Cybersecurity concept in 8 steps

1 What is an IT security concept?

An IT security concept is an essential tool for companies to define basic measures for IT security and information security. Well-organised information security reduces the number of exploitable vulnerabilities in the information technology used and limits the impact in the event of a hacker attack.

The IT security concept does not specify how exactly these measures are to be implemented.

For example, the concept could specify that access to the internal network must be protected with VPN and two-factor authentication. However, no technical details such as specific software, hardware or cloud services are specified.

The IT security concept thus provides binding rules on how to implement IT security and the requirements of data protection in the company in order to maintain the protection goals of information security confidentiality, integrity and availability. The result is a concrete planning, management and implementation framework for IT security in the company.

An essential aspect of an IT security concept is its holistic approach: instead of concentrating on individual concrete solutions, the IT landscape of the company is considered as a whole.

2 How do I use this guide?

In this guide I show you how to create an IT security concept for an organisation. We highlight relevant issues, examine best practices and look at samples of the content of an IT security concept.

3 Goals of an IT security concept

The IT security concept is primarily concerned with protecting information from threat and loss. This can include, for example, confidential internal company data, customer data or personal data.

Suitable technical and organisational measures (TOM) are defined for this purpose.

Protection against hacker attacks

A hacker attack is an attempt by someone to gain unauthorised access to a computer, a computer system or a computer network with the intention of causing damage. These attacks aim to

• Destroy or disrupt IT systems,
• take control of IT systems
• alter or block access to data stored on IT systems
• delete data; or
• steal data.

An IT security concept should therefore definitely include measures to effectively prevent current attack scenarios such as ransomware.

Protection against insider attacks

However, an IT security concept should not only protect against hacker attacks from the outside. Internal employees also pose a great risk to the information security of companies. Careless employees or malicious (former) employees can steal or even delete data for financial or personal reasons.

External contractors and other third parties also often have legitimate access to sensitive data in order to work efficiently and flexibly. This poses a challenge for the IT security team. It is much more difficult to detect threats when the person in question already has legitimate access to sensitive information. Policies and technology can significantly reduce the risk of such data loss or theft.

Customer Requirements, Cyber Risk Insurance

A prudently created and carefully implemented IT security concept fulfils requirements with regard to.

• Certifications and compliance requirements such as TISAX and ISO 27001
• insurance benefits (cyber-risk insurance),
• increased trust among customers and suppliers

Data protection, KRITIS and other legal requirements

An IT security concept ensures that the measures indispensable for data protection in accordance with the DSGVO are implemented.

According to §8a BSIG, operators of critical infrastructures (KRITIS) must prove that their IT security is state of the art. An IT security concept is mandatory for this purpose.

4 Procedure for creating an IT security concept

There are many different approaches to the creation of an IT security concept. The following steps are roughly based on the recommendations of BSI Standard 200-2 (IT-Grundschutz methodology).

1. Definition of the information network: At the beginning of this IT security concept is the definition of which areas and locations of the company or authority are covered (definition of the scope).
2. Structural analysis: A good knowledge of the information, process and technical support systems is an important basis for the IT security concept. In particular, information on all specialist and IT applications, IT systems and servers, networks, rooms and buildings must be compiled.
3. Determining the need for protection: When determining the need for protection, the need for protection for the business processes, the information processed in the processes and the technical systems is determined. The protection requirement (e.g. normal, high, very high) and the security objectives (confidentiality, integrity, availability) are to be determined together with the persons responsible for the business.
4. Apart from the need for protection of the data for one's own company or authority, the extent to which contractual or regulatory requirements may influence the need for protection or the measures to be defined must be examined. These can be requirements for the use of cryptographic methods for the implementation of the GDPR or contractual obligations to achieve certification maturity of the TISAX standard.
5. Risk analysis and catalogue of measures Minimum requirements in the form of measures are assigned for all resources compiled in the structural analysis on the basis of the identified need for protection. The building blocks of the BSI Basic Protection can serve as support.
6. IT security check: After defining the measures, the current status of implementation must be checked. Deviations and open points must be noted and an implementation strategy derived.
7. Dealing with residual risks: It is likely that not all desired measures will be implemented immediately and completely. The currently remaining and identified residual risks should be dealt with responsibly.
8. Updating and updating: Decisions should be made on the regular updating and control of the defined measures.

6 Risk analysis

The basic approach of the IT-Grundschutz of the Federal Office for Information Security (BSI) does not provide for a direct risk analysis. For the implementation of standard security measures, it is usually sufficient to apply the measures described in the BSI's basic security standards and catalogues of measures. This covers the general risks associated with the technology application.

If an IT system or application requires special protection or the risks are not described in the BSI standard documents, BSI Standard 100-3 describes a risk analysis based on IT-Grundschutz. However, there are also other procedures, for example according to ISO 27005 or other norms and standards.

A risk analysis should also be used if security requirements have been tightened or if IT systems are used in scenarios that are not provided for in the IT-Grundschutz list.

In the case of normal protection requirements, this may possibly be the case for new technologies. For example, until recently, the BSI had no standard measures for the use of Kubernetes. A separate risk assessment may also make sense when using cloud technologies (IaaS/PaaS/SaaS).

If a risk analysis is necessary, it is often advisable for the responsible business and technical managers and external security experts to work together. In particular, external consultants can contribute an attack-oriented perspective that is often not available internally.

7 What legal requirements does the DSGVO (Germany) place on an IT security concept?

Even in the DSGVO (General Data Protection Regulation, Germany), which applies to data protection in the EU, an IT security concept is not formally required.

• However, Art. 30 DSGVO requires a written list of all processing activities and a general description of technical and organisational measures.
• Art 32 DSGVO gives an indication of the obligation to implement and apply risk-based technical and organisational measures. According to the GDPR, these measures must ensure a level of protection appropriate to the risk. A mature IT security concept fulfils this requirement.

8 How does an ISMS differ from an IT security concept?

An Information Security Management System (ISMS) is the big umbrella for all processes taking place and to be controlled within the framework of information security in a company or an authority. An IT security concept is usually a component of an ISMS.

An IT security concept focuses on the protection of data and information processed in information technology.

The ISMS is responsible, for example, for the continuation and ongoing updating of the IT security concept and the way in which residual risks are dealt with. The responsibilities and accountability are also regulated - in other words, the entire PDCA cycle.

In the case of an audit or certification (for example according to ISO/IEC 27001 or TISAX), the ISMS is primarily checked.

9 Who draws up the IT security concept?

The concrete procedure is specified by the IT security officer. Support is provided by the heads of the specialist departments and the administrative staff. But be careful, because creating an IT security concept requires extensive knowledge that no one can acquire in a short time.

Often, specialists are needed for the comprehensive identification of risks and the derivation of effective and cost-efficient measures, who are specifically hired in the company. However, such IT security specialists are often hard to find and have high salaries, which is why they are usually found in large companies.

For the creation of an IT security concept in SMEs (small and medium-sized enterprises), external consultants are often used, also because such a solution is usually much more cost-effective in the medium and long term.