elsewhere:

• Network management requirements (see NET.1.2 Network Management)
• Details regarding the protection of the underlying infrastructure and of IT systems to be managed, in particular their management interfaces (see SYS.2 Desktop Systems)
• Logging and archiving concepts (see OPS.1.1.5 Logging, OPS.1.2.2 Archiving)
• Updates (e.g. with additional software) and agents (see OPS.1.1.3 Patch and Change Management)
• User access to system management solutions (see ORP.4 Identity and Access Management, as well as OPS.1.2.5 Remote Maintenance and OPS.1.1.2 Proper IT Administration).

Useful Resources

No further information is available for module OPS.1.1.7 System Management.

Introduction

Archiving plays a special role in the document management process. On the one hand, digital documents are expected to be available until the end of a specified retention period. On the other, their confidentiality and integrity need to be preserved. In addition, the context must be maintained so that the respective stored sequence can be reconstructed.

For the entire duration of long-term storage, corresponding safeguards for information maintenance and, if required, measures for maintaining evidence must therefore be implemented.

The German IT terms for “electronic archiving” and “electronic long-term storage” are sometimes used synonymously. For better clarity, the terms “archiving” and “digital long-term archive” are used in this module. An IT process for storing electronic documents is referred to as an “archive system”, “digital archive”, or “long-term storage”. The retention period of documents depends on the applicable legal regulations and other requirements, as well as on the purpose of the data involved.

In this module, the term “documents” includes data and digital documents unless these are expressly used with a differing meaning.

From a German legal perspective, the term “archiving” is substantiated and documented by the federal and state archiving laws. "Archiving" in the legally correct sense refers solely to government documents. It refers to how the documents of an authority are to be segregated and preserved by a competent governmental facility (Federal Archive) for an unlimited period of time as soon as they are no longer needed for the purposes of that authority (see Articles 1 and 2 of the German Federal Archives Act (BArchG)). This type of archiving should distinguished from the time-limited retention considered in this module.

Objective

This module describes how digital documents can be securely archived for the long term such that they are reproducible and cannot be changed. To this end, it defines requirements that can be used to securely plan, implement, and operate an archive system.

The storage of paper documents is not considered in this module, but requirements are made as to how these can be digitised and archived.

Scoping and Modelling

Module OPS.1.2.2 Archiving must be applied once to any information domain that involves long-term archiving of electronic documents. Long-term archiving may be necessary due to external or internal requirements, or a system for long-term archiving of electronic documents may already be in operation.

This module does not deal with archiving for an unlimited period of time in the sense of Germany's federal and state archive laws.

It describes security safeguards with which electronic documents can be stored and preserved for the long term within the framework of the applicable retention periods. Safeguards for operative backups are not addressed in this module. Requirements in this regard are covered in CON.3 Backup Concept.

Long-term digital storage consists of individual components, such as a database. Detailed descriptions of how such components can be operated securely are not covered in this module. The requirements of the corresponding modules, such as APP.4.3 Relational Database Systems, SYS.1.1 General Server, and SYS.1.8 Storage Systems should be considered in this regard.

Useful resources

In its publication “Bekanntmachung zur elektronischen Signatur nach dem Signaturgesetz und der Signaturverordnung: Auflistung geeigneter Algorithmen und Parameter” [Announcement on Electronic Signatures Under the Digital Signature Act and the Digital Signature Ordinance: List of Suitable Algorithms and Parameters], the Federal Network Agency for Electricity, Gas, Telecommunications, Post and Railway (BnetzA) lists algorithms and parameters that have been classified as suitable.

The German Institute for Standardisation (DIN) defines criteria for trustworthy digital long-term archives in DIN 31644:2012-04, “Information and Documentation – Criteria for Trustworthy Digital Archives”. DIN 31647:2015-05, “Information and Documentation – Preservation of Evidence in Cryptographically Signed Documents”, defines technical and security requirements for the long-term storage of digitally signed documents while preserving the legal force of digital signatures.

In its technical guideline BSI TR-03138, "RESISCAN: Replacement Scanning”, the BSI has compiled the security-relevant technical and organisational measures that must be taken into account for replacement scanning.

In the technical guideline BSI TR-03125, "TR-ESOR: Preservation of Evidence in Cryptographically Signed Documents” (including its annexes), the BSI provides a guideline that describes how electronically signed data and documents can be stored in a trustworthy manner—that is, in the sense of the legally effective preservation of evidential value—over long periods of time until the end of the respective retention periods.

