chrisbst48/IT-Grundschutz-Compendium_2022_EN huggingface dataset:
SYS.3.2.2.A23 Enforcing Compliance Requirements (H)
Violations of an organisation's regulations and manipulation of device operating systems SHOULD be detected by a suitable solution. The following actions SHOULD be taken if violations of regulations or OS manipulations are suspected. The solution SHOULD provide corresponding functions, including: 1. Automated warnings 2. Autonomous locking of devices 3. Deletion of the organisation’s confidential information 4. Deletion of the entire device 5. Prevention of access to company apps 6. Prevention of access to the organisation’s systems and information If a violation or manipulation is suspected, an alert SHOULD be sent to the administrators in charge and the organisation's security management personnel.
SYS.3.2.2.A3 Selecting an MDM Product (B)
When suitable MDM software is to be purchased, care MUST be taken to ensure that it satisfies all of the requirements specified in the MDM strategy at hand. It MUST also be able to implement all the necessary technical and organisational security safeguards and support all the mobile devices permitted.
SYS.3.2.2.A4 Distribution of the Basic Configuration to Mobile Devices (B)
All mobile devices MUST be integrated into the MDM system at hand before they are used. When devices receive their basic configuration, they MUST be set to factory settings. The connection between mobile devices and the MDM system MUST be appropriately secured. For devices which are already in use, all organisation-related data MUST be deleted first. An end device which has not been configured through the MDM system MUST NOT be able to access the corresponding organisation’s information.
SYS.3.2.2.A5 Installing the MDM Client (B)
When mobile devices are handed over to employees, the MDM client in question MUST be installed and configured on them if it is not already provided by the operating system in use.
SYS.3.2.2.A6 Logging the Device Status (S)
The lifecycle of a mobile device (including its configuration history) SHOULD be sufficiently logged and centrally retrievable. If required, an administrator SHOULD be able to determine the current status of managed devices (device audit).
SYS.3.2.2.A7 Installation of Apps (S)
Apps SHOULD be installed, uninstalled, and updated via the MDM in use system in line with the requirements of the planned deployment scenario. The MDM system SHOULD force the installation, uninstallation, and update process as soon as a connection to a mobile device is established. Users SHOULD not be able to uninstall apps installed via the MDM system. The MDM system SHOULD support a blacklist or whitelist for the installation of apps.
SYS.3.2.3 iOS (for Enterprise)
Target Object: IT system / Order: R2
SYS.3.2.3.A1 Strategy for Using iOS Devices (B)
If an MDM system is used, any iOS-based devices in use MUST be managed and configured via this system. There MUST be a strategy for using iOS devices that defines aspects such as the selection of end devices or backup strategies. Whether additional apps from third-party providers should or may be used MUST be regulated. Furthermore, jailbreaks MUST be prohibited by organisational guidelines and, if possible, technically prevented.
SYS.3.2.3.A12 Using Apple IDs (S)
An anonymised Apple ID SHOULD be used instead of a user's personal Apple ID. If possible, Apple Business Manager SHOULD be used for volume licensing (formerly the Volume Purchase Program, VPP) and the centralised installation of apps.
SYS.3.2.3.A13 Using the “iOS Restrictions” Configuration Option (S)
All iOS functions and services that are not needed or allowed SHOULD be disabled. Based on the intended purpose at hand and the underlying protection needs, the use of lock screens, unified communication, Siri, background images, connections to host systems, and diagnostic and usage data SHOULD be checked in particular.
SYS.3.2.3.A14 Using the iCloud Infrastructure (S)
Before extensive or selective usage of the iCloud infrastructure is approved for business use, the compatibility of Apple’s general terms and conditions with an organisation's internal policies SHOULD be assessed in terms of availability, confidentiality, integrity, and data protection. If the use of the iCloud infrastructure is allowed, identities on the iCloud web service SHOULD be verified by two-factor authentication. Otherwise, iCloud use for purely business purposes SHOULD be reduced to a minimum or completely prohibited.
SYS.3.2.3.A15 Using Continuity Functions (S)
If using the iCloud infrastructure has not been generally prohibited by an organisation’s security management department, the compatibility of Continuity functions with the organisation's internal policies SHOULD be assessed, taking account of the aspects of confidentiality and integrity. Based on the results of this assessment, the extent to which these functions are technically and organisationally restricted SHOULD be regulated.
