A research department runs a statistical analysis over a large data set. The software used is formally approved for the deployed database system and appears to run without errors. Only weeks later, a random sample shows: every result is wrong. The cause — a silent compatibility issue between the application and the database version.
Malfunctions are among the most insidious IT threats because they often occur without a visible error message. BSI lists them as elementary threat G 0.26 and emphasises: all three protection goals — confidentiality, integrity and availability — can be affected.
What’s behind it?
Modern IT systems are complex — and with complexity comes a growing number of potential points of failure. Malfunctions arise when hardware or software does not operate as intended, while the system still appears to be running. This distinguishes them from total failure (G 0.25), which is immediately apparent.
Causes of malfunction
- Material fatigue and wear — Mechanical components such as fans, hard drives and connectors degrade over time. Sporadic faults often signal an eventual failure weeks in advance.
- Conceptual weaknesses — Missing error handling in software, inadequate input validation or flawed algorithms lead to incorrect results.
- Exceeding operational limits — When a system is operated under load conditions for which it is not designed (too many concurrent users, excessive temperatures), intermittent faults occur.
- Incompatibilities — Unsupported combinations of operating system, driver and application produce subtle faults that surface in random samples but rarely in superficial tests.
- Missing maintenance — Clogged ventilation grilles, outdated firmware, uncalibrated sensors.
Impact
The real risk lies in how long it takes to detect. A faulty calculation that remains unnoticed for months can cause business decisions to rest on wrong foundations. Compromised database integrity requires extensive forensics to determine the point of first corruption and identify all affected records. Confidentiality is affected when malfunctions cause access controls to fail.
Practical examples
Overheating storage system. A storage array in a server room has a clogged ventilation grille. It does not fail completely but shows sporadic write errors. Only after several weeks does an administrator notice that stored files are incomplete. Reconstructing the affected data holdings takes weeks.
Incompatible analysis software. A department uses a statistical application that, according to the vendor documentation, is not approved for the deployed database system. The analysis appears to work but systematically produces wrong values. The flawed results feed into a quarterly report before a random sample reveals the error.
Network switch with defective port. A single port on a network switch transmits packets with sporadic bit errors. The affected workstation experiences occasional connection drops and corrupted file transfers. Because the errors are intermittent, fault diagnosis takes weeks until the defective port is identified.
Relevant controls
The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 33 mapped controls below in the section ‘ISO 27001 Controls Covering This Threat’.)
Prevention:
- A.8.8 — Management of technical vulnerabilities: Regular firmware updates and patches fix known bugs that cause malfunctions.
- A.7.13 — Equipment maintenance: Scheduled maintenance cycles detect wear before it leads to malfunction.
- A.8.19 — Installation of software on operational systems: Controlled software approval prevents incompatible configurations.
- A.8.29 — Security testing in development and acceptance: Tests before production use uncover incompatibilities and faulty behaviour.
Detection:
- A.8.15 — Logging: Central logging captures error messages, warnings and anomalies.
- A.8.16 — Monitoring activities: Monitoring detects performance drops, increased error rates and deviations from normal behaviour.
- A.5.34 — Privacy and protection of personal identifiable information (PII): Integrity checks protect against unnoticed data corruption.
Response:
- A.5.24 — Information security incident management planning and preparation: Documented procedures for handling detected malfunctions.
- A.8.14 — Redundancy of information processing facilities: Redundant systems can take over while the faulty system is repaired.
BSI IT-Grundschutz
G 0.26 is linked by the BSI IT-Grundschutz catalogue to the following modules:
- OPS.1.1.6 (Software tests and approvals) — Requirements for testing and acceptance before productive use.
- SYS.1.1 (General server) — Basic protection and maintenance requirements.
- INF.2 (Data centre and server room) — Physical protection measures against environment-related malfunctions.
- OPS.1.1.7 (Systems management) — Monitoring and proactive management of system states.
Sources
- BSI: The State of IT Security in Germany — Annual report with current statistics on IT disruptions
- BSI IT-Grundschutz: Elementary Threats, G 0.26 — Original description of the elementary threat
- ISO/IEC 27002:2022 Section 7.13 — Implementation guidance on equipment maintenance