IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- Demands on software can range from the manufacturer's declaration
concerning the quality assurance systems used, ISO 9000 etc. certificates to
independent software tests according to ISO 12119.
Brief examples:
- The software production process of the manufacturer must be
certified according to ISO 9000.
- The functionality of the product must be checked by an independent
body according to ISO 12119.
- It the product is to fulfil IT security functions, these are to be set down in
security requirements (c.f. S 4.42 Implementation of Security Functions in
the IT Application). This is described in detail below.
Security Requirements
Dependent on whether the product must have security features, security
functions can be stipulated in the Requirements Catalogue. Typical security
functions which are relevant here are briefly explained. Further details are to
be found in the ITSEC.
- Identification and authentication
Many products require that those users who have access to resources
controlled by the product should be determined and monitored. Not only
the claimed identity of the user should be determined, but it should be
checked whether the user really is the person he claims to be. This takes
place by the user providing the product with information connected to the
user in question.
- Access control
For many products it will be necessary to ensure that users and processes
working for these users are prevented from gaining access to information
or resources when they are not entitled to access or when access is not
necessary. Further, there will be requirements concerning the unauthorised
creation or modification (including deletion) of information.
- Logging
For many products it will be necessary to ensure that actions taken by users
or processes on behalf of such users are recorded. This allows the
consequences of such actions to be assigned to the user in question so that
the user can be held responsible for his actions.
- Protocol evaluation
For many products it will be necessary to ensure that sufficient information
is recorded concerning both usual and unusual incidents. Checks at a later
date can thus determine whether security breaches have taken place and
which information or other resources were affected.
- Incorruptibility
For many products it will be necessary to ensure that certain relations
between various data remain correct and that data can be transferred
between various processes without alteration.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000