Task: IT-Grundschutz

With the Greenbone Security Manager it is possible to automatically check the german "IT-Grundschutz-Kataloge" as published and maintained by the Bundesamt für Sicherheit in der Informationstechnik (German Federal Office for IT Security, BSI).

Supported is the current (12th) "Ergänzungslieferung" with tests for over measures. That is the maximum number of measures which is possible to support with automatic tests.

Some measures are quite comprehensive so that the actual number of executed tests per system is beyond 100. The number of tested systems remains irrelevant for the Greenbone Security Manager.

This makes the Greenbone Security Manager the fastest co-worker for executing a IT-Grundschutz audit. And it opens the opportunity to install a check for breaches as a permanent background process.

Checking IT-Grundschutz

This example executes a simple check according to the German "IT-Grundschutz-Kataloge".

1. Import the scan configuration IT-Grundschutz Scan (12. EL)
   (outdated: IT-Grundschutz Scan for 11th EL)

   

   This covers the settings to execute all of the checks. The actual checks are not explicitly selected so that rather a summary result is generated.

   

2. The majority of checks for the measures is based on local security checks. For these a respective access needs to be configured. If not done yet, create a corresponding user account on the Windows systems (the higer the privileges of this user account, the more measures can be checked).

   

3. Define the target systems (targets) and, if applicable, choose the respective credentials.

   

4. Now you can create the actual task. This means to combine the imported scan configuration with the newly created targets.

   

5. The search is started by clicking on of the respective task. It can take a while for the scan to complete. To update the view with the current progress, click on .

   

6. As soon as the status changes to "Done" the complete report is available. At any time you can review the intermediate results. Please note, that for the textual form of the reports you need to enable category "Low" in the filter.

   With the imported scan configuration 2 versions of the results will be created: an overview in textual form (under "general/IT-Grundschutz") and a table for further processing (under "general/IT-Grundschutz-T"). For the latter, you need to enable category "Log" in the report filter

   

   

Import of results into a spreadsheet application

1. Choose download format "ITG" either in the report filter or in the task ovieview. Note: Using the report filter it is necessary to enable the category "Log".

   

   For this download format suitable tabular results for all target systems are automatically collected and joined.

2. Import the ITG file as so called CSV table into your spreadsheet application.

   

   The example above shows a import for OpenOffice 3.2. Please take care that the following settings are adjusted for the import (if not already default):

   • Charset: UTF-8
   • Field separator: The "pipe" symbol (vertical line)
   • Text separator: The doublequote
   • Last column: Type "Text"

3. Now the scan results are available in the spreadsheet application:

   

4. From this point you can create simple (like in the screenshot below) or, of course, your individual comprehensive analysis or report.

   

Import of results into IT-Grundschutz tools

A number of tools is available to help IT-Grundschutz processes with structured approach, data entries and management.

The german federal agency for IT security (Bundesamt für Sicherheit in der Informationstechnik, BSI) offers on its website an overview on IT-Grundschutz tools.

For an import of the results of a IT-Grundschutz scan into one of these tools please contact the vendor of the corresponding tool. For additional questions please don't hesitate to contact the Greenbone Support.

Result classes of IT-Grundschutz checks

The following result classes can occur for a check:

• nicht erfüllt (FAIL): It was detected that the target system does not fulfill the measure.

• erfüllt (OK): It was detected that the target system does fulfill the measure.

• Fehler (ERR): It was not possible to execute the test routine properly. For example, some checks like measure M4.001 require an agent installed on the target system. If the agent is not present the check can not be executed for technical reasons. In case no credentials are provided several of the checks will have this status.

• Prüfung für diese Maßnahme ist nicht verfügbar (NI): In general it is assumed this measure can be automatically checked for, but an implementation is not yet available. For newly released "Ergänzungslieferungen" this is initially true for a number of measures. However, the Greenbone Security Feed is updated continuously, and eventually all measures will be implemented.

• Prüfung dieser Maßnahme ist nicht implementierbar (NA): A number of measures of the "IT-Grundschutzkataloge" are kept too general to create an explicit automatic check. Other measures describe checks that can only be done physically and thus also belong to this class of test that can't be implemented at all.

• Prüfung für das Zielsystem nicht passend (NS): Some measures refer exclusively to a special type of operating system. If the target system runs another operating system type, the measure does not apply and the result class is set to NS.

• Diese Maßnahme ist entfallen (DEP): Some updates ("Ergänzungslieferungen") removed some measures without a replacement. Old IDs of such deprecated measures are never re-used. So, the results marked as DEP can be savely ignored but the entries remain for completeness.

Supported measures

This overview refers to the 11th Ergänzungslieferung. The measure ID's link to the corresponding detailed information available on the website of BSI.

The following test types are distinguished:

• Remote: For the check it is only necessary to have network connection to the target system.

• Credentials: For the check is is required to use a account on the target system.

• Agent: For the check it is necessary to install an agent (SLAD or WinSLAD) on the target system.