Kritikalität einer Organisationseinheit feststellen/en: Unterschied zwischen den Versionen

Aktuelle Version vom 15. November 2021, 07:13 Uhr

The protection needs analysis reveals how critical an organizational unit actually is. Protection needs are defined as those IT risks that occur from the perspective of the IT service recipient and thus jeopardize the business and the implementation of the company's goals.

To identify this, structured interviews are usually conducted with the business.

To conduct a protection needs assessment, either an Expert or Professional must be able to conduct an interview with a functional area manager and collect data on the following questions:

What data do they process in your department?
How do you classify this data?
What business services (processes) do you need for daily business?
How do you classify these business services?
How long can you get along without the data in case of a system failure and how much data loss on a time axis back into the future would be tolerable?
What processing does your department go through?

Protection needs analysis

Question 1: What data do they process in your department?

The types of data used in the organizational unit must be determined. This could be, for example, accounting data, customer data or personnel data. Responsible persons must be identified and recorded for this data. Usually the responsible persons are found within the department or in a superior superior. Sometimes, however, it can happen that another department is named because data is processed for it.

Data types can be used by different organizational units. The data classification of the data types should be uniform throughout the company (e.g. Secret, Internal or Confidential). Only one responsible person can be defined per data type. Hierarchies among the data are also feasible. For example, the umbrella term financial data can also be subdivided into cost accounting data, balance sheet data, accounting data, wage data, etc. The persons responsible for this data can be other persons. The persons responsible for these data can be other persons than the person responsible for the financial data. Because the latter has delegated the responsibility, for example.

Question 2: How do you classify this data?

The classification aims at the protection goals of the data:

How do you classify this data in terms of its confidentiality? --> Data class and from this results the associated possible Damage extent. Furthermore, you should record possible scenarios for a damage and provide additional concrete damage information (if possible) in EUR or also classify the damage if it is not of a purely monetary nature (e.g. image damage).

Capturing the sensitivity of the data during the interview is especially useful for personal data.

The retention period for the data can also be determined here.

Question 3: What business services do you need for daily business operations?

Business applications (ERP, DMS, financial accounting, etc.)
Clinical administrative applications (patient administration, therapy planning, patient documentation, etc.)
Medical systems with integration of medical devices
Communication systems (mail, intranet, internet, Skype, telephony, fax etc.)
Data storage services (file-share, collaboration platforms, cloud services, etc.)
and what data is related to these applications (created, edited, viewed, ...)

Question 4: How do you classify these business services?

Here, the classification is done for the protection goals that target systems:

How do you classify a loss of integrity or authenticity?
How do you classify a loss of availability with respect to the application:

- short term intraday availability loss during business hours? (2-4h)

not workable | limited workable

Risk class regarding risk impact (medium damage / worst case)

- all day application availability loss during business hours? (8-24h)

not workable | limited workable

Risk class regarding risk impact (medium damage / worst case)

- a longer-term loss of availability of the application during business hours? (>1 day; up to 2 days or more)

not workable | limited workable

Risk class in terms of risk impact (medium damage / worst case).

etc

Here in particular, business services are used by different departments. It is therefore necessary to evaluate which department places which requirements on the respective service. The requirement of the department with the greatest risk potential for each protection goal is drawn for the service. IT operations must be aligned with this requirement.

Services that are used by very many or all departments (even if they are only slightly critical for the respective department) are then considered to be more important and are also aligned accordingly than if they are used, for example, by only one or by a very small number of departments and are thereby classified as very critical. Essential is thereby also the weighting of the activity of the department on the operational operating result if it concerns a supporting department like e.g. quality management or the production management.

Question 5: How long can you go without the data, in the event of a system failure and how much data loss on a time axis back to the future would be tolerable?

Lastly, you should also determine RPO / RTO / response times for the applications:

Recovery Time Objective (RTO) - How long can a business process/system be down? The RTO is the time taken from the time of damage to complete recovery of business processes (recovery of: Infrastructure - Data - Reprocessing of data - Resumption of activities) may elapse. The time period here can range from 0 minutes (systems must be available immediately), to several days (in individual cases weeks).

Recovery Point Objective (RPO) - How much data loss can be accepted? The RPO is the time period that is allowed between two backups, i.e. how much data/transactions can be lost at most between the last backup and the system failure. If no data loss is acceptable, the RPO is 0 seconds.

Question 6: What processing does your department go through?

