S 3.202 General stand-alone IT systems
Description
This module considers an IT system not networked to any other IT system. It may be equipped with any operating system. The IT system can be run on any platform; it may consist of a PC with or without a hard disk, or it may equally be a Unix workstation or an Apple Macintosh. For example, the IT system may have drives for diskettes, CD-ROMs, DVDs, or other drives for removable data media, as well as other peripheral devices. If the client has further interfaces for data exchange, such as USB, Bluetooth, WLAN, these need to be protected in line with the organisation's security policies, as set out in the relevant modules. If present, a printer is connected directly to the IT system.
This chapter provides an overview of the threats and security safeguards typical for stand-alone IT systems. This overview does not depend on the operating system used. For this, the supporting modules of the IT-Grundschutz Catalogues must be taken into account.
Threat scenario
The following typical threats to the IT-Grundschutz of stand-alone IT systems are assumed to exist:
Force Majeure
| T 1.1 | Loss of personnel |
| T 1.2 | Failure of the IT system |
Organisational Shortcomings
| T 2.1 | Lack of, or insufficient, rules |
| T 2.7 | Unauthorised use of rights |
| T 2.21 | Inadequate organisation of the exchange of users |
Human Error
| T 3.3 | Non-compliance with IT security measures |
| T 3.6 | Hazards posed by cleaning staff or outside staff |
| T 3.8 | Improper use of the IT system |
| T 3.16 | Incorrect administration of site and data access rights |
| T 3.17 | Incorrect change of PC users |
Technical Failure
| T 4.1 | Disruption of power supply |
| T 4.7 | Defective data media |
Deliberate Acts
| T 5.1 | Manipulation or destruction of equipment or accessories |
| T 5.2 | Manipulation of information or software |
| T 5.4 | Theft |
| T 5.9 | Unauthorised use of IT systems |
| T 5.18 | Systematic trying-out of passwords |
| T 5.19 | Abuse of user rights |
| T 5.20 | Misuse of administrator rights |
| T 5.23 | Malicious software |
Method recommendation
To secure the information system examined, other modules must be implemented in addition to this module, with these modules being selected based on the results of the IT-Grundschutz modelling process.
The bundle of security safeguards relating to the field of "General stand-alone IT system" are presented in the following. The safeguards mentioned here must be implemented partially in any case, even if this IT system is only used by one person. If several users are to work with the IT system, administrating the computer and separating the users are required additionally. In this case, the safeguards and threats relevant to multi-user operations must be taken into consideration as well.
Depending on the operating system in use, this module might need to be supplemented with additional safeguards described in other modules.
The following steps should be taken in respect of the IT security in connection with the use of stand-alone workstation computers:
- Policies regarding the use of stand-alone IT systems
The stipulation of binding policies is required for the secure use of IT systems. For example, this includes the questions of who may be allowed to use the system for which purpose and which data may be accessed in what way. This work is performed within the framework of implementing the module S 1.9 Hardware and software management.
- Secure installation of stand-alone IT systems
Carefully selecting the operating system and software components, as well as installing these securely are required in order to exclude the risk caused by accidental operation or deliberate misuse of the IT systems. The safeguards to be taken at this point strongly depend on the operating system used, which is why they must be implemented within the framework of implementing the corresponding modules, e.g. S 3.4 Unix client or S 3.9 Windows XP client. In this connection, safeguard S 4.15 Secure log-in is of particular importance, since the technical protection of stand-alone systems is mainly based on a suitable access control. Additional safeguards are first and foremost required if several users with different authorisations are to access the same IT system.
- S 2.63 Establishing access rights
- S 3.18 Log-out obligation for PC users
- S 4.41 Use of appropriate security products for IT systems
- Secure configuration of the installed components
Depending on the security requirements, the software components needed may require different configurations. The safeguards to be taken here also depend on the operating system used, which is why they must be implemented within the framework of implementing the corresponding modules. Additional safeguards are also required here if the rights of several users need to be separated. Safeguard S 4.7 Change of preset passwords must also be taken into consideration, since access control very frequently is illusory due to the fact that the passwords used are generally known.
- Secure operation of stand-alone IT systems
One of the most important security safeguards when operating today's client systems is to install and permanently update a virus scanner. In order to be able to detect attempted attacks and misuse, organisational safeguards especially are required for stand-alone IT systems. The required safeguards are implemented within the framework of implementing the modules S 1.6 Protection against malware and S 1.9 Hardware and software management and therefore need no further consideration here. Specific safeguards for stand-alone systems first and foremost include S 4.4 Correct handling of drives for removable media and external data storage and S 4.30 Utilisation of the security functions offered in application programs.
- Data backup for stand-alone IT systems (see S 6.32)
The data backup procedure and the amount of data backed up depend on the operational scenario of the IT system (see safeguard S 6.32 Regular data backup).
The following safeguards must be implemented for the general stand-alone IT system:
Planning and design
| S 2.23 | (Z) | Issue of PC Use Guidelines |
| S 2.63 | (A) | Establishing access rights |
| S 4.41 | (Z) | Use of a appropriate security products for IT systems |
Implementation
| S 4.7 | (A) | Change of preset passwords |
| S 4.15 | (A) | Secure log-in |
Operation
| S 2.22 | (Z) | Escrow of passwords |
| S 3.18 | (A) | Log-out obligation for PC users |
| S 4.2 | (A) | Screen lock |
| S 4.4 | (C) | Correct handling of drives for removable media and external data storage |
| S 4.30 | (A) | Utilisation of the security functions offered in application programs |
Contingency Planning
| S 6.32 | (A) | Regular data backup |