Transcript Kein Folientitel

Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
IT Security - Regulations and Technical Aspects
Security requirements, data protection and management
The following presentations have been used for System Administrator
training at FZK and are thus specific to their environment. However
many features will be common to most institutes and thus the slides
could make a good basis for producing customized training material
Authors: Andreas Lorenz and Thomas Brandel
Revised for the ISSeG Project by Ursula Epting, Bruno Hoeft and Tobias Koenig
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
Agenda
•
Analysis of the organizational unit’s need for IT security
•
Handling of data
•
Organization of IT security
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
IT Security Need (1)
Analysis of the Organizational Unit’s Need for IT Security /
Survey Relating to IT Security
To ensure safe operation meeting the IT security criteria, it is helpful to
make a survey all over the site.
A master questionnaire will be presented on the next transparencies.
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
IT Security Need (2)
Questionnaire: Group of the organizational unit (one questionnaire per group)
A group is a set of computers of the same type. Groups are characterized by the way of use. Typical groups are e.g. desktop computers or server
systems.
Per unit, not more than 4-5 groups should be identified – this figure does not represent an absolute limit, it shall serve as a guideline for the group
sizes of an organizational unit.
General data
Organizational unit or
institute /department
Name of the unit (name of the institute or central institution, name of the organizational unit)
Designation of the group
Name of the resource group within the institution
Short description
Short (notes) description of the use of the group at the institution
Contact partner (for
technical questions)
Contact partners for the group (more persons are possible) in case of questions
E-mail address
E-mail addresses of the contact partners
Network integration
Requires access to (mark all
accesses required)
Choose the respective network areas to which the group requires access
Use from network areas
outside of the group?
Indicate whether the group has to be accessed from outside of the network area. It is not referred to access from the
computing center or IWR.
Role of the device group
□ Desktop
□ Server
© Members of the ISSeG Collaboration, 2008
□ Laboratory/ special device
□ Guests/ external devices
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
IT Security Need (3)
Dependence on other services
Services required
(central)
Selection of central resources needed by the group
Services required
(decentralized)
Selection of resources needed by the group, which are not supplied centrally
Are the devices
integrated in the
central administration
directory and update
management?
Indicate whether the resources may be provided with software updates and virus protection programs
from a central point and whether they may be controlled from there
Consequences of failure (availability)
Maximum tolerable failure time of
this computer group for the
organizational unit
Period, during which the failure of the network does not cause any major damage per critical safety
incident
Consequences of failure (beyond
the maximum outage time)
Potential consequences of a failure, if the maximum outage time is exceeded.
Who is affected:
Which group of persons or resources is affected by the failure of the group?
Further information for IWR or the Computing Center
Remarks
Free text field to inform about special features of the group
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
Agenda
• Analysis of the organizational unit’s need for IT security
• Handling of data
• Organization of IT security
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
Overview: Handling of Data
• Classification
• Storage devices
• Disposal
• Saving of data
• Back-up
• Archive
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
•
Data (1)
Classification of Data
Access authorization
–
–
–
–
–
–
•
worldwide
for the Research Center
for an organizational unit
for a department
for a certain working group only
personal (not private!)
Relevance to data protection legislation (person-related data)
– yes
– no
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
Data (2)
Disposal of Storage Devices
•
•
•
•
•
•
Safe deletion or destruction of storage devices
Treatment depends on the worthiness of the stored data to be
protected
Disks, CDs: Safe destruction by shredding
Hard disks: Destruction of the data by (multiple) overwriting
When disposing of storage devices, contact the Waste Management
Center
When handing a computer over to a new user, take care that the
personal data of the previous owner have been deleted
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
•
Data (3)
Back-up and Archiving
The following site-wide file systems are subject to a daily automatic
back-up:
– Global data storage under Windows
– Windows directories of the organizational units
– Global working domain of UNIX users
•
Other areas of back-up:
– Mail servers
– Several databases
– SAP data
•
It is also possible to install a client for back-up and long-term archiving
on servers, workstations or clients
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
Agenda
• Analysis of the organizational unit’s need for IT security
• Handling of data
• Organization of IT security
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
Organization of IT Security (1)
The following commissioners and bodies exist:
•
•
•
•
•
IT security commissioner
Data protection commissioner
Works council
IT security commissioners of the organizational units
IT security working group
The organizational structures of sites (bodies and commissioners) may vary considerably. They depend on the national legislation.
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
Organization of IT Security (2)
•
Behavior in case of incidents
– In case of incidents, contact the IT Security Commissioner of your
organizational unit first. He/she will decide on the further
proceeding
– If personal data are affected, contact the Data Protection
Commissioner and the Works Council, if necessary
– Under certain circumstances, charges are filed by the Legal
Department
The proceeding is dependent on the organizational structure of the site (bodies and commissioners), of course.
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
Information on the Intranet
Site-specific documents and intranet links.
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
Information on the Internet (1)
•
DFN-CERT (Computer Emergency Response Team)
– www.dfn-cert.de
•
Bundesamt für Sicherheit in der Informationstechnik (Federal Office
for Security in Information Technology)
– www.bsi.de
– www.bsi-fuer-buerger.de
•
Securityfocus
– www.securityfocus.com
•
Heise Security Newsticker
– www.heise.de/security
•
Secorvo Security News
– www.secorvo.de/security-news
•
Secunia (Information on weaknesses of various software)
– www.secunia.com
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
Information on the Internet (2)
•
IT-SecCity
– www.itseccity.de
•
Deutschland sicher im Netz e.V.
– www.sicher-im-netz.de
•
NIST Computer Security Division:
– http://csrc.nist.gov/
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
Final Remark
Thank you for your
attention
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/
Forschungszentrum Karlsruhe
in der Helmholtz-Gemeinschaft
Copyright © Members of the ISSeG Collaboration, 2008.
Licensed under the Apache License, Version 2.0 (the
"License"); you may not use this material except in
compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
Work distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR
CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing
permissions and limitations under the License.
© Members of the ISSeG Collaboration, 2008
See: http://www.isseg.eu/