Inhalt:
Security in the Computing Center
Excerpt from the Raiffeisen Informatik Security Handbook
Access Concept
Physical access to the premises at Raiffeisen Informatik is strictly regulated. A safety zones concept is applied considering the most varied security demands of various systems and facilities. Normally, access authorization is required to be able to pass zone borders; these are handed over to all employees in the form of coded keys (token and/or employee ID card). This electronic key system is centrally managed; authorization keys can be issued and locked again upon demand.
(Excerpt from Security Handbook of Raiffeisen Informatik, abridged)
Availability
Applications and systems in banking, finance, and commerce are often mission critical for our customers. Ensuring permanent availability without any compromises is our daily business. The most important equipment required for operating the computing center is stored in security zones. The redundancy of system critical components at different locations provides high level of protection against security attacks targeted at the equipment. This also applies to the infrastructure necessary to operate the equipment. WAN (Wide Area Network) access is also redundant whereby high availability is also provided in this area.
(Excerpt from Security Handbook of Raiffeisen Informatik, abridged)
Data Backup & Archiving
- universal concept for hosts, servers and clients
- state-of-the-art storage & backup technologies
- highest levels of availability and integrity of backup systems and media
- provision of all prescribed storage & archiving periods
- restrictive access protection to the archived data
- Secure disposal of old data media
Access Policy
The strategy of Raiffeisen Informatik follows the principle of minimum of rights and the separation of different tasks/roles. This means that when granting access authorization it is to be observed that only such rights are granted that are necessary for the performance of the respective task and/or correspond to the role (the "need to know" principle) as well as that tasks/functions incongruous in one person/role (e.g. ordering/release of payment or administration/auditing) are both logically and physically separated (separation of functions principle). Additionally, the principle that "Everything that is not expressly allowed is deemed prohibited" is valid.
(Excerpt from Raiffeisen Informatik Access Policy, abridged)