HP A-Series Spezifikationen PDF herunterladen (Seite 36)

Security Target Version 1.02, 08/16/2013

Assurance Activity – Design

Assurance Activity - Guidance

Assurance Activity - Testing

FDP_RIP.2.1

“Resources” in the context of this

requirement are network packets being

sent through (as opposed to “to”, as is the

case when a security administrator

connects to the TOE) the TOE. The

concern is that once a network packet is

sent, the buffer or memory area used by

the packet still contains data from that

packet, and that if that buffer is re-used,

those data might remain and make their

way into a new packet. The evaluator

shall check to ensure that the TSS

describes packet processing to the extent

that they can determine that no data will

be reused when processing network

packets. The evaluator shall ensure that

this description at a minimum describes

how the previous data are

zeroized/overwritten, and at what point

in the buffer processing this occurs.

FIA_PMG_EXT.1.1

The evaluator shall examine the operational

guidance to determine it provides guidance to

security administrators on the composition of

strong passwords, and it provides instructions

on setting the minimum password length.

The evaluator shall also perform the following tests.

One or more of these tests can be performed with a

single test case.

Test 1: The evaluator shall compose passwords that

either meet the requirements, or fail to meet the

requirements, in some way. For each password, the

evaluator shall verify the TOE supports the password.

While the evaluator is not required (nor is it feasible)

to test all possible compositions of passwords, the

evaluator shall ensure all characters, rule

characteristics, and a minimum length listed in the

requirement are supported, and justify the subset of

those characters chosen for testing.

FIA_UIA_EXT.1

The evaluator shall examine the TSS to

determine that it describes the logon

process for each logon method (local,

remote (HTTPS, SSH, etc.)) supported

for the product. This description shall

contain information pertaining to the

credentials allowed/used, any protocol

transactions that take place, and what

constitutes a “successful logon”.

The evaluator shall examine the operational

guidance to determine any necessary

preparatory steps (e.g., establishing credential

material such as pre-shared keys, tunnels,

certificates, etc.) to logging in are described.

For each supported the login method, the

evaluator shall ensure the operational guidance

provides clear instructions for successfully

logging on. If configuration is necessary to

ensure the services provided before login are

limited, the evaluator shall determine the

operational guidance provides sufficient

instruction on limiting the allowed services.

The evaluator shall perform the following tests for

each method by which administrators access the TOE

(local and remote), as well as for each type of

credential supported by the login method:

Test 1: The evaluator shall use the operational

guidance to configure the appropriate credential

supported for the login method. For that

credential/login method, the evaluator shall show

providing correct I&A information results in the

ability to access the system, while providing incorrect

information results in denial of access.

Test 2: The evaluator shall configure the services

allowed (if any) according to the operational

guidance, and then determine the services available to

an external remote entity. The evaluator shall

determine the list of services available is limited to

those specified in the requirement.

Test 3: For local access, the evaluator shall determine

what services are available to a local administrator

prior to logging in, and make sure this list is

consistent with the requirement.

FIA_UAU_EXT.2.1

Assurance activities for this requirement are covered under those for FIA_UIA_EXT.1. If other

authentication mechanisms are specified, the evaluator shall include those methods in the activities for

FIA_UIA_EXT.1.

1 2 ... 31 32 33 34 35 36 37 38 39 40 41 ... 65 66

Kommentare zu diesen Handbüchern

Keine Kommentare

HP A-Series Spezifikationen Seite 36

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für PC / Workstation Barebones HP A-Series