Introduction

Teleworking is understood to refer to all tasks that are performed in part or entirely outside of the business premises and buildings of an employer using information and communication technology. In home-based teleworking, employees regularly alternate between a home office and the workplace of their employer on a daily or hourly basis.

Objective

The objective of this module is to protect information that is stored, processed, and transmitted during teleworking. To this end, it presents typical threats and defines special requirements for secure teleworking.

Scoping and Modelling

Module OPS.1.2.4 Teleworking must be applied to every teleworking location.

This module concentrates on the form of teleworking that occurs in the home environment (home-based teleworking). It is assumed that a secure telecommunication link is available between a given home workstation and the corresponding organisation to allow suitable information to be exchanged and data to be accessed on the organisation's servers. The requirements of this module cover the following three areas:

• the organisation of teleworking
• the employee's workstation computer
• the communication link between the teleworking computer and the organisation in question

Security requirements for the infrastructure of teleworking locations are not included in this module; these are described in module INF.8 Working from Home. Requirements for non-fixed workplaces can be found in module INF.9 Mobile Workplace.

Detailed recommendations on how to configure and secure IT systems are not covered by this module. Information on this is included in SYS.2.1 General Client, as well as in the operating-system-specific modules. Other security aspects relevant to teleworking, such as for WLAN, are considered in the modules of the sublayers NET.2 Radio Networks and NET.4 Telecommunication.

If data modified during telework is not stored directly on the organisation's IT systems, the requirements for carrying out backups must be specified. Corresponding requirements are included in module CON.3 Backup Concept.

Useful Resources

The International Organization for Standardization (ISO) provides information on how to deal with teleworking in the standard ISO/IEC 27001:2013, especially in annex A, A.6.2.1 (“Mobile Device Policy”) and A.11.2.6 (“Security of Equipment and Assets Off-Premises”.

The Information Security Forum (ISF) also provides guidelines on teleworking in “The Standard of Good Practice for Information Security”, especially in Area PA2 ("Mobile Computing").

The National Institute of Standards and Technology (NIST) has published NIST Special Publication 800-46, “Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security”.

Introduction

The term remote maintenance refers to when an external IT system is used to access IT systems and the applications running on them. This access can facilitate configuration, maintenance, or repair work, for example.

There are different ways to carry out remote maintenance. Remote client maintenance often involves transmitting the keyboard and mouse signals from an administrator's IT system to a remote IT system. The remote IT system then transmits its screen output back to the administrator's IT system. The administrator can thus perform actions on the remote IT system as if they were on site (active remote maintenance). In the case of remote server maintenance, the input and output of a console is often transmitted.

In passive remote maintenance, only the screen contents of an IT system are transmitted to an administrator. The administrator gives instructions to a user on site, who carries them out under the administrator's supervision. However, this approach usually proves to be very time-consuming and cumbersome in practice, which is why IT departments are often granted full access to IT systems.

Since many IT systems are located beyond the reach of their administrators (e.g. in remote data centres, industrial facilities, or an off-site location without IT staff), remote maintenance is used in many organisations. Remote maintenance often involves accessing an organisation's internal IT systems and applications through insecure networks. Because of the far-reaching possibilities for intervention in these IT systems and applications, securing remote maintenance components is particularly important.

Objective

The aim of this module is to protect information that is stored, processed, and transmitted during remote maintenance, along with the remote maintenance interfaces of IT systems. For this purpose, it presents requirements that relate equally to the functions of active and passive remote maintenance.

Scoping and Modelling

This module must be applied to all the target objects for which remote maintenance is used in the information domain under consideration.

It covers remote maintenance mainly from the point of view of an IT department and provides advice for administrators on how remote maintenance may be used. It is important that information security be guaranteed holistically in all lifecycle phases. The security aspects of the communication links and the authentication mechanisms used, along with the protection of remote maintenance access, are important components of the module. Nevertheless, it does not cover all the relevant aspects of the business processes associated with remote maintenance. In particular, the modules OPS.1.1.3 Patch and Change Management, ORP.3 Awareness and Training in Information Security, CON.1 Crypto Concept, and CON.3 Backup Concept should also be considered. The requirements of the NET Networks and Communication module layer must also be implemented in areas where they relate directly to remote maintenance.

