What are the Maximumprinzip, Kumulationseffekt, and Verteilungseffekt in the protection needs assessment?

Question

Accepted Answer

Maximum principle: a system takes the highest protection need of its applications. Cumulation: many applications together push it higher. Distribution: spreading an application over systems can lower each system's need.

* Maximumprinzip is the default rule; Kumulationseffekt adjusts up, Verteilungseffekt adjusts down. *
Maximumprinzip (maximum principle) — the default rule:
A system serving application A (confidentiality: very high) and application B (confidentiality: normal) gets confidentiality = very high. Per basic value (C, I, A) the highest requirement among all hosted applications wins. Example from the BSI: applications A (SH/H/N-M) and B (N-M/N-M/H) on system F yield SH/H/H.
Kumulationseffekt (cumulation effect) — adjust upward:
A system may need more protection than any single application suggests, because several applications fail simultaneously if it dies — the total damage is larger than each individual one (e.g. a virtualization host running 20 "normal" VMs).
Verteilungseffekt (distribution effect) — adjust downward:
A system may need less protection than its application suggests, because the application is distributed across several systems and this system runs only less-important parts (e.g. one node of a redundant cluster).
Tip: Max is the rule; cumulation and distribution are the two documented exceptions — one up, one down.