Foreword 14. EL Foreword The revelations by Edward Snowden and the corresponding consequences for IT security of companies and authorities have been a predominant topic in the IT security scene. In the beginning of 2014, two cases of identity theft became known, the magnitude of which marked a turning point in the area of IT-supported mass attacks. The responsible IT persons of companies and authorities are exposed to even more sophisticated attacks that – due to the practices of the attackers – can only be detected with a great deal of effort. Particularly in companies and authorities, the protection of company data is of existential importance because the business operations can be disturbed and even disrupted in case of massive impairments or outages of the systems. Furthermore, there can also be financial damage that may reach considerable magnitudes rapidly. When using cloud computing, availability, confidentiality and integrity of information can be affected in particular. Securing of cloud applications still represents a great challenge for organisations. The IT-Grundschutz of the BSI offers a proven safeguard catalogue that enables companies and authorities to provide reliable protection of their IT systems against digital attacks. The IT-Grundschutz catalogues include organisational, technical, personnel-related and infrastructure-related recommendations that are of basic importance for security of all company data. Due to the dynamic developments in the field of IT and the corresponding cyber threats, the IT-Grundschutz modules are subject to continuous updating. The present 14th version reflects the current state of the art. Furthermore, it considers requests from the user group of IT-Grundschutz. This resulted, among others things, in four modules on the secure application of cloud computing, on cloud management, on storage solutions / cloud storage, and on web services. These can be used to show the specific properties of cloud applications, platforms such as abstraction of the resources, elasticity, service-oriented architecture, secure orchestration and automation of processes as well as prioritisation and de-provisioning of IT resources in IT-Grundschutz. The IT-Grundschutz recommendations for security of cloud applications provide a secure and well-founded basis for cloud solutions of organisations right from the beginning. In addition to the topic of cloud computing, the 14th version also includes further important updates. The topic of mobile end devices has been revised completely in IT-Grundschutz, i.e. the modules "Mobile telephones" and "Smartphones, tablets and PDAs". The module "General application", which deals with specialised application software, is newly integrated. Furthermore, the module "Awareness and training" has been revised. Both modules were kindly provided by IT-Grundschutz users. During the past two decades, IT-Grundschutz has developed into one of the most successful standard works of the BSI, a large part of this positive development being provided by the users themselves. That is why I would like to take this opportunity to express my gratitude to the IT-Grundschutz users. Bonn, November 2014 Dr. Hartmut Isselhorst, President of Department C IT-Grundschutz Catalogues: 14. EL, 2014 1 Acknowledgements 14. EL Acknowledgements We will continue to develop the IT-Grundschutz Catalogues as needed based on the annual survey of the needs of registered users. At this point, we would like to thank the following persons involved for their cooperation in the further development of the IT-Grundschutz and their committed support regarding the continuation of the 14th version of the IT-Grundschutz Catalogues: Contents Persons Overall coordination and chief editorship Mr. Holger Schildt, BSI Editing Ms. Jessika Welticke, BSI Mr. Michael Förtsch, BSI Mr. Fabian Schelo, BSI Mr. Christoph Wiemers, BSI Revision of module M 1.13 Information security Ms. Isabel Münch, BSI awareness: Mr. Christian Aust, consecco Module M 1.17 Cloud use Mr. Marko Klaus, Computacenter AG & Co. oHG Ms. Antje Straube, Computacenter AG & Co. oHG Mr. Michael Broermann, Computacenter AG & Co. oHG Ms. Dr. Clemens Doubrava, BSI Mr. Dr. Patrick Grete, BSI Mr. Alex Essoh, BSI Module M 3.303 Storage solutions / cloud storage Mr. Marko Klaus, Computacenter AG & Co. oHG Ms. Antje Straube, Computacenter AG & Co. oHG Mr. Michael Broermann, Computacenter AG & Co. oHG Mr. Dr. Clemens Doubrava, BSI Mr. Dr. Patrick Grete, BSI