Scenario: Operating your own server

If you operate your own server, there are various security measures to which you should adhere depending on the application and sensitivity of the data. In its IT-Grundschutz catalog (catalog of basic protection measures) , the BSI (German Federal Office for Information Security) outlines good starting points for maintaining the three goals of data security when the degree of required protection is categorized as "normal" (tips for servers with normal protection requirements):

  • confidentiality: protecting against unauthorized access to information
  • availability: protection against unauthorized influence on functionality
  • integrity: protection against unauthorized modification

If the degree of required protection is categorized as "high" or "very high," additional measures must be implemented. A key criterion for a higher degree of protection is data sensitivity. The following table provides recommendations for categorizing the level of protection, which can be raised at any time (such as through a risk analysis), but not lowered.

The following should be observed in addition:

  • If the server has data or applications that require different levels of protection, the rule of thumb is to ensure a maximum degree of security.
  • To reduce the complexity that results from implementing the highest level of security, it’s worth thinking about moving highly sensitive data/applications to a separate server that offers special protection.

Protection level

 

Confidentiality

Availability

Integrity

Personal data

High to very high [1]

High

Very high

Sensitive personal data

Very high

High

Very high

Intellectual property - unpublished research material  

Project-dependent

Project-dependent

Project-dependent

Intellectual property  – copyright-protected material that belongs to others

High

High

Normal

Business-critical data

Very high

In line with the needs of the people who require access to the data.

Very high

Other internal university data

Normal

Normal

Normal

[1] Depending on the size of the affected group (data for all students = very high, data involving student theses = high) – the key here is estimating the potential repercussions in case of data theft.

Additional measures

Additional measures to satisfy a higher level of protection for a target system can be found in the following modules and measures in the BSI catalog (some modules/measures apply to multiple categories).

The list of measures is not complete and is intended to make it easier to get started on the path to improved IT security. Suggestions for expanding the lists are welcome and can be submitted through: it-sicherheit(at)tum.de.

Confidentiality

  • B 1.7 Encryption concept
  • M 2.31 Authorized user and access rights profile documentation
  • M 4.238 Using a local packet filter
  • M 4.250: Selecting a central, network-based authentication service (TUM central identity management)
  • M 5.10: Restricted access rights allocation
  • ...

Availability

  • M 2.314 Using highly-available server architectures
  • M 4.238 Using a local packet filter
  • ...

Integrity

  • M 5.8 Regular network security checks
  • M 4.238 Using a local packet filter
  • ...

Centralized services

Regardless of the sensitivity of the data, we strongly encourage you to take advantage of the centralized services provided by TUM and the Leibniz Supercomputing Center. You can assume that these services adhere to the most stringent security standards. This will relieve you of having to think about specific security measures.

You should nevertheless review whether additional measures are necessary, such as encrypting highly sensitive data stored on a central NAS server.

An outline of the university’s centralized IT services can be found at: IT Systems and Services