IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
interventions which were necessary during installation to arrive at the
configuration sought must be documented. If experience with preceding
versions of the tested product has already been accumulated, an analysis
should be made of how expensive their maintenance was.
Enquiries should be made regarding the extent to which support is offered
by the manufacturer or seller and under what conditions. If a hotline is
offered by the manufacturer or seller, its ease of access and quality should
also be considered.
- Documentation
The existing documentation must be checked with a view to whether it is
complete, correct and consistent. In addition to this it should be
understandable, clear, error-free and easy-to-follow.
It must further be monitored whether it is adequate for secure use and
configuration. All security-related functions must be described.
Over and above this, the following additional points of the Requirements
Catalogue must be tested:
- compatibility requirements
- interoperability
- conformity to standards
- adherence to internal rules and legal provisions
- software quality
Security-specific tests
If specific security requirements were placed on the product, in addition to the
trials mentioned above, the following aspects must be examined:
- effectiveness and correctness of the security functions,
- strength of the security mechanisms and
- absolute necessity and unavoidability of the security mechanisms.
As the basis for a security check the Manual for the Evaluation of the Security
of Information Technology Systems (ITSEM) could, for example, be
consulted. This describes many of the procedures shown below. The
additional comments are an aid to orientation and serve as an introduction to
the topic.
At the outset it must first be demonstrated by functional tests that the product
supplies the required security functions.
Following this, it must be checked whether all the required security
mechanisms were mentioned in the Requirements Catalogue and, if necessary,
this must be amended. In order to confirm or reject the minimum strength of
the mechanisms, penetration tests must be carried out. Penetration tests must
be carried out after all other tests, as indications of potential weaknesses can
arise out of these tests.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000