Mr. Alex Essoh, BSI Module M 3.404 Mobile telephones Mr. Dr. Patrick Grete, BSI Module M 3.405 Smartphones, tablets and PDAs Mr. Holger Schildt, BSI Module M 5.23 Cloud management Mr. Erwan Smits, Atos Origin GmbH Mr. Dominic Mylo, Atos Origin GmbH Dr. Clemens Doubrava, BSI Mr. Alex Essoh, BSI Dr. Patrick Grete, BSI Module M 5.24 Web services Mr. Frank Rustemeyer, HiSolutions AG Mr. David Fuhr, HiSolutions AG Mr. Dominik Oepen, HiSolutions AG Mr. Alexander Papitsch, HiSolutions AG Mr. Christoph Puppe, HiSolutions AG Dr. Patrick Grete, BSI Dr. Clemens Doubrava, BSI Mr. Alex Essoh, BSI Module M 5.25 General applications Mr. Isabel Münch, BSI Mr. Martin Meints, Dataport IT-Grundschutz Catalogues: 14. EL, 2014 1 Acknowledgements 14. EL Contents Persons Quality assurance Mr. Sebastian Frank, Secumedia Mr. Christian Merz, BSI In addition to updating and revising modules, numerous individual threats and safeguards were updated to reflect new developments in technology, new threat scenarios, and new developments in information security. We would also like to thank those involved in this process as well. Furthermore, we would like to thank everyone who has contributed to improving IT-Grundschutz and the IT-Grundschutz Catalogues by providing constructive criticism and practical suggestions for improvement. The persons and organisations listed in the following were involved in updating and developing previous versions of the IT-Grundschutz Catalogues. We would like to thank these people as well: Companies and persons • State and Federal Technology for Data • Novell GmbH Protection Officers Work Group • Oracle Deutschland GmbH • Atos Origin • Orange Business Services Mr. Herbert Blaauw, Mr. Matthias Mönter Mr. Josef Ledermann Mr. Götz, Mr. Jaster, Mr. Pohl Andreas Sesterhenn, Jörg Stockmann • Open Web Application Security Project - German Chapter • AXA Versicherung AG Mr. Tobias Glemser (Tele-Consulting security • Industry Association OSE - Organisation pro | networking | training GmbH), Software Escrow Mr. Ralf Reinhardt (sic[!]sec GmbH) Dr. Michael Eggers • PERSICON Information Risk Management • ConSecur GmbH GmbH Mr. Nedon, Mr. Eckardt Mr. Knud Brandis, Mr. Willy Wauschkuhn, Prof. Dr. Rainer Rumpel, Mr. Knut Haufe • European Commission DG Information Society & Media • Röhm GmbH Chemische Fabrik Mr. Achim Klabunde Mr. Güldemeister, Data Protection Officer • EUROSEC GmbH • SerNet GmbH Mr. Fünfrocken, Ms. Martina Seiler Mr. Christoph Zauner Mr. Vetter, Dr. Zieschang • T-Systems International GmbH • KPMG AG Mr. Stephan Hüttinger, Mr. Torsten Kullich, Mr. Alexander Geschonneck Mr. Klaus Müller, Mr. Stefan Morkovsky, Mr. Axel Nennker, Mr. Norbert Vogel • Guide Share Europe "Data Protection and Data Security" Working • TÜViT GmbH Group Mr. Adrian Altrhein, Mr. Peter Herrmann, Mr. Stephan Klein, Mr. Mirco Przybylinski, Mr. • HiSolutions Software GmbH Jan Seebens, Dr. Anja Wiedemann Mr. Timo Kob, Mr. Ronny Frankenstein, • German Chemical Industry Association • HiSolutions AG Mr. Christoph Puppe, Mr. Enno Ewers, Mr. • Secumedia Frank Rustemeyer Mr. Elmar Török • INFODAS GmbH • SIZ Dr. Gerhard Weck Mr. Gerhard Müller, Mr. Detlef Zimmer, Mr. IT-Grundschutz Catalogues: 14. EL, 2014 2 Acknowledgements 14. EL Companies and persons • Mink Consulting Engineers Ulrich Schmidt • Microsoft Germany GmbH • Symantec Germany GmbH • Networkers AG • VZM GmbH Mr. Ludger Hötting, Mr. Oliver Redeker, Mr. Mr. Bruno Hecht, Mr. Werner Metterhausen, Marcel Zamzow Mr. Rainer von zur Mühlen The following authors have incorporated their expert knowledge into the IT-Grundschutz Catalogues by writing corresponding modules. They deserve special thanks since their commitment enabled the creation and development of the IT-Grundschutz Catalogues in the first place. Federal Ministry of the Interior: Mr. Jörg-Udo Aden, Mr. André Reisen, Mr. Manfred Kramer, Dr. Christian Mrugalla, Dr. Lydia Tsintsifa Federal Ministry of Education and Research: Mr. Frank Stefan Stumm Federal Office for Information Security: Mr. Heinz Altengarten, Mr. Rainer Belz, Mr. Thomas Biere, Ms. Steffi Botzelmann, Ms. Elke Cäsar, Mr. Thomas Caspers, Mr. Markus de Brün, Mr. Björn Dehms, Mr. Thorsten Dietrich, Mr. Uwe Dornseifer, Dr. Clemens Doubrava, Mr. Günther Ennen, Mr. Olaf Erber, Mr. Alex Didier Essoh, Mr. Frank W. Felzmann, Mr. Michael Förtsch, Dr. Kai Fuhrberg, Mr. Heinz Gerwing, Dr. Patrick Grete, Mr. Karl Greuel, Mr. Thomas Häberlen, Dr. Dirk Häger, Dr. Timo Hauschild, Mr. Florian