IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Tests of additional functional features
The additional features itemised in the Requirements Catalogue alongside the
security-specific features and the functional features must also be checked:
- Performance
Running time behaviour should be determined for all planned
configurations of the product. In order to test performance adequately,
general tests in which production working is simulated, or a pilot
application with selected users, are useful. It must be established whether
the set performance requirements are being met.
- Reliability
Behaviour during accidentally or maliciously caused system crashes (crash
test) must be analysed and it must be established what damage results from
this. A record must be made of whether the product can be properly and
correctly restarted following system crashes. A check must also be made as
to whether there can be direct access to data bases independent of the
regular program function. In many cases such access can lead to loss of
data and should be prevented by the product. It should also be recorded
whether the program supports possibilities of reversing ”critical actions”
(e.g. deleting, formatting).
- User-friendliness
Whether the product is user-friendly depends, to a particular degree, on the
subjective feeling of the tester. However, the following aspects can provide
clues when making the assessment:
- technology of menu surfaces (pull-down menus, scrolling, drag &
drop, etc.),
- design of menu surfaces (e.g. uniformity, comprehensibility, menudriven
operation),
- keyboard layout,
- error messages,
- trouble-free access to interfaces (batch operation, communication,
etc.),
- readability of the user documentation,
- help functions.
Analysis of user-friendliness must describe possible modes of operation of
the product, including operation following handling- or operating errors,
and their consequences and implications for maintaining secure operation.
- Maintainability
Personnel and financial expenditure on the maintenance and care of the
product should be determined during testing. This can be estimated with
the aid, for example, of reference factors such as other reference
installations, tests in specialist magazines, or using the installation
expenditure determined during testing. To do this, the number of manual
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000