
Security Target Version 1.02, 08/16/2013
3. Security Problem Definition
The Security Problem Definition (composed of organizational policies, threat statements, and assumption) has been
drawn verbatim from the Security Requirements for Network Devices, Version 1.1, 8 June 2012 (NDPP). The NDPP
offers additional information about the identified threats, but that has not been reproduced here and the NDPP
should be consulted if there is interest in that material.
In general, the NDPP has presented a Security Problem Definition appropriate for network infrastructure devices,
such as switches, and as such is applicable to the HP TOE.
3.1 Organizational Policies
P.ACCESS_BANNER The TOE shall display an initial banner describing
restrictions of use, legal agreements, or any other
appropriate information to which users consent by
accessing the TOE.
3.2 Threats
T.ADMIN_ERROR An administrator may unintentionally install or configure
the TOE incorrectly, resulting in ineffective security
mechanisms.
T.TSF_FAILURE Security mechanisms of the TOE may fail, leading to a
compromise of the TSF.
T.UNAUTHORIZED_ACCESS A user may gain unauthorized access to the TOE data
and TOE executable code. A malicious user, process, or
external IT entity may masquerade as an authorized
entity in order to gain unauthorized access to data or
TOE resources. A malicious user, process, or external IT
entity may misrepresent itself as the TOE to obtain
identification and authentication data.
T.UNAUTHORIZED_UPDATE A malicious party attempts to supply the end user with
an update to the product that may compromise the
security features of the TOE.
T.UNDETECTED_ACTIONS Malicious remote users or external IT entities may take
actions that adversely affect the security of the TOE.
These actions may remain undetected and thus their
effects cannot be effectively mitigated.
T.USER_DATA_REUSE User data may be inadvertently sent to a destination not
intended by the original sender.
3.3 Assumptions
Kommentare zu diesen Handbüchern