In Germany, the following infrastructure areas are deemed as critical: (see also http://www.bsi.bund.de/fachthem/kritis/index.htm): • transport • energy (electricity, oil and gas) • hazardous substances (chemical and biological agents, transport of hazardous material, arms industry) • information technology and telecommunications • the financial, monetary and insurance system • supply of vital goods and services (public health service, emergency and rescue services, civil protection, food and drinking water supply, waste disposal) • public authorities, the administration, the judiciary (including police, customs and federal armed forces) • other (the media, large research institutions, architectural buildings of outstanding or symbolic value, cultural heritage) Safe IT products In contrast to IT security products, the main characteristic of safe IT products is that they themselves are safe. Whether a product is safe or not can be established by evaluating it under certain security standards, such as ITSEC or Common Criteria, and can be documented in an IT security evaluation certificate. Special strategies, which strive to minimize the chance that vulnerabilities occur at all or, if they occur, to ensure that they are less complex, are used to develop safe IT products. Secure IT systems IT systems comprise several IT products and components and are used in specific environments and under given framework conditions as regards organizational structures and human resources. Secure IT systems are characterized by having in place a security management and by having implemented the necessary infrastructural, organizational, personnel and technical security measures that were evaluated by an independent body and issued a system security evaluation certificate. Page 19