INF.7 Office Workplace

Description

Introduction

An office room is the area within an institution where one or more employees are present to carry out their tasks. This building block describes the typical threats and requirements regarding information security for an office room.

Objective

The objective of this building block is to protect the information processed in office rooms.

Scope and Modeling

The building block INF.7 Office Workplace is to be applied to every room in the information domain that is used as an office workplace.

This building block addresses technical and non-technical security requirements for office rooms. Recommendations on how IT systems in these rooms can be configured and secured are not covered in this building block. Guidance on this can be found, among other places, in the building block SYS.2.1 General Client as well as in the operating system-specific building blocks.

Requirements for buildings in general are not part of this building block. These are found in the building block INF.1 General Building, which is always to be applied to rooms and buildings. The cabling of office rooms is also not addressed. For this purpose, the building block INF.12 Cabling must be considered.

Threat Landscape

Since IT-Grundschutz building blocks cannot address individual information domains, typical scenarios are used to illustrate the threat landscape. The following specific threats and vulnerabilities are of particular relevance for the building block INF.7 Office Workplace.

Unauthorized Access

If access controls are absent or inadequate, unauthorized persons can enter an office room and steal sensitive data, remove equipment, or manipulate it. This can impair the availability, confidentiality, or integrity of equipment and information. Even if no immediate damage is apparent, operational continuity can be disrupted. For example, it must be investigated how such an incident was possible, whether damage occurred, or whether manipulations were carried out.

Impairment Due to Unfavorable Working Conditions

An office room that is not set up according to ergonomic principles, or an unfavorable working environment, are problematic. Both can cause employees to be unable to work without interruption or to be unable to use the IT employed optimally. Disruptions can include noise, heavy customer traffic, unfavorable lighting, or poor ventilation. This can restrict workflows and employees’ potential. Errors can also creep into work, which can reduce the integrity of data.

Manipulation by Cleaning and External Personnel or Visitors

For smaller or brief meetings, it is usually more efficient to receive visitors in the office. However, visitors, just like cleaning and external personnel, could view internal information, jeopardize business processes, and manipulate IT systems in various ways. Everything from improper treatment of technical equipment to attempted “playing around” with IT systems to theft of documents or IT components is possible. For example, a power connection could be accidentally disconnected by cleaning personnel, or water could get into IT systems. Documents could also be misplaced or even disposed of with the waste.

Manipulation or Destruction of IT, Accessories, Information, and Software in the Office Room

Attackers may attempt to manipulate or destroy IT systems, accessories, and other storage media for various reasons. The attacks are all the more effective the later they are discovered by employees or the institution itself, the more extensive the perpetrators’ knowledge, and the more far-reaching the consequences for a work process. For example, sensitive employee data could be viewed without authorization. Storage media or IT systems could also be destroyed. Significant downtime and process restrictions could be the result.

Theft

As IT devices become increasingly compact, it is all the easier to slip them unnoticed into a bag. Theft of storage media, IT systems, accessories, software, or information generates replacement costs on the one hand. Resources are also required to restore a working state. On the other hand, losses due to unavailability can also occur. Furthermore, the person who stole the IT devices could view and disclose confidential information. This can cause further damage, which in many cases significantly outweighs the purely material loss of the IT device.

Along with expensive IT systems, mobile end devices that can be transported inconspicuously and easily are frequently stolen. If office rooms are not locked, not supervised, or IT systems are not adequately secured, the technology can accordingly be removed quickly and inconspicuously.

Trailing Cables

Depending on where the connection points for power outlets and the data network are located in the office room, cables could be routed across the room, including across traffic routes. Such “trailing” cables are not only trip hazards on which persons can injure themselves. If persons catch on them, IT devices can also be damaged.

Requirements

The following are the specific requirements of the building block INF.7 Office Workplace. The Information Security Officer (ISO) is responsible for ensuring that all requirements are met and verified in accordance with the established security concept. The ISO must always be involved in strategic decisions.

Additional roles are defined in the IT-Grundschutz Compendium. They should be filled where meaningful and appropriate.

Exactly one role should be Primarily responsible. There may also be Additional responsibilities. If one of these additional roles is primarily responsible for fulfilling a specific requirement, that role is listed in square brackets after the requirement heading. The use of singular or plural does not imply anything about the number of persons filling these roles.

Basic Requirements

The following requirements MUST be met as a priority for this building block.

INF.7.A1 Appropriate Selection and Use of an Office Room (B) [Supervisors]

ONLY suitable rooms MAY be used as office rooms. Office rooms MUST be appropriately selected and equipped for the protection needs or security level of the information processed therein. Office rooms with public traffic MUST NOT be located in security-relevant areas. The Workplace Ordinance MUST be implemented for the workplace and for the design of an office room.

INF.7.A2 Closed Windows and Locked Doors (B) [Employees, Facility Management]

When employees leave their office rooms, all windows SHOULD be closed. If confidential information is present in the office room, the doors MUST be locked when leaving. This SHOULD be observed especially in areas with public traffic. The relevant requirements SHOULD be set out in an appropriate directive. All employees SHOULD be required to comply with the directive. Additionally, it MUST be regularly checked whether windows are closed and, if necessary, doors are locked when the office room is vacated. It MUST also be ensured that fire and smoke protection doors are actually closed.

Standard Requirements

Together with the basic requirements, the following requirements represent the state of the art for this building block. They SHOULD generally be met.

INF.7.A3 Trailing Cables (S)

Power connections and network access points in the office room SHOULD be located where IT devices are installed. Cables routed across the floor SHOULD be appropriately covered.

INF.7.A4 DISCONTINUED (S)

This requirement has been discontinued.

INF.7.A5 Ergonomic Workplace (S) [Central Administration, Supervisors]

The workplaces of all employees SHOULD be set up ergonomically. Screens in particular SHOULD be positioned so that ergonomic and uninterrupted work is possible. Care SHOULD be taken that screens cannot be viewed by unauthorized persons. The Display Screen Ordinance (BildscharbV) SHOULD be implemented. All workplaces SHOULD be individually adjustable for the most error-free possible operation of IT.

INF.7.A6 Tidy Workplace (S) [Employees, Supervisors]

All employees SHOULD be encouraged to leave their workplace tidy. Employees SHOULD ensure that unauthorized persons cannot view confidential information. All employees SHOULD carefully check their workplaces and ensure that no confidential information is freely accessible. Supervisors SHOULD sporadically check workplaces to determine whether sensitive information is openly accessible there.

INF.7.A7 Appropriate Storage of Official Documents and Storage Media (S) [Employees, Facility Management]

Employees SHOULD be instructed to store confidential documents and storage media under lock and key when not in use. Appropriate containers SHOULD be placed in office rooms or their vicinity for this purpose.

Requirements for High Protection Needs

The following are exemplary proposals for requirements for this building block that go beyond the level of protection representing the state of the art. The proposals SHOULD be considered when protection needs are elevated. The specific determination is made within an individual risk analysis.

INF.7.A8 Use of Anti-Theft Devices (H) [Employees]

If access to rooms cannot be appropriately restricted, anti-theft devices SHOULD be used for all IT systems. Anti-theft devices SHOULD be used in areas with public traffic.

Additional Information

Good to Know

The Information Security Forum (ISF) provides requirements for the physical security and environmental security of buildings and rooms in its standard “The Standard of Good Practice for Information Security” in chapter CF19.

The German Institute for Standardization provides requirements for the physical security of buildings and rooms in its standard “DIN EN 1627:2021-11.”

The Federal Ministry of Labour and Social Affairs provides requirements for the design and operation of workplaces with regard to the safety and health protection of employees in its Workplace Ordinance.