SYS.3.2.3.A17 Using the Device Code History (S)
In configuration profiles, the number of unique codes that must be used before repetition is allowed SHOULD be set to an appropriate value.
SYS.3.2.3.A18 Using the Configuration Option for the Safari Browser (S)
The browser policies already established in an organisation SHOULD also be implemented accordingly for Safari by means of technical and organisational safeguards. The requirements for browsers on stationary and portable PCs that are already in place SHOULD be used as a basis for securing iOS-based devices and establishing application scenarios. The operational environment of the devices SHOULD be considered.
SYS.3.2.3.A2 Planning the Use of Cloud Services (B)
Before iOS-based devices are used, it MUST be determined which cloud services should or may be used and to what extent. It SHOULD be taken into account that iOS-based devices are generally closely intertwined with Apple's own iCloud services. It SHOULD also be considered that this integration can be triggered by merely activating individual devices with an Apple ID. It SHOULD therefore be checked whether Apple Business Manager (formerly the Device Enrollment Program, DEP) can be used for device registration.
SYS.3.2.3.A21 Installation of Apps and Integration of the Apple App Store (S)
To ensure that the required apps are sufficiently available to authorised users at the necessary time, consideration SHOULD be given to integrating Apple Business Manager into theMDM infrastructure at hand. Payments in the App Store SHOULD NOT be confirmed using biometrics.
SYS.3.2.3.A23 Using Automatic Deletion of Configuration Profiles (H)
Devices that are continuously offline for a clearly defined period of time SHOULD lose their access to the corresponding organisation's internal infrastructure. At the end of the defined period or on a specific day, their configuration profiles SHOULD be deleted without the need for action on the part of those in charge of IT. If the user of such a device accesses their organisation's internal network before the period expires, this SHOULD reset the period until their configuration profile will be automatically deleted. If it is necessary to ensure that a user is still in possession of a given device, the user SHOULD be actively prompted to establish access within a set period of time. If no access is established before this period expires, the user's configuration profile SHOULD be automatically deleted.
SYS.3.2.3.A25 Using the Configuration Option for AirPrint (H)
Approved AirPrint printers SHOULD be provided to users by means of a configuration profile. In order to prevent users from printing information on untrusted printers, all communication links SHOULD always be routed through an organisation’s infrastructure systems.
SYS.3.2.3.A26 No Connections to Host Systems (H)
To prevent iOS-based devices from being connected to other IT systems in an unauthorised manner, users SHOULD only be able to connect iOS-based devices to a corresponding MDM system.
SYS.3.2.3.A7 Preventing Unauthorised Deletion of Configuration Profiles (B)
In order to ensure that configuration profiles cannot be deleted without authorisation, suitable technical (e.g. through support mode) or organisational regulations MUST be established and implemented. Users of mobile devices SHOULD be made aware of the intention and purpose of these security safeguards.
SYS.3.2.4 Android
Target Object: IT system / Order: R2
SYS.3.2.4.A2 Disabling Developer Options (S)
The developer options SHOULD be disabled on all Android-based devices.
SYS.3.2.4.A3 Using Multi-User and Guest Mode (S)
Whether a device may be shared with other persons SHOULD be regulated. Whether multi-user or guest mode must be used for this purpose SHOULD be specified. Users on Android-based devices SHOULD be natural persons.
SYS.3.2.4.A5 Advanced Security Settings (S)
Only the approved security apps SHOULD be entered as device administrators or “Trust Agents”. This SHOULD be checked regularly. Furthermore, only authorised apps SHOULD be able to access usage data and notifications.
SYS.3.3 Mobile Telephones
Target Object: IT system / Order: R2
SYS.3.3.A1 Security Guidelines and Rules for the Use of Mobile Phones (B)
A security policy MUST be established with regard to the use and control of mobile phones. Each mobile phone user MUST be provided with a copy of the security policy. Regular checks MUST be carried out to ensure compliance with the security policy. The security policy on mobile phone use for business purposes SHOULD form part of the training provided to users on security safeguards.