What data is processed in it (personal data)?
Which applications are used for it?
Which other departments participate in it? From which other departments do they depend for their work (deliver, receive, bidirectional)?

Results from the protection needs analysis

Dependency between business - systems - data - processing activities.
Which data are processed in which applications
Which data is exchanged via which communication systems Which data is stored where
Ranking of data types according to protection goals and risk classification
Ranking of processing activities by protection objectives and risk ratings
Ranking of business IT services according to protection goals and risk classification
Ranking of Med. adm. Services according to protection objectives and risk classification
Ranking of Med. clin. Services according to protection goals and risk classification
Ranking of communication services according to protection goals and risk classification
Ranking of data repositories according to protection goals and risk classification
Key figures for backup and emergency planning

This information can subsequently be helpful in order to:

Conduct risk analyses in a targeted manner depending on protection goals / risk classifications.
create guidelines
Create training programs
Emergency planning and business continuity management

Visualization of the protection needs analysis in the graph

A protection needs analysis has different statuses, just like other checks. Depending on the status, the protection needs analysis is displayed differently in the graph.

If the evaluation is "activated", thin lines with default value 0 of the dependency are displayed in the graph.
In case of evaluation "completed", the strokes are displayed according to the percentage rating of the damage extent class in the risk policy.

@@ Zeile 1: / Zeile 1: @@
-Wie kritisch eine Organisationseinheit tatsächlich ist wird im Rahmen der Schutzbedarfsanalyse  sichtbar. Als Schutzbedarfe werden jene IT-Risiken bezeichnet, welche aus der Perspektive des IT-Leistungsempfängers auftreten und dadurch das Business und somit die Umsetzung der Unternehmensziele gefährden.
+The protection needs analysis reveals how critical an organizational unit actually is. Protection needs are defined as those IT risks that occur from the perspective of the IT service recipient and thus jeopardize the business and the implementation of the company's goals.
-Um dies zu erkennen werden in der Regel strukturierte Interviews mit dem Business geführt. Dabei sind folgende Informationen zu erheben:
+To identify this, structured interviews are usually conducted with the business.
-Zur Durchführung einer Schutzbedarfsanalyse muss entweder ein Expert oder Professional ein Interview mit einem Fachbereichsverantwortlichen führen und Daten zu folgenden Fragestellungen erfassen können.
+To conduct a protection needs assessment, either an Expert or Professional must be able to conduct an interview with a functional area manager and collect data on the following questions:
-# Welche Daten verarbeiten sie in Ihrer Abteilung?
+# What data do they process in your department?
-# Wie klassifizieren sie diese Daten?
+# How do you classify this data?
-# Welche Business Services(Prozesse) benötigen Sie für das tägliche business?
+# What business services (processes) do you need for daily business?
-# Wie klassifizieren sie diese Business Services?
+# How do you classify these business services?
-# Wie lange können Sie ohne die Daten auskommen, im Falle eines Systemausfalls und wie viel Datenverlust auf einer zeitlichen Achse zurück in die Zukunft wäre verkraftbar?
+# How long can you get along without the data in case of a system failure and how much data loss on a time axis back into the future would be tolerable?
-# Welche Verarbeitungsprozesse durchlaufen Ihre Abteilung?
+# What processing does your department go through?
-== Schutzbedarfsanalyse  ==
+== Protection needs analysis ==
-=== Frage 1: Welche Daten verarbeiten sie in Ihrer Abteilung? ===
+=== Question 1: What data do they process in your department? ===
-Die Datenarten welche in der Organisationseinheit verwendet werden müssen ermittelt werden. Dies könnten z.B. Buchhaltungsdaten,Kundendaten oder Personaldaten  sein. Für diese Daten müssen Verantwortliche ermittelt und erfasst werden. Meist finden sich die Verantwortlichen innerhalb des Fachbereichs bzw. in einem übergeordneten Vorgesetzten. Manchmal kann es aber auch vorkommen, dass ein anderer Fachbereich genannt wird, da Daten für diesen bearbeitet werden.
