TÜV Informationstechnik GmbH

Transcription

1 9ICCC IT security starts here: At the building structure and its mission critical infrastructure Joachim Faulhaber & Wolfgang Peter TÜV Informationstechnik GmbH

2 Agenda Scope Risc potentials Physical security requirements Application of the criteria catalogue TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 1

3 Class ALC: Life-cycle support TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 2

4 ALC_DVS: Development security Objectives Development security is concerned with physical, procedural, personnel, and other security measures that may be used in the development environment to protect the TOE and its parts. It includes the physical security of the development location and TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 3

5 Data Center 9ICCC TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 4

6 Diversity of security procedural security IT security physical security TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 5

7 Physical security standards Depth of coverage between standards about 80% Differences in the methodology Slightly different focuses TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 6

8 Security Objectives Confidentiality Availability Integrity TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 7

9 Risk potentials Crime Operating malfunctions Force majeure TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 8

10 Crime Burglary Sabotage Vandalism Attack TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 9

11 Force majeure Fire Water Corrosive gases Explosion Rubble loads Lightning strikes Earthquakes TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 10

12 Operating malfunctions Lack of electrical supply by Breakdown Switching operations Overloading Air conditioning breakdown Communication breakdown Safety equipment breakdown Magnetic stray fields Radio frequencies TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 11

13 Comprehensive security for all physical aspects of data centers TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 12

14 TSI requirements Supply engineering Reliability Circ. air cooler / heat exchanger Room monitoring Outside air supply Procedures Function tests Maintenance Allocation Qualification Security concept Emergency concept Fire protection concept Maintenance concept Building plans Circuit diagram Air-conditioning and vent. diagram Air conditioning Organisation Documentation Environment Building Traffic routes Water Industry Warehouse Topography Zoning design Fire-Seals Arrangement Doors/windows Fire protection Lightning protection Security technology Fire protection technology Burglar alarm system Access control system Video system Security service Fire alarm system Fire extinguishing system Alarm equipment Field of application Redundant feeds Routes Routes Overvoltage protection red. central components Data networks Energy supply Distributors Overvoltage protection Uninterruptible power supply Standby generator TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 13

15 Cornerstones of infrastructure measures Fire alarm Temperature sensors Access control etc. Detection Precaution Overvoltage protection Intrusion detection UPS etc. But also planning certification Reaction Alarm relaying Fire extinguishing systems Starting standby generator unit etc. TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 14

16 Evaluation result Level1: medium protection requirements (according to the BSI infrastructure requirements of the baseline protection manual) Level2: extended protection requirements (extended requirements to all above mentioned aspects) Level3: high protection requirements (complete redundancy of essential components, no single point of failures, climate limits according to EN ) Level4: very high protection requirements (advanced access control, no adjacent hazard potentials, with minimal intervention time) TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 15

17 Creating trust Customers and markets Processing industry Market positioning Courts of Law Suppliers Bank Liability questions Basel II IT-operator Board Persuasion Conditions Insurance TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 16

18 Excerpt of TSI certified datacenters TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 17

19 Summary The matter of physical security Methodology & structural approach Application of parts of the criteria to CC site visits TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 18

20 TÜV Informationstechnik GmbH Member of TÜV NORD Group Joachim Faulhaber Deputy Division Manager TÜViT, Certification Wolfgang Peter Director Evaluation Body for IT Security TÜViT, Information Security Langemarckstr Essen, Germany Phone: Fax: URL: TÜV Informationstechnik GmbH Member of TÜV NORD Group J. Faulhaber, W. Peter 9ICC 19