SYS.3.3.A10 Secure Data Transmission via Mobile Phones [User] (S)
There SHOULD be rules defining the data which can be transmitted using mobile phones. The interfaces allowed for this SHOULD also be defined. A decision SHOULD also be taken on how the data should be encrypted, if required.
SYS.3.3.A11 Precautions for Mobile Telephones [User] (S)
The data stored on mobile phones SHOULD be backed up to another medium at regular intervals. If a defective mobile phone needs to be repaired, all its data SHOULD be deleted and the device reset to the factory settings. Replacement devices SHOULD always be available to replace a failed mobile phone on short notice.
SYS.3.3.A12 Setting Up a Mobile Telephone Pool (S)
A device pool SHOULD be set up if the users of business mobile phones change regularly. The issue and return of mobile phones and accessories SHOULD be documented. Before they are issued, it SHOULD be ensured that mobile phones are charged and equipped with the programs and data the new owner will need. In addition, users SHOULD be made aware of their obligation to comply with the relevant security policy. When devices are returned, they SHOULD be reset to factory settings.
SYS.3.3.A13 Protection Against Mobile Telephone Data Being Used to Create Movement Profiles [User] (H)
It SHOULD be clarified whether the creation of movement profiles by third parties can have a negative effect or is regarded as a problem. To prevent GPS positioning, this function SHOULD be switched off. To prevent tracking through the mobile communication network, mobile phones SHOULD be switched off and their batteries removed.
SYS.3.3.A14 Protection Against Call Number Identification During Use of Mobile Telephones [User] (H)
To prevent them from being associated with specific people, telephone numbers SHOULD be suppressed for outgoing calls. SMS and MMS messages SHOULD NOT be sent. Mobile phone numbers SHOULD NOT be published or passed on to unauthorised third parties.
SYS.3.3.A15 Protection Against Eavesdropping on Indoor Conversations Using Mobile Telephones (H)
To ensure that confidential information cannot be subject to eavesdropping, mobile phones SHOULD NOT be taken into rooms used for confidential meetings and conversations. If necessary, this mobile phone ban SHOULD be enforced by detectors.
SYS.3.3.A2 Blocking Lost Mobile Telephones [User] (B)
If a mobile phone is lost, the SIM card used in it MUST be blocked promptly. If possible, existing anti-theft mechanisms such as remote deletion or blocking SHOULD be used. All the information necessary to block the SIM card and mobile phone MUST be immediately at hand.
SYS.3.3.A3 Raising Employee Awareness and Providing Training on the Use of Mobile Telephones (B)
Employees MUST be made aware of the particular threats posed to information security by mobile phones. They MUST be familiar with the security features of mobile phones. Users MUST know how to lock mobile phones. Users MUST be advised on how mobile phones should be stored safely and correctly.
SYS.3.3.A4 Decommissioning and Properly Disposing of Mobile Telephones and the Memory Cards Used in Them (B)
Mobile phones MUST be reset to factory settings before disposal. A check MUST be carried out to confirm that all data has been deleted. It SHOULD also be ensured that mobile phones and any memory cards used in them are properly disposed of. If mobile phones and memory cards are collected and then disposed of at a later point in time and/or in larger quantities, they MUST be protected from unauthorised access until their disposal.
SYS.3.3.A5 Use of the Security Mechanisms of Mobile Telephones [User] (S)
The available security mechanisms SHOULD be used and pre-configured on mobile phones. SIM cards SHOULD be protected by secure PINs. The super PIN/PUK SHOULD only be used by the people in charge within the framework of defined processes. Mobile phones SHOULD be protected by device codes. If possible, devices SHOULD be reliant on their SIM cards (SIM lock).
SYS.3.3.A6 Mobile Telephone Updates [User] (S)
Regular checks SHOULD be carried out to determine whether there are any software updates for the mobile phones in use. The handling of updates SHOULD be regulated. If there are new software updates, the way in which users will be informed about them SHOULD be specified. Whether users are allowed to install updates themselves or are to hand in their mobile phones at a central location for this purpose SHOULD be specified.
SYS.3.3.A7 Acquisition of Mobile Telephones (S)
Before mobile phones components are acquired, a list of requirements SHOULD be created. The list of requirements SHOULD be used to evaluate the products available on the market. A product SHOULD be selected according to whether the manufacturer will offer updates for the planned period of use. It SHOULD be ensured that spare parts such as batteries and chargers can be procured in sufficient quality.