+The types of data used in the organizational unit must be determined. This could be, for example, accounting data, customer data or personnel data. Responsible persons must be identified and recorded for this data. Usually the responsible persons are found within the department or in a superior superior. Sometimes, however, it can happen that another department is named because data is processed for it.
-Datenarten können von unterschiedlichen Organisationseinheiten verwendet werden. Die Datenklassifikation der Datenarten sollte im gesamten Unternehmen einheitlich sein (z.b Geheim,Intern oder Vertraulich). Pro Datenart kann nur ein Verantwortlicher definiert werden. Auch Hierarchien unter den Daten sind machbar. Z.B. kann der Überbegriff Finanzdaten auch in Kostenrechnungs-, Bilanz-, Abrechnungs-, Lohndaten etc. unterteilt werden. Die Verantwortlichen dieser Daten können andere Personen sein, als der Verantwortliche der Finanzdaten. Weil dieser z.B. die Verantwortlichkeit delegiert hat.
+Data types can be used by different organizational units. The data classification of the data types should be uniform throughout the company (e.g. Secret, Internal or Confidential). Only one responsible person can be defined per data type. Hierarchies among the data are also feasible. For example, the umbrella term financial data can also be subdivided into cost accounting data, balance sheet data, accounting data, wage data, etc. The persons responsible for this data can be other persons. The persons responsible for these data can be other persons than the person responsible for the financial data. Because the latter has delegated the responsibility, for example.
-=== Frage 2: Wie klassifizieren sie diese Daten? ===
+=== Question 2: How do you classify this data? ===
-Die Klassifizierung zielt auf die Schutzziele der Daten ab:
+The classification aims at the protection goals of the data:
-* Wie klassifizieren Sie diese Daten hinsichtlich Ihrer '''Vertraulichkeit'''? --> Datenklasse und daraus ergibt sich das zugehörige mögliche [[Risikopolitik#Schadensausma.C3.9Fe|Schadensausmaße]]. Weiters sollten Sie mögliche Szenarien für einen Schaden erfassen und zusätzliche konkrete Schadensangabe (wenn möglich) in EUR  machen bzw. den Schaden auch klassifizieren wenn er nicht rein monetärer Natur ist (z.B Imageschaden).
+* How do you classify this data in terms of its '''confidentiality'''? --> Data class and from this results the associated possible [[Special:MyLanguage/Risikopolitik#Schadensausma.C3.9Fe|Damage extent]]. Furthermore, you should record possible scenarios for a damage and provide additional concrete damage information (if possible) in EUR or also classify the damage if it is not of a purely monetary nature (e.g. image damage).
-* Die Sensibilität der Daten im Rahmen des Interviews zu erfassen  ist vor allem bei personenbezogenen Daten sinnvoll.
+* Capturing the sensitivity of the data during the interview is especially useful for personal data.
-* Die Aufbewahrungsdauer für die Daten kann hier ebenfalls ermittelt werden.
+* The retention period for the data can also be determined here.
-=== Frage 3: Welche Business Services benötigen Sie für den täglichen Geschäftsbetrieb? ===
+=== Question 3: What business services do you need for daily business operations? ===
-* Business Anwendungen (ERP, DMS, Finanzbuchhaltung etc.)
+* Business applications (ERP, DMS, financial accounting, etc.)
-* Klinische administrative Anwendungen (Patientenadministration, Therapieplanung, Patientendokumentation etc.)
+* Clinical administrative applications (patient administration, therapy planning, patient documentation, etc.)
-* Medizinische Systeme unter Einbindung von Medizinprodukten
+* Medical systems with integration of medical devices
-* Kommunikationssysteme (Mail, Intranet, Internet, Skype, Telefonie, Fax etc.)
+* Communication systems (mail, intranet, internet, Skype, telephony, fax etc.)
-* Datenablage-Services (File-Share, Kollaborations-Plattformen, Cloud Services etc.)
+* Data storage services (file-share, collaboration platforms, cloud services, etc.)
-* und '''welche Daten stehen mit diesen Applikationen in Zusammenhang''' (erstellt, bearbeitet, eingesehen, …)
+* and '''what data is related to these applications''' (created, edited, viewed, ...)
-=== Frage 4: Wie klassifizieren sie diese Business Services? ===
+=== Question 4: How do you classify these business services? ===
-Hier erfolgt die Klassifizierung für die Schutzziele die auf Systeme abzielen:
+Here, the classification is done for the protection goals that target systems:
-* Wie klassifizieren Sie einen Integritäts- bzw. Authentizitätsverlust?
+* How do you classify a loss of integrity or authenticity?
