IT Baseline Protection Manual - The Information Warfare Site

Threats Catalogue Deliberate Acts Remarks
____________________________________________________________________ .........................................
T 2.27 Lack of, or inadequate documentation
Various forms of documentation may be considered: the product description,
the administrator and user documentation required to use the product, and the
system documentation.
If documentation on the IT components used is inadequate or lacking, this can
have significant effects both on the selection and decision-making processes
regarding a product, and in terms of damage occurring during actual
operation.
If the documentation is inadequate in the case of damage such as hardware
failure or malfunctioning of programs, error diagnosis and rectification may
be delayed considerably or rendered completely impractical.
Examples:
- If a program stores working data in temporary files without sufficient
documentation of that process, this can lead to the situation that temporary
files are unsuitably protected and confidential information being exposed.
If these files are not sufficiently protected against user access, or if sectors
which are only used temporarily are not correctly deleted physically,
information can become accessible to unauthorised persons.
- When a new software product is installed, existing configurations are
changed. Other programs which have run correctly hitherto are then
incorrectly parameterised and crash. If the changes resulting from the
installation of new software were described in detail, the error could be
located and eliminated in less time.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000