* English translation of German security manual is back
For many years, I used the English-language _IT Baseline Security Manual_ created by the German Federal Office for Information Security (BSI: Bundesamt fur Sicherheit in der Informationstechnik) from its German-language _IT-Grundschutz Standard-Sicherheitmassnahmen_.
Some years ago, the English translation disappeared from the Web, and I continued to rely only on saved versions of the 1997 version. However, in recent correspondence, reader Claus Stark, the business information security officer of the Frankfurt office of Citigroup, very kindly pointed me to a new English translation of the 2004 version of the Baseline Security Manual available in PDF online.
The 269-page Introduction and Modules 2004 file (7.2 MB) starts with an overview of the documents (Chapter 1) and recommendations (Chapter 2) on the analysis and modeling of information systems security requirements and safeguards.
* Chapter 3 covers fundamentals such as security of personnel, contingency planning, data backups, anti-malware, cryptography and incident management.
* Chapter 4 looks at infrastructure (buildings, cabling, rooms, cabinets, telecommuting and operations centers).
* Chapter 5 discusses standalone systems such as PCs running DOS, Windows, Unix, and the like.
* Chapter 6 continues with networked systems.
* Chapter 7 continues with data transmission systems – data media, modems, firewalls, e-mail, Web servers, remote access, Lotus Notes, Internet Information Services, Apache Web server, Exchange/Outlook 2000, and routers and switches.
* Chapter 8 on telecommunications presents basic security principles and practices for PBXs, fax machines and servers, voice mail, ISDN connections, mobile phones and personal digital assistants.
* Chapter 9 adds notes on application software, databases, more on telecommuting, Novell eDirectory 8.6 and archiving.
The Threats Catalog (426 pages) includes:
* Force majeure
* Organizational shortcomings
* Human failures
* Technical failures
* Deliberate acts
The Safeguards Catalog (2056 pages) includes:
* Infrastructure
* Organization
* Personnel
* Hardware and software
* Communications
* Contingency planning
All the PDF documents have extensive bookmarks and are easily searchable.
I am confident that security practitioners and system/network administrators will find these free documents a valuable addition to their libraries of reference resources.021