-* Wie klassifizieren Sie einen Verfügbarkeitsverlust bzgl. der Applikation:
+* How do you classify a loss of availability with respect to the application:
-:- kurzweiligen untertägigen Verfügbarkeitsverlust in den Geschäftszeiten? (2-4h)
+:- short term intraday availability loss during business hours? (2-4h)
-::: nicht arbeitsfähig | eingeschränkt arbeitsfähig
+::: not workable | limited workable
-::: Risikoklasse hinsichtlich Risikoauswirkung (mittlerer Schaden / worst case)
+::: Risk class regarding risk impact (medium damage / worst case)
-:- ganztägigen Verfügbarkeitsverlust der Applikation in den Geschäftszeiten? (8-24h)
+:- all day application availability loss during business hours? (8-24h)
-::: nicht arbeitsfähig | eingeschränkt arbeitsfähig
+::: not workable | limited workable
-::: Risikoklasse hinsichtlich Risikoauswirkung (mittlerer Schaden / worst case)
+::: Risk class regarding risk impact (medium damage / worst case)
-:- einen längerfristigen Verfügbarkeitsverlust der Applikation in den Geschäftszeiten? (>1 Tag; bis zu 2 Tage oder mehr)
+:- a longer-term loss of availability of the application during business hours? (>1 day; up to 2 days or more)
-::: nicht arbeitsfähig | eingeschränkt arbeitsfähig
+::: not workable | limited workable
-::: Risikoklasse hinsichtlich Risikoauswirkung (mittlerer Schaden / worst case)
+::: Risk class in terms of risk impact (medium damage / worst case).
 * etc
-Vor allem hier werden Business Services von unterschiedlichen Fachbereichen verwendet. Es muss daher ausgewertet werden welcher Fachbereich welche Anforderungen an den jeweiligen Service stellt. Es zieht die Anforderung des Fachbereichs mit dem größten Gefahrenpotential je Schutzziel für den Service. Nach dieser Anforderung muss der IT-Betrieb ausgerichtet werden.
+Here in particular, business services are used by different departments. It is therefore necessary to evaluate which department places which requirements on the respective service. The requirement of the department with the greatest risk potential for each protection goal is drawn for the service. IT operations must be aligned with this requirement.
-Services die von sehr vielen bzw. allen Abteilungen genutzt werden (auch wenn sie nur wenig kritisch für die jeweilige Abteilung sind), dann als gewichtiger betrachtet werden und auch danach ausgerichtet werden, als wenn sie z.B. nur von einer oder von einer sehr geringen Anzahl an Abteilungen verwendet werden und dabei als sehr kritisch eingestuft werden. Wesentlich ist dabei auch die Gewichtung der Tätigkeit der Abteilung auf das operative Betriebsergebnis wenn es sich um eine unterstützende Abteilung wie z.B. Qualitätsmanagement oder die Produktionsleitung handelt.
+Services that are used by very many or all departments (even if they are only slightly critical for the respective department) are then considered to be more important and are also aligned accordingly than if they are used, for example, by only one or by a very small number of departments and are thereby classified as very critical. Essential is thereby also the weighting of the activity of the department on the operational operating result if it concerns a supporting department like e.g. quality management or the production management.
-=== Frage 5: Wie lange können Sie ohne die Daten auskommen, im Falle eines Systemausfalls und wie viel Datenverlust auf einer zeitlichen Achse zurück in die Zukunft wäre verkraftbar? ===
+=== Question 5: How long can you go without the data, in the event of a system failure and how much data loss on a time axis back to the future would be tolerable? ===
-Zuletzt sollten Sie auch RPO / RTO / Reaktionszeiten für die Applikationen ermitteln:
+Lastly, you should also determine RPO / RTO / response times for the applications:
-*'''Recovery Time Objective (RTO)''' - Wie lange darf ein Geschäftsprozess/System ausfallen? Bei der RTO handelt es sich um die Zeit, die vom Zeitpunkt des Schadens bis zur vollständigen Wiederherstellung der Geschäftsprozesse (Wiederherstellung von: Infrastruktur - Daten - Nacharbeitung von Daten - Wiederaufnahme der Aktivitäten) vergehen darf. Der Zeitraum kann hier von 0 Minuten (Systeme müssen sofort verfügbar sein), bis mehrere Tage (in Einzelfällen Wochen) betragen.
+*'''Recovery Time Objective (RTO)''' - How long can a business process/system be down? The RTO is the time taken from the time of damage to complete recovery of business processes (recovery of: Infrastructure - Data - Reprocessing of data - Resumption of activities) may elapse. The time period here can range from 0 minutes (systems must be available immediately), to several days (in individual cases weeks).
