IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Assessment Scale
In order to be able to carry out a comparison of various products, criteria must
be available as to what extent the various requirements are fulfilled. To do
this, it is necessary to assess the quantitative and qualitative importance of the
various requirements for the IT-supported task.
This assessment can take place in three steps, for example. In the first step, it
is determined which features stipulated in the Requirements Catalogue are
necessary and which are desirable. If a necessary feature is not fulfilled, the
product is rejected (so-called K.O. criterion). In the event that a desirable
feature is not fulfilled, this is considered as a negative aspect, but the product
is not necessarily rejected as a result.
As a second step, the importance of the desirable features is determined. This
can be quantitative, for example, with values between 1 for low and 5 for
high. Necessary features must not be assessed quantitatively. In the event that
this is necessary, however, these features must be of a higher value than the
desirable features (in order to highlight the importance of a necessary feature,
it can represent a value of 10, for example).
In the third step, a confidence factor is determined for the feature with regard
to fulfilment of its intended task (e.g. with values between 1 for low and 5 for
high). On the basis of this confidence factor, a decision is taken as regards the
extent to which feature is to be tested. The confidence factor of the security
mechanisms must be determined in accordance with their strengths.
- low mechanism strength with confidence factor 1
- medium mechanism strength with confidence factor 3
- high mechanism strength with confidence factor 5
These guidelines should be checked according to the individual cases.
Examples:
In extracts, security requirements for some typical standard software products
are described below:
Word processing programs:
Necessary security features:
- Automatic saving of intermediate data while the program is running
Desirable security features:
- Password protection of individual files
- Encryption of individual files
- It must be possible to switch off the macro programming
File compression program:
Necessary security features:
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000