IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.83 Testing Standard Software
Initiation responsibility: Head of Specialist Department, Head of IT
Section
Implementation responsibility: Test group
The testing of standard software can be divided up into the preparation,
implementation and evaluation. The following tasks must be carried out in
these sections:
Test Preparation
- Determining the test methods for the individual tests (test type, processes
and tools)
- Creating test data and test cases
- Establishing the necessary test environment
Performing the test
- Receipt tests
- Functional tests
- Tests of additional functional features
- Security-specific tests
- Pilot application
Test evaluation
The various tasks are described below
Test Preparation
Determining the test methods for the individual tests (test type, processes and
tools)
Methods for carrying out tests are, for example, statistical analyses,
simulation, proof of correctness, symbolic program execution, review,
inspection, failure analysis. It should be noted that some of these test methods
can only be carried out if the source coding is available. The suitable test
method must be selected and determined in the preparation stage.
It must be clarified which processes and tools will be used for testing
programs and checking documents. Typical processes for testing programs
are, for example, black box tests, white box tests or penetration tests.
Documents can be checked using informal methods, reviews or checklists, for
example.
A black box test is a functionality test without knowledge of the internal
program sequences. Here, the program is run with all data types for all test
cases with troubleshooting and plausibility checks.
A white box test is a functionality test with disclosure of the internal program
sequences, e.g. by source code evaluation or tracing. White box tests generally
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000