If remote maintenance is carried out by an external service provider, module OPS.2.1 Outsourcing for Customers must also be observed. If cloud-based remote maintenance products are used, the general requirements from OPS.2.2 Cloud Usage must also be met.

Requirements for protecting remote maintenance using firewalls are not part of this module. These are included in module NET.3.2 Firewall.

Fundamental aspects of IT administration are also not included in this module. These can be found in module OPS.1.1.2 Proper IT Administration.

Useful Resources

In its publication “Grundregeln zur Absicherung von Fernwartungszugängen” [Basic Rules for Securing Remote Maintenance Access], the Federal Office for Information Security describes how remote maintenance access can be kept secure.

In its publication “Fernwartung im industriellen Umfeld” [Remote Maintenance in Industrial Environments], the Federal Office for Information Security describes how remote maintenance access can be kept secure in an industrial environment.

Introduction

Networked IT systems often require synchronous states. In most cases, the time serves as a reference. However, the internal clocks of IT systems can deviate from the actual time. The Network Time Protocol (NTP) is used to regularly determine a reference time of central timers via network connections and to adjust internal clocks accordingly.

In networks, precise time synchronisation makes it possible to apply uniform time stamps to information—in order to arrange data chronologically, compare data, or limit access rights, for example. This is the only way to achieve things like correlating time sequences from log data of different IT systems. Accurate time information is also important in the field of cryptographic protocols. Furthermore, synchronising all timers accurately is essential in OT networks.

NTP clients obtain time information from NTP servers. NTP servers can in turn obtain time information from other NTP servers as NTP clients. This creates a hierarchical time distribution (in “strata”). At the top are NTP servers that obtain their time from precise sources (e.g. an atomic clock or a GPS or DCF77 receiver). These NTP servers are called stratum-1.

The NTP service uses methods to determine the deviation of a system clock from external time sources even in the case of deviating responses from different time sources. For example, it ignores time information from a source that suddenly deviates significantly from its own system time.

Control messages allow clients to request status information or change the behaviour of an NTP server, including across the respective network.

NTP messages are usually transmitted in an unsecured form. NTP does, however, offer the option to protect a message with cryptographic keys so that the message cannot be changed without authorisation.

Objective

The aim of this module is to secure NTP servers and clients in such a way that the IT systems in a given information domain can reliably determine the time and adjust their clocks accordingly.

Scoping and Modelling

OPS.1.2.6 NTP Time Synchronisation must be applied to every IT system that uses NTP in the information domain at hand.

In order to create an IT-Grundschutz model for a specific information domain, all the modules must be considered in their entirety. As a rule, several modules must be applied to a given topic or target object.

This module covers:

• Planning for the use of the NTP protocol
• Operation of NTP servers
• Operation of NTP clients

The following content is also significant, but dealt with elsewhere:

• General requirements for the operation of servers (see SYS.1.1 General Server)
• General requirements for the operation of clients (see SYS.2.1 General Client)

Useful Resources

No further information is available for module OPS.1.2.6 NTP Time Synchronisation.

Introduction

Within the framework of outsourcing, organisations (outsourcing customers) outsource business processes and services entirely or partially to external service providers (outsourcing service providers). Outsourcing can involve the use and operation of hardware and software. A service can be provided on the customer's premises or at an external operating facility of the outsourcing service provider. Typical examples involve the operation of a data centre, an application, or a web site. Outsourcing is a generic term that is often supplemented by other terms such as "hosting", "housing", or "colocation".

Regardless of what is outsourced, every outsourcing arrangement binds the customer to the external service provider and the quantity and quality of its services. For the customer in particular, this relationship is associated not only with opportunities, but also with considerable risks. These include a high degree of dependency and the loss of in-house knowledge, as well as of ways to control and guide operations. Information security aspects must therefore be taken into consideration appropriately at every stage of an outsourcing arrangement.

Objective

This module seeks to ensure that all the security objectives of a given outsourcing customer are still met after its business processes or services have been handed over to an outsourcing service provider. The agreed security level should be consistently maintained or improved regardless of outsourcing. Outsourcing must not result in any uncontrollable risks for the outsourcing organisation with regard to information security. The focus of this module consists of requirements that outsourcing customers should consider and meet during every phase of an outsourcing project.

Scoping and Modelling

Module OPS.2.1 Outsourcing for Customers must be applied separately from the user perspective to each outsourcing service provider that provides services to one or more of a given customer's target objects.

