IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Establishing the necessary test environment
The test environment described in the test plan must be established and the
products to be tested installed. The components used should be identified and
their configuration described. In the event that deviations from the described
configuration arise when installing the product, this should be documented.
Performing the test
The test must be carried out using the test plan. Each action, together with the
test results, must be adequately documented and evaluated. In particular, if
errors appear, these must be documented in such a way that they can be
reproduced. Operating parameters suited to later production working must be
determined and recorded to enable installation instructions to be drawn up
later.
If additional functions are detected in the product which are not listed in the
Requirements Catalogue but can nevertheless be of use, a short test for them
must be carried out at the very least. If it becomes apparent that this function
is of particular importance for later operation, they must be tested in full. For
the additional test expenditure incurred, application must be made if necessary
for an extension of the time limit to the person responsible. The test results
must be included in the overall evaluation.
If, when processing individual test contents, it becomes apparent that one or
several requirements of the Requirements Catalogue were not sufficiently
specific, these must be put in more specific terms if necessary.
Example: In the Requirements Catalogue, encryption is demanded to
safeguard the confidentiality of the data to be processed. During testing it has
become apparent that off-line encryption is unsuitable for the intended
purpose. An addition must therefore be made to the Requirements Catalogue
with regard to on-line encryption. (Off-line encryption must be initiated by the
user and each of the elements to be encrypted must be specified; on-line
encryption is carried out in a transparent way on behalf of the user with pre-set
parameters.)
Receipt tests
Before all other tests, the following basic aspects must first be tested, as any
failure in these receipt tests will lead to direct actions or the stopping of the
test:
- The absence of computer viruses in the product must be checked by a
current virus search program.
- It must be established in an installation test whether the product can be
installed simply, completely and comprehensibly for the later-intended
purpose. Likewise, there must be a check on how the product is completely
de-installed.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000