Hillebrand, Dr. Hartmut Isselhorst, Ms. Angelika Jaschob, Mr. Harald Kelter, Mr. Kurt Klinner, Dr. Robert Krawczyk, Mr. Michael Mehrhoff, Mr. Christian Merz, Ms. Isabel Münch, Ms. Sabine Mull, Dr. Frank Niedermeyer, Dr. Harald Niggemann, Mr. Daniel Nowack, Mr. Michael Otter, Mr. Jonas Paulzen, Mr. Robert Rasten, Ms. Martina Rohde, Ms. Gabriele Scheer-Gumm, Mr. Fabian Schelo, Ms. Cornelia Schildt, Mr. Holger Schildt, Dr. Arthur Schmidt, Dr. Willibald Schneider, Mr. Heiner Schorn, Dr. Ernst Schulte-Geers, Mr. Carsten Schulz, Mr. Bernd Schweda, Ms. Petra Simons-Felwor, Mr. Martin Telzer, Mr. Berthold Ternes, Mr. Hristoforos Thomaidis, Ms. Katja Vogel, Ms. Anne-Kathrin Walter, Mr. Frank Weber, Mr. Helmut Weisskopf, Ms. Jessika Welticke, Mr. Maximilian Winkler as well as: Mr. Markus Balkenhol, Mr. Marcel Birkner, Mr. Werner Blechschmidt, Ms. Anastasia Eifer, Mr. Mounir Guiche, Mr. Tobias Hödtke, Mr. Björn Jacke, Ms. Sabine Kammerhofer, Mr. Thomas Ledermüller, Mr. Tim Lemmen, Dr. Marie-Luise Moschgath, Mr. Joachim Pöttinger, Mr. Philipp Rothmann, Mr. Michael Ruck , Mr. Michael Schwank, Mr. Ranbir Singh Anand, Mr. Markus Steinkamp, Mr. Felix Stolte, Dr. Stefan Wolf Special thanks for decades of organisation of IT-Grundschutz and long-term overall coordination and editorship up until 2013 go to Ms. Isabel Münch. IT-Grundschutz Catalogues: 14. EL, 2014 3 New functions in the 14th version of the IT-Grundschutz Catalogues New functions New functions in the 14th version of the IT-Grundschutz Catalogues Further development as needed The IT-Grundschutz Catalogues are developed further as needed based on the annual survey of the needs of registered users. The new and revised modules address the following topics: Revision of Information security awareness and training The revised module M 1.13 Information security awareness and training describes how to create and maintain an efficient information security awareness and training programme. Both awareness and training measures are required to teach the employees the required knowledge. Here, reasonable information security of all employees should be internalised as a natural part of their working environment. Cloud use The module M 1.17 Cloud use is intended for all types of cloud service users and mainly refers to two scenarios: In the first scenario an organisation provides its users with certain cloud services that are either provided by the organisation itself or that are purchased from third parties. If such organisation implements the IT-Grundschutz, then it will make demands on the provider regarding the information security and the information security management system (ISMS). In the second scenario an organisation uses the cloud services of a third party (e.g. security as a service) and is required to integrate such services into its own IT landscape. The requirements for information security and the ISMS are slightly different and are also dealt with in this module. Revision of Storage solutions / cloud storage Many parts of the module M 3.303 Storage solutions / cloud storage are based on the existing module "Storage systems and storage networks" and add new storage concepts that are used for cloud computing such as Fibre Channel (FC), Fibre Channel over Ethernet (FCoE), NFS, Cloud Storage or Object Storage. The security mechanisms of the appropriate protocols are explained in detail. Revision of Mobile telephones Mobile telephones are integral elements of today's communication infrastructure. This poses the question of how to use them securely. The module M 3.404 Mobile telephones considers digital mobile radio systems based on the GSM standard (D and E networks) as well as UMTS and LTE. These mobile radio standards mainly differ in the frequency range of the radio connection used and the correspondingly applied duplex techniques. Such techniques also result in different bit rates. Revision of smartphones, tablets and PDAs The module M 3.405 Smartphones, tablets and PDAs deals with mobile end devices for collection, processing and communication of data. They come in different categories with varying dimensions and performance features. Amongst other things, these include: Organisers, PDAs, smartphones and tablets. When using sub-notebooks (netbooks, ultrabooks etc.) or tablets, also the module M 3.203 Laptops should be implemented. Cloud management The module M 5.23 Cloud management summarises the cloud-specific security aspects of IT management