Security compliance of test systems — A practical approach

Increased interest in security has resulted in greater demand for automated test systems to comply with security standards. Automated test systems have traditionally been operated in isolated environments because of their unique characteristics. However, changes in United States defense acquisition regulations require that defense contractors bring these test systems into compliance with National Institute of Standards and Technology Special Publication 800-171, a standard that makes no distinction between general-purpose information technology (IT) systems and special-purpose test systems. Applying modern IT security technologies to satisfy the standard's requirements is not so easy because the technologies have been designed with assumptions that are often not true of test systems. We propose that a useful strategy for compliance to this standard must address actual risks, be practical, use multi-dimensional solutions, and improve over time given test systems' unique characteristics.