External Service

Go up to Terms and Definitions

An External Service provides functionality used by a system while operating outside the applicable system or authorization boundary.

External Services include hosted repositories, identity services, certificate services, time services, vulnerability databases, licensing services, source-control services, and externally operated application programming interfaces.

An External Service differs from an External Network Connection. The connection provides the communication path. The service provides the functionality reached through that path.

Reliance upon an External Service introduces an external dependency. Availability, configuration, identity, authorization, integrity, version, and behavior of the service may affect system operation and the interpretation of test results.

a service used by a system and provided from outside the applicable system or authorization boundary

Adapted from the National Institute of Standards and Technology (NIST) definition of external system service:

NIST Computer Security Resource Center, “external information system service”

The word external identifies the location of the service relative to the applicable boundary. It does not require a particular ownership, commercial relationship, hosting technology, or geographic location.

A service operated by the same organization remains an External Service when it operates outside the boundary applicable to the system under consideration.

A test record identifies External Services whose availability, state, configuration, output, or behavior affects test execution or interpretation.

A DIDO-TE test retrieves a container image from a registry operating outside the Test Environment’s authorization boundary. The container registry constitutes an External Service. The network path used to reach the registry constitutes an External Network Connection.