SYS.3.3.A8 Use of the Wireless Interfaces of Mobile Telephones [User] (S)
IrDA, WLAN, Bluetooth, and other wireless interfaces of mobile phones SHOULD be disabled as long as they are not needed.
SYS.3.3.A9 Securing the Power Supply for Mobile Telephones [User] (H)
Appropriate measures SHOULD be taken to ensure a sustainable supply of energy to mobile phones. Replaceable batteries or power banks SHOULD be used as required.
SYS.4.1 Printers, Copiers, and All-in-One Devices
Target Object: IT system / Order: R2
SYS.4.1.A1 Planning the Use of Printers, Copiers, and All-in-One Devices (B)
Before printers, copiers, and all-in-one devices are procured, their secure use MUST be planned. In doing so, the following criteria should be taken into consideration: • Support of secure protocols for data transmission and administration • Encryption of stored information • Authentication of users directly on each device • Use of physical protection mechanisms, such as anti-theft eyelets or device locks • Existence of a reliable and efficient automatic page feeder on scanning units • Support for suitable data formats • Support for patch codes and bar codes for document separation and transfer of meta information (if required) • Existence of a function for secure storage deletion • Availability of regular updates and maintenance contracts The locations where devices may be situated MUST be specified. In addition, it MUST be defined who may access printers, copiers, and all-in-one devices. The results SHOULD be documented in a basic concept.
SYS.4.1.A11 Restricting the Connection of Printers, Copiers, and All-in-One Devices (S)
The IT Operation Department SHOULD ensure that network-enabled printers, copiers, and all-in-one devices cannot be reached from external networks. When connecting all-in-one devices to the telephone network, it SHOULD be ensured that no uncontrolled data connections can be established between an organisation's data network and the telephone network. Network printers and all-in-one devices SHOULD be operated in their own network segment and kept separate from an organisation's clients and servers.
SYS.4.1.A14 Authentication and Authorisation for Printers, Copiers, and All-in-One Devices (H)
Only authorised persons SHOULD be able to access printed or copied documents. If possible, only central printers, copiers, and all-in-one devices SHOULD be used that require user authentication before starting printing tasks (“secure print”). After users have authenticated themselves, only their own print jobs SHOULD be visible. Only the functions necessary for each respective user SHOULD be enabled.
SYS.4.1.A15 Encryption of Information for Printers, Copiers, and All-in-One Devices (S)
If possible, all information stored on internal non-volatile storage media SHOULD be encrypted. Print jobs SHOULD also be transmitted in an encrypted form if possible.
SYS.4.1.A16 Reducing Downtimes for Printers, Copiers, and All-in-One Devices (H)
To minimise the downtime of printers, copiers, and all-in-one devices, the safeguards taken SHOULD include the following: • Replacement devices should be available. • An appropriate response time should be ensured in maintenance contracts. • A list of specialised suppliers should be maintained for the purpose of quickly purchasing replacement devices or spare parts. • A store of regularly required spare parts should be maintained if necessary.
SYS.4.1.A17 Protection of Payloads and Metadata (S)
Payload data and metadata such as print jobs and scan files SHOULD only be stored on devices for as short a time as possible. Data SHOULD be deleted automatically after a predefined amount of time. File servers on such devices and functions such as “scan to device memory” SHOULD be disabled by the IT Operation Department. The protocols and functions required for this SHOULD be blocked whenever possible. In general, the IT Operation Department SHOULD ensure that no metadata is visible to unauthorised parties. Organisations SHOULD regulate how printouts with metadata are to be passed on to third parties.
SYS.4.1.A18 Configuration of Printers, Copiers, and All-in-One Devices (S)
All printers and all-in-one devices SHOULD only be configurable by the IT Operation Department. Unused device functions SHOULD be switched off. In particular, all unnecessary data and network interfaces of printers, copiers, and all-in-one devices SHOULD be disabled. The devices SHOULD be managed exclusively via encrypted protocols such as HTTPS and SNMPv3. All protocols that allow unencrypted access to printers and all-in-one devices SHOULD be replaced by encrypted ones by the IT Operation Department or switched off. This SHOULD be implemented in particular for protocols that can be used to change a device's configuration (e.g. SNMP, Telnet, PJL).
