If new software is tested with production data, unauthorised persons may be able to view sensitive personal data or other confidential information.

If the software is tested with original production data rather than copies (e.g. in the case of database systems), this can lead to even more extensive risks:

• In addition to confidentiality, software malfunctions during testing can lead to the integrity or availability of the production data being compromised.
• Unintentional changes in production data can also result from software being tested or operated incorrectly. These changes may not be identified quickly. Such errors can also affect other IT applications that access the same data sets.

These circumstances are very often exacerbated because the focus lies not on protecting the test data, but on whether the software behaves as intended during testing and meets the requirements defined.

• BSI -

  Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)