-*'''Recovery Point Objective (RPO)''' - Wie viel Datenverlust kann in Kauf genommen werden? Bei der RPO handelt es sich um den Zeitraum, der zwischen zwei Datensicherungen liegen darf, das heißt, wie viele Daten/Transaktionen dürfen zwischen der letzten Sicherung und dem Systemausfall höchstens verloren gehen. Wenn kein Datenverlust hinnehmbar ist, beträgt die RPO 0 Sekunden.
+*'''Recovery Point Objective (RPO)''' - How much data loss can be accepted? The RPO is the time period that is allowed between two backups, i.e. how much data/transactions can be lost at most between the last backup and the system failure. If no data loss is acceptable, the RPO is 0 seconds.
-=== Frage 6: Welche Verarbeitungsprozesse durchlaufen Ihre Abteilung? ===
+=== Question 6: What processing does your department go through? ===
-* Welche Daten werden darin verarbeitet (personenbezogene Daten)?
+* What data is processed in it (personal data)?
-* Welche Applikationen werden dafür verwendet?
+* Which applications are used for it?
-* Welche anderen Abteilungen nehmen daran teil?  Von welchen anderen Fachbereichen sind sie in ihrer Arbeit abhängig (liefern, erhalten, bidirektional)
+* Which other departments participate in it?  From which other departments do they depend for their work (deliver, receive, bidirectional)?
-== Ergebnisse aus der Schutzbedarfsanalyse  ==
+== Results from the protection needs analysis ==
-* Abhängigkeit zwischen Fachbereich –Systeme – Daten - Verarbeitungstätigkeiten
+* Dependency between business - systems - data - processing activities.
-* Welche Daten werden in welchen Applikationen verarbeitet
+* Which data are processed in which applications
-* Welche Daten werden über welche Kommunikationssysteme ausgetauscht Welche Daten werden wo abgelegt
+* Which data is exchanged via which communication systems Which data is stored where
-* Reihung der Datenarten nach Schutzzielen und Risikoeinstufung
+* Ranking of data types according to protection goals and risk classification
-* Reihung von Verarbeitungstätigkeiten nach Schutzzielen und Risikoeinstufungen
+* Ranking of processing activities by protection objectives and risk ratings
-* Reihung der Business IT Services nach Schutzzielen und Risikoeinstufung
+* Ranking of business IT services according to protection goals and risk classification
-* Reihung der Med. adm. Services nach Schutzzielen und Risikoeinstufung
+* Ranking of Med. adm. Services according to protection objectives and risk classification
-* Reihung der Med. klin. Services nach Schutzzielen und Risikoeinstufung
+* Ranking of Med. clin. Services according to protection goals and risk classification
-* Reihung der Kommunikationsservices nach Schutzzielen und Risikoeinstufung
+* Ranking of communication services according to protection goals and risk classification
-* Reihung der Datenablagen nach Schutzzielen und Risikoeinstufung
+* Ranking of data repositories according to protection goals and risk classification
-* Kennzahlen für Backup und Notfallplanung
+* Key figures for backup and emergency planning
-Diese Informationen können in weiterer Folge hilfreich sein um:
+This information can subsequently be helpful in order to:
-* Risikoanalysen zielgerichtet abhängig von Schutzzielen / Risikoeinstufungen durchzuführen
+* Conduct risk analyses in a targeted manner depending on protection goals / risk classifications.
-* Richtlinien zu erstellen
+* create guidelines
-* Schulungsprogramme zu erstellen
+* Create training programs
-* Notfallplanung und Business Continuity Management
+* Emergency planning and business continuity management
-== Visualisierung der Schutzbedarfsanalyse im Graph ==
+== Visualization of the protection needs analysis in the graph ==
-Eine Schutzbedarfsanalyse hat unterschiedliche Stati, wie andere Überprüfungen auch. Abhängig vom Stati wird die Schutzbedarfsanalyse unterschiedlich im Graphen dargestellt.
+A protection needs analysis has different statuses, just like other checks. Depending on the status, the protection needs analysis is displayed differently in the graph.
-* Bei Bewertung „aktiviert“ werden dünne Striche mit default-Wert 0 der Abhängigkeit im Graph dargestellt.
+* If the evaluation is "activated", thin lines with default value 0 of the dependency are displayed in the graph.
-* Bei Bewertung „abgeschlossen“ werden die Striche entsprechend der prozentuellen Wertung der Schadensausmaßklasse in der Risikopolitik dargestellt.
+* In case of evaluation "completed", the strokes are displayed according to the percentage rating of the damage extent class in the risk policy.