IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
depth of the various features should be based on the confidence factor, i.e. the
amount of confidence placed in the correct operation of this feature. The
proneness to error and frequency of use of the feature must also be taken into
consideration. More detailed information is to be found in ISO 12119.
Notes:
- For requirements relevant to security, the test depth can also be adapted to
the mechanism strength required.
- The testing time for the initial tests should be kept to a minimum in regard
to the other tests.
The total testing time should then be distributed to the individual test sections
in accordance with the relative testing time of the feature.
Determining persons-in-charge of testing
It should be determined for each test which tasks are to be carried out and who
is responsible for these. In particular, it should be ensured that the staff /
works council, the Data Privacy Officer and the IT Security Officer are
involved in some tests.
Test environment
Testing is always destructive as errors are being looked for. Tests should thus
always be conducted in an isolated test environment.
If possible, the test environment should be a precise functional copy of the
production environment. It is generally not viable to completely recreate the
production environment.
So that the same conditions are present for the selected products, a reference
test environment should be defined. This can be further adjusted or limited for
individual tests.
The resources required for the various tests (equipment, IT infrastructure)
should be specified. It should be described in detail when, and to what extent,
these must be available.
It is important that all operating systems in all versions used in production are
available in the test environment. The intention is to determine system-based
weaknesses of components of the production environment in connection with
the standard software production to be installed. In exceptional cases, if
aspects can be generalised, individual components can be omitted.
The following aspects should be observed and help to set up a reliable and
suitable test environment:
- An up-to-date virus scan program should ensure that the test environment
is free of viruses.
- The test environment must be free of side effects on the actual operation. In
order to avoid interaction from the outset, the installation of dedicated IT
systems is recommended.
- The access rights must be configured in the test environment in the same
way as in the production area.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000