regarding information security, and provides a holistic view of the same. For example, cloud management does not replace, but accesses the management of networks, system and storage. These areas are already dealt with in the corresponding modules. Thus, the new module focuses on the security aspects that are connected to the original properties of cloud computing such as multi-client capability, orchestration and automation of processes as well as provisioning and/or de-provisioning of IT resources. IT-Grundschutz Catalogues: 14. EL, 2014 1 New functions in the 14th version of the IT-Grundschutz Catalogues New functions Web services The module M 5.24 Web services shows the specific risks of a service-oriented architecture (SOA) and recommends measures for secure provisioning of web services. In addition to SOAP-based (Simple Object Access Protocol) web services, the REST-based (Representational State Transfer) web services in particular are addressed in detail. General application The module B 5.25 General applications deals with specialised application software. This includes individual software created by internal or external developers, standard software with internal adaptations, e.g. through program changes or through developing specific modules (customising) and standard software that is used as delivered by the manufacturer and that is configured in accordance with the specialised tasks and the security policies. Updates and revisions Furthermore, numerous individual threats and safeguards were updated to reflect new developments in technology, new threat scenarios, and new developments in information security. No other structural changes were made to this updated version. The numbers of the existing threats and safeguards have been retained so that it is possible to revise a security concept based on an earlier version of the IT-Grundschutz Catalogues. However, it is still recommended to read the selected safeguards completely during revision in order to take additions into account and to refresh our knowledge of information security. IT-Grundschutz Catalogues: 14. EL, 2014 2 1 IT-Grundschutz - The basis for information security 1 1 IT-Grundschutz - The basis for information security 1.1 Why is information security important? Information constitutes an essential asset for companies and government agencies and so requires adequate protection. Today, the majority of information is at least partially generated, stored, transported, or processed further with the help of information technology (IT). State-of-the-art business processes in the fields of economy and administration without IT support are no longer imaginable today. A reliably working information processing system is as indispensable for maintaining operations as the related technology. Inadequately protected information is a frequently underestimated risk factor that can threaten the existence of some organisations. At the same time, reasonable information protection and basic IT protection can be achieved with relatively modest resources. With the IT-Grundschutz, the BSI offers a simple method for appropriately protecting all an organisation's information. With a combination of the IT-Grundschutz approach in BSI standard 100-2 and the IT-Grundschutz Catalogues, the BSI provides both a collection of security safeguards and a corresponding methodology for selecting and adapting suitable safeguards for safe handling of information for most different application environments. Nowadays, almost all business processes and specialised tasks are controlled electronically. These processes and tasks store large amounts of information digitally, process it electronically, and transmit it in local and global networks, as well as in private and public networks. Many tasks and projects in the public or private sector cannot be implemented at all or can only be implemented in part without IT. As a result, many administrative and business organisations depend on the correct operation of the IT used. The corresponding goals of government agencies and companies can only be achieved when their IT is used properly and securely. As the level of dependency on IT increases, the potential damage to society caused by a failure of information technology also increases accordingly. Since IT systems are never completely free of vulnerabilities, there is a justifiably great interest regarding the protection of the data and information processed by the IT and regarding