This module includes threats and security requirements from the outsourcing customers’ point of view and is limited to the requirements regarding the protection of information on the part of the outsourcing organisation.

Transmission paths to outsourcing service providers are not covered here.

The use of cloud services is dealt with in module OPS.2.2 Cloud Usage. Module OPS.2.1 Outsourcing for Customers module is not applicable to such cases.

Module OPS.2.1 Outsourcing for Customers also does not apply to service providers (such as porter services or cleaning staff) that perform tasks on behalf of a customer without assuming responsibility for a target object. Since these service providers nevertheless have access to target objects, they must be integrated into the customer's security concept in line with IT-Grundschutz. This integration is to be carried out at the requirement level—that is, via the requirements for third-party personnel, gatekeepers, security services, and cleaning staff as found in modules ORP.2 Personnel and INF.1 Generic Building, for example.

Useful Resources

The International Organization for Standardization (ISO) provides guidelines for the management of service providers in the ISO/IEC 27001:2013 standard (section A.15.2, “Supplier Service Delivery Management”). DIN ISO 37500:2015-08 provides further information on dealing with service providers under “Guidance on Outsourcing”.

The Information Security Forum (ISF) defines various requirements (SC1) for service providers in “The Standard of Good Practice for Information Security”.

Germany's digital association Bitkom provides information on how business processes can be outsourced to service providers in “Leitfaden Business Process Outsourcing: BPO als Chance für den Standort Deutschland” [Guide to Business Process Outsourcing: BPO as an Opportunity for Germany as a Business Location].

Bitkom has also published guidance on the legal aspects of outsourcing in the "Leitfaden Rechtliche Aspekte von Outsourcing in der Praxis" [Guide to Legal Aspects of Outsourcing in Practice].

The National Institute of Standards and Technology (NIST) lists requirements for service providers in NIST Special Publication 800-53.

Introduction

In the context of cloud computing, IT services are provided, used, and billed over a network in arrangements that adapt to customers' changing requirements. These services are offered and used solely by means of defined technical interfaces and protocols. The range of the services offered within the framework of cloud computing covers the entire spectrum of information technology, including infrastructure (e.g. computing power, storage space), platforms, and software.

Cloud computing offers many advantages: IT services can be used in a scalable and flexible manner based on one's current needs and billed according to the range of functions, duration of use, and number of users in question. The specialised knowledge and resources of cloud service providers can also be accessed, which frees up internal resources for other tasks. In practice, however, the benefits that organisations expect from cloud use often fail to fully materialise. This is usually because factors critical to success were not sufficiently considered in advance. Cloud services must therefore be strategically planned and (security) requirements, responsibilities, and interfaces carefully defined and agreed. Awareness and understanding of the necessary changes in roles, both on the part of IT operation departments and the users in organisations that utilise cloud services, are also important success factors.

In addition, the topic of cloud governance should be considered when introducing cloud services. Critical areas here include the implementation of multi-client capability, contractual arrangements, ensuring the portability of different services, billing of the services used, monitoring of the rendering of services, security incident management, and numerous aspects of data protection.

Objective

This module describes requirements that facilitate the secure use of cloud services. It is aimed at all organisations that already use such services or want to use them in the future.

Scoping and Modelling

Module OPS.2.2 Cloud Usage must be applied to all cloud services. If an organisation uses different cloud services providers, the module must be applied once to each provider. The interface between cloud service providers is also covered in this module and must be examined for all cloud services.

Cloud services represent a special form of outsourcing in almost all delivery models, with the exception of on-premise private clouds (see module OPS.2.1 Outsourcing for Customers). The threats and requirements described in Module OPS.2.2 Cloud Usage are therefore also often frequently applied to outsourcing. However, cloud services have some special features that are only found in this module. Module OPS.2.1 Outsourcing for Customers is therefore not applicable to cloud services.

The threats and requirements described in this module apply regardless of the service and delivery model used.

Security requirements with which providers can protect their cloud services are not the subject of this module. Threats and specific security requirements that must be considered relevant due to the connection of a cloud service via corresponding application programming interfaces (APIs) are also not considered in this module.

Differentiation from Conventional IT Outsourcing

When the work, production, or business processes of an organisation are outsourced, they are dealt with completely or partially by external service providers. This is an established part of organisational strategies today. In most cases, conventional IT outsourcing is designed so that all the infrastructure rented is used exclusively by a single customer (single-tenant architecture) even if outsourcing providers usually have several customers. Moreover, outsourcing contracts are most often concluded over longer periods of time.