SYS.4.1.A2 Suitable Siting and Access to Printers, Copiers, and All-in-One Devices (B)
The IT Operation Department MUST set up and secure printers, copiers, and all-in-one devices so that only authorised users can use the devices and access processed information. In addition, it MUST be ensured that only authorised persons can administer, maintain, and repair the devices. Confidentiality agreements MUST be established in writing with service providers (e.g. for maintenance). Printers, copiers, and all-in-one devices MUST be set up with device passwords to block access to their web servers and administration control panels. They MUST comply with the respective organisation's identity and authorisation management requirements in this regard.
SYS.4.1.A20 Enhanced Information Protection for Printers, Copiers, and All-in-One Devices (C)
The names of print jobs SHOULD only be displayed in anonymised form on print servers. All interfaces for external storage media SHOULD be disabled. Furthermore, device-internal address books SHOULD be disabled and alternative addressing methods (e.g. address search via LDAP) offered to users. Printers and all-in-one devices with e-mail functionality SHOULD ensure that e-mails can only be sent using the e-mail address of an authenticated user. Documents SHOULD also only be sent to internal e-mail addresses. Incoming fax documents and transmission reports SHOULD only be accessible to authorised users.
SYS.4.1.A21 Extended Protection of Printers, Copiers, and All-in-One Devices (H)
The IT Operation Department SHOULD regularly check the security settings of printers, copiers, and all-in-one devices and correct them if necessary. If an automated control and correction system is available, it SHOULD be used. In addition, there SHOULD be a restriction on devices being reset to factory settings via their boot menus. It SHOULD be ensured that no firmware or additional software can be installed on printers and all-in-one devices that has not been verified and approved by the respective manufacturer.
SYS.4.1.A22 Proper Disposal of Printed Documents (B)
Printed documents containing confidential information that are no longer required MUST be disposed of appropriately. If home workstations are equipped with printers, copiers, or all-in-one devices, it SHOULD be ensured that information printed there can also be suitably destroyed directly on site when it is no longer needed.
SYS.4.1.A4 Drawing Up a Security Policy for the Use of Printers, Copiers, and All-in-One Devices (S)
Organisations SHOULD develop a security policy for printers, copiers, and all-in-one devices. It SHOULD regulate the requirements and specifications for the information security of such devices and how they are to be met. It SHOULD also specify which functions may be administered or used by which users under which conditions.
SYS.4.1.A5 Drawing Up User Guidelines for Handling Printers, Copiers, and All-in-One Devices [Chief Information Security Officer (CISO)] (S)
A user guideline SHOULD also be created that summarises all the security requirements for handling printers and all-in-one devices in a clear and comprehensible manner. All users SHOULD be familiar with the guideline.
SYS.4.1.A7 Restriction of Remote Administrative Access to Printers, Copiers, and All-in-One Devices (S)
The IT Operation Department SHOULD ensure that only a clearly defined group of administrators and service technicians have remote administrative access to printers, copiers, and all-in-one devices. This SHOULD also be ensured if the organisation in question uses central device management software. It SHOULD be specified whether control panel displays can be viewed via a data network. If this is desired, such displays SHOULD only be transferable to employees in the IT Operation Department. This SHOULD also be agreed with the users concerned.
SYS.4.3 Embedded Systems
Target Object: IT system / Order: R2
SYS.4.3.A1 Rules for Handling Embedded Systems (B)
A person MUST be appointed to be in charge of embedded systems in order for them to operate smoothly. All users and administrators MUST be informed of any codes of conduct and reporting channels in the event of failures, malfunctions, or suspected security incidents. Embedded systems MUST be configured securely. These configurations SHOULD be documented. Regulations SHOULD be defined for testing integrity and functionality.
SYS.4.3.A10 Recovery of Embedded Systems (S)
Embedded systems SHOULD have rollback capabilities.
SYS.4.3.A11 Secure Disposal of Embedded Systems (S)
Prior to the disposal of embedded systems, all their data SHOULD be securely deleted. Their deletion (or destruction) SHOULD be documented.