the processes of planning, implementing, and monitoring their security. Here, it is important to not to only focus on the security of IT systems, because information security is not only a question of technology, but also greatly depends on the organisational and personnel boundary conditions. The security of the operating environment, the reliability of services, proper handling of the information to be protected, and many other important aspects must not be neglected. Deficiencies in the field of information technology may cause significant problems. Potential damage can be assigned to different categories. • Loss of availability: If basic information is not present, this is most often noticed quickly when tasks cannot be continued in the absence of this information. If an IT system is down, financial transactions cannot be executed, online orders cannot be placed, and production processes come to a halt, for example. However, even just limiting the availability of certain information can result in IT-Grundschutz Catalogues: 14. EL, 2014 1 1 IT-Grundschutz - The basis for information security 1 impairments of the processes of an organisation. • Loss of confidentiality of information: Each citizen wants his/her personal data to be treated confidentially. Each company knows that the competition is interested in internal, confidential data about turnover, marketing, research, and development. The accidental disclosure of information may cause serious damage in many areas. • Loss of integrity (correctness of the information): Falsified or manipulated data may cause erroneous bookings, incorrect deliveries, or faulty products, for example. Over the last few years, the loss of data authenticity as a component of data integrity has become increasingly important: data is assigned to the wrong person. For example, payment instructions or orders could be processed to the account of a third person, inadequately secured digital declarations of intent could be associated with the wrong persons, or someone’s "digital identity" could be forged. Information and communication technology plays an important role in more and more areas of daily life, with a consistently high speed of innovation over the past few years. The following developments are particularly worth mentioning: • Increasing level of networking: today, humans, but also IT systems, no longer operate isolated from each other and are in fact becoming increasingly networked. Networking allows access to shared databases and use of intensive forms of cooperation across geographic, political, or institutional boundaries. The result is not only dependence on the individual IT systems, but also a high level of dependence on the data networks. This in turn means that security deficiencies may quickly have global effects. • IT distribution and penetration: more and more areas are supported by information technology, often without this support even being noticed. The necessary hardware is becoming increasingly compact and inexpensive so that small and miniature IT units can be integrated into all aspects of daily life. For example, there are jackets with integrated PDAs, RFIDs for controlling the flow of visitors or goods, and IT-based sensors in cars in order to be able to automatically adjust to changes in the environment. The various IT components communicate with each other more and more frequently over wireless connections. This way, even everyday objects can be localised and controlled via the internet. • Disappearance of network borders: until recently, it was possible to clearly limit business processes and applications to specific IT systems and the communication routes between these systems. Likewise, it was also possible to determine where the systems were located and to which organisation they belonged. Due to globalisation and the increasing use of wireless and spontaneous communication, it is becoming more and more difficult to detect borders between these systems. • Attacks come more quickly: The best way to prevent computer viruses, Trojan horses, or other attacks to IT systems, application programs, and protocols is to obtain the most recent information on security gaps and how to eliminate them, e.g. by installing patches or updates. However, the time between the announcement of a security gap and the first targeted large-scale attacks is constantly decreasing, which means it is becoming more and more important to have a well-staffed information