Using cloud services is similar to conventional outsourcing in many respects, but there are also several differences which have to be taken into account:

• For economic reasons, several users often share a joint infrastructure in a cloud.
• Cloud services are dynamic and thus scalable in both directions within much shorter periods. Cloud-based offerings can thus be adapted more quickly to the user’s actual needs.
• The cloud services used are usually controlled by the cloud user via a web interface. This means that the user can automatically tailor the services used to their individual needs.
• The technologies used for cloud computing make it possible to distribute IT services dynamically over multiple locations that can be geographically dispersed, including both within and outside of one's home country.
• The customer can easily manage the services used and their resources via web interfaces or other suitable interfaces, which requires little interaction with the provider.

Useful Resources

In its publication “Cloud Computing Compliance Controls Catalogue (C5)”, the BSI describes criteria for assessing the information security of cloud services.

The Cloud Security Alliance (CSA) provides recommendations for the use of cloud services in its “Security Guidance for Critical Areas of Focus in Cloud Computing”.

The National Institute of Standards and Technology (NIST) provides recommendations on the use of cloud services in NIST Special Publication 800-144, “Guidelines on Security and Privacy in Public Cloud Computing”.

The European Union Agency for Network and Information Security (ENISA) has published the advanced document "Cloud Computing: Benefits, Risks, and Recommendations for Information Security".

In section SC 2 ("Cloud Computing") of “The Standard of Good Practice for Information Security”, the Information Security Forum (ISF) provides guidelines for the use of cloud services.

Introduction

Within the framework of outsourcing, service providers handle business processes and services either in part or entirely on behalf of outsourcing customers. Outsourcing can involve the use and operation of hardware and software, and services can be provided on the outsourcing customer's premises or at an external operating facility of the outsourcing service provider. Typical examples involve the operation of a data centre, an application, or a web site. Outsourcing is a generic term that is often supplemented by other terms such as "hosting", "housing", or "colocation".

Regardless of the services actually taken over, outsourcing requires a close relationship between the service provider and the customer. This means the outsourcing service provider is not insulated from the risks of an outsourcing relationship. In addition, it must implement the risk-mitigating security requirements defined by outsourcing customers (see module OPS.2.1 Outsourcing for Customers). This is because it is also in the interest of the outsourcing service provider to provide the agreed service and maintain the agreed security level. If the requirements placed on the outsourcing service provider are not met, there is a risk of high contractual penalties and possibly further legal consequences. Along with financial consequences, this can also cause lasting damage to the provider's reputation.

Objective

The module describes the requirements that outsourcing service providers must meet in order to provide the level of security demanded by outsourcing customers and avoid uncontrollable risks that might result from these business relationships. This module concentrates on requirements that address the processes of planning, implementing, and controlling information security aspects within the framework of outsourcing from the service provider’s point of view.

Scoping and Modelling

Module OPS.3.1 Outsourcing for Service Providers must be applied from the service provider's perspective to any outsourcing customer that obtains services from an outsourcing provider.

The module contains security requirements that service providers should fulfil when offering outsourcing services.

The protection of transmission channels between service providers and the outsourcing customers is not addressed within the framework of this module.

The use of outsourcing services from the customer's perspective is covered in OPS.2.1 Outsourcing for Customers.

Useful Resources

The International Organization for Standardization (ISO) provides guidelines for the management of service providers in the ISO/IEC 27001:2013 standard (annex A.15.2, “Supplier Service Delivery Management”). DIN ISO 37500:2015-08 provides further information on dealing with service providers under “Guidance on Outsourcing”.

The Information Security Forum (ISF) defines various requirements (SD1.1, SA2.2, SC1.2, SC2.2, LC1.1, BC1.1) for service providers in “The Standard of Good Practice for Information Security”.

Germany's digital association Bitkom provides information on how business processes can be outsourced to service providers in “Leitfaden Business Process Outsourcing: BPO als Chance für den Standort Deutschland” [Guide to Business Process Outsourcing: BPO as an Opportunity for Germany as a Business Location].

Bitkom has also published guidance on the legal aspects of outsourcing in the "Leitfaden Rechtliche Aspekte von Outsourcing in der Praxis" [Guide to Legal Aspects of Outsourcing in Practice].

The National Institute of Standards and Technology (NIST) lists requirements for service providers in NIST Special Publication 800-53.