9.1 Standard software

Description

Standard software is software offered on the market and which is generally available from specialist outlets, e.g. catalogues. It is characterised by the fact that it is intended to be installed by the user and that it can be easily adapted to suit the specific needs of the user.

This chapter deals with an approach to handling standard software with regard to security. The entire lifecycle of standard software is considered: drawing up a requirements catalogue, preselection of a suitable product, test, release, installation, licence administration and deinstallation.

The quality management system of the developer of the standard software is not covered in this chapter. It is assumed that the software has been developed in accordance with the usual quality standards.

The described procedure serves as orientation for establishing a security process as far as standard software is concerned. If applicable, the procedures listed here can also be compared with a process already carried out, or they can be partly reduced for present interests.

Threat Scenario

The following typical threats are assumed for "standard software" as part of IT baseline protection:

Organisational Shortcomings:

• T 2.1 Lack of, or insufficient, rules
• T 2.3 A lack of compatible, or unsuitable, resources
• T 2.26 Lack of, or inadequate, test and release procedures
• T 2.27 Lack of, or inadequate, documentation
• T 2.28 Violation of copyright
• T 2.29 Software testing with production data

Human Failure:

• T 3.3 Non-compliance with IT security measures
• T 3.38 Errors in configuration and operation

Technical Failure:

• T 4.8 Discovery of software vulnerabilities
• T 4.22 Software vulnerabilities or errors

Deliberate Acts:

• T 5.21 Trojan Horses
• T 5.23 Computer viruses
• T 5.43 Macro viruses

Recommended Countermeasures (S)

For the implementation of IT baseline protection, selection of the required packages of safeguards ("modules") as described in chapters 2.3 and 2.4, is recommended.

The safeguards package for the module "Standard software" is presented in the following. Depending on the nature and scope of the standard software, it must be considered whether only individual safeguards have to be reduced. S 2.79 to S 2.89 provide a detailed description of how the lifecycle of standard software can be shaped. These are supplemented by the other safeguards stated.

Organisation:

• S 2.9 (2) Ban on using non-approved software
• S 2.10 (2) Survey of the software held
• S 2.35 (1) Obtaining information on security weaknesses of the system
• S 2.40 (2) Timely involvement of the staff/factory council
• S 2.66 (2) The importance of certification for procurement
• S 2.79 (1) Determining responsibilities in the area of Standard software
• S 2.80 (1) Drawing up a requirements catalogue for standard software
• S 2.81 (1) Preselection of a suitable Standard software product
• S 2.82 (1) Developing a test plan for Standard Software
• S 2.83 (1) Testing Standard software
• S 2.84 (1) Deciding on and developing the installation instructions for standard software
• S 2.85 (1) Approval of Standard software
• S 2.86 (2) Guaranteeing the integrity of Standard software
• S 2.87 (2) Installation and configuration of Standard software
• S 2.88 (2) Licence management and version control of Standard software
• S 2.89 (3) De-installation of standard software
• S 2.90 (2) Checking delivery

Personnel:

• S 3.4 (1) Training before actual use of a program

Hardware/Software:

• S 4.34 (2) Using encryption, checksums or digital signatures (optional)
• S 4.78 (2) Careful modifications of configurations

Contingency Planning:

• S 6.21 (3) Backup copy of the software used (optional)