security management team and a warning system. • Higher interactivity of applications: Under the heading Web 2.0, previously existing technologies are combined in order to create new application and use models this way. This includes the most diverse fields of application such as new, social communication platforms, portals for the joint use of information, photos, and videos, or interactive web applications. Due to the increased integration of user feedback, information is not only distributed faster, but it is also more difficult to control its disclosure. • Responsibility of the users: The best technology and quickest elimination of security gaps do not result in sufficient information security, unless humans are considered as a risk factor in so doing. This is not only about being able to identify security-critical situations, but also about the responsible behaviour of the individual. For this, it is necessary to dispose of knowledge regarding IT-Grundschutz Catalogues: 14. EL, 2014 2 1 IT-Grundschutz - The basis for information security 1 security gaps and codes of conduct. Given the above-mentioned potential threats and the increasing dependence on IT, each organisation, regardless of whether it is a company or a government agency, must ask itself the following key questions relating to IT security: • How carefully is business-relevant information handled? • How secure is the information technology of the organisation? • Which security safeguards need to be adopted? • How do these safeguards need to be implemented specifically? • How does the organisation maintain and/or improve the level of security attained? • Are the personnel aspects of information security taken into consideration sufficiently? • What is the level of security of other organisations the organisation cooperates with? • Is there a contingency plan in order to be able to react quickly in the event of a threat? When searching for answers to these questions, it must be taken into consideration that information security is a combination of technical, organisational, personnel, and structural/infrastructural aspects. It makes sense to introduce an information security management team designing, coordinating, and monitoring the tasks related to information security. When comparing the business processes, applications, and IT systems of all organisations regarding the questions raised above, a special group would emerge. The approaches and IT systems in this group can be characterised as follows: • The approaches and IT systems are typical, meaning that they are not individual solutions, but rather commonly used. • The protection requirements of the information in terms of confidentiality, integrity, and availability are within the normal range. • The approaches and IT systems are subject to the usual general conditions and are therefore exposed to typical basic threats and hazards. If it were possible to identify the common denominator of all required security safeguards for this group of "typical" business processes, applications, and IT systems, i.e. the standard security safeguards, this would make answering the questions raised above for these "typical" application cases much easier. Areas outside of this group, regardless of whether they are rare, custom solutions, or IT systems with high protection requirements, can be based on the standard security safeguards, but will ultimately need to be examined individually. The IT-Grundschutz Catalogues describe these standard security safeguards in detail, which should be taken into consideration for practically every IT system. The catalogues contain: • standard security safeguards for typical business processes, applications, and IT systems with "normal" protection requirements, • a description of the threat scenarios usually applicable, and • detailed descriptions of safeguards to facilitate their implementation. A comprehensive description of the process for achieving and maintaining an adequate level of security, as well as a simple approach for determining the achieved level of security in the form of a target-actual comparison can be found in BSI standards 100-1, 100-2, and 100-3 for IT-Grundschutz. Since the IT-Grundschutz also proved popular on an international scale, the IT-Grundschutz Catalogues and the GSTOOL, as well as most of the other documents relating to IT-Grundschutz, are also available in digital form in the English language. IT-Grundschutz Catalogues: 14. EL, 2014 3