BSI ID: G 0.26

Devices and systems used for information processing today often have many functions and are therefore correspondingly complex in design. This applies to both hardware and software components. Due to their complexity, there are many different sources of error in such components. As a result, devices and systems repeatedly fail to function as intended, giving rise to safety issues.

There are many causes of malfunctions, including material fatigue, manufacturing tolerances, design flaws, exceeding limit values, unintended conditions of use, or lack of maintenance. Since no device or system is perfect, a certain residual probability of malfunction must always be accepted. Malfunctions of devices or systems can compromise all fundamental values of information security (confidentiality, integrity, availability).

In addition, malfunctions may remain undetected for long periods of time. This can result, for example, in calculation results being falsified and not corrected in time.

Examples:

• A blocked ventilation grille causes a storage system to overheat, which then does not fail completely but only exhibits sporadic malfunctions. It is not until several weeks later that it is noticed that the stored information is incomplete.

• A standard scientific application is used to perform a statistical analysis of a previously collected data set stored in a database. However, according to the documentation, the application is not approved for use with the database product in question. The analysis appears to work, but random checks reveal that the calculated results are incorrect. Compatibility issues between the application and the database are identified as the cause.