HP A-Series Spezifikationen PDF herunterladen (Seite 40)

Security Target Version 1.02, 08/16/2013

Assurance Activity

ADV_FSP

There are no specific assurance activities associated with these SARs. The functional specification documentation is provided to support the evaluation

activities described in Section 4.2 (of the NDPP), and other activities described for AGD, ATE, and AVA SARs. The requirements on the content of

the functional specification information is implicitly assessed by virtue of the other assurance activities being performed; if the evaluator is unable to

perform an activity because the there is insufficient interface information, then an adequate functional specification has not been provided.

AGD_OPE

Some of the contents of the operational guidance will be verified by the assurance activities above and evaluation of the TOE according to the CEM.

The following additional information is also required.

The operational guidance shall at a minimum list the processes running (or that could run) on the TOE in its evaluated configuration during its

operation that are capable of processing data received on the network interfaces (there are likely more than one of these, and this is not limited to the

process that 'listens' on the network interface). It is acceptable to list all processes running (or that could run) on the TOE in its evaluated configuration

instead of attempting to determine just those process the network data. For each process listed, the administrative guidance will contain a short (e.g.,

one- or two-line) description of the process' function, and the privilege with which the service runs. 'Privilege' includes the hardware privilege level

(e.g., ring 0, ring 1), any software privileges specifically associated with the process, and the privileges associated with the user role the process runs

as or under.

The operational guidance shall contain instructions for configuring the cryptographic engine associated with the evaluated configuration of the TOE. It

shall provide a warning to the administrator that use of other cryptographic engines was not evaluated nor tested during the CC evaluation of the TOE.

The documentation must describe the process for verifying updates to the TOE, either by checking the hash or by verifying a digital signature. The

evaluator shall verify this process includes the following steps:

1. For hashes, a description of where the hash for a given update can be obtained. For digital signatures, instructions for obtaining the

certificate that will be used by the FCS_COP.1(2) mechanism to ensure a signed update has been received from the certificate owner. This

may be supplied with the product initially, or may be obtained by some other means.

2. Instructions for obtaining the update itself. This should include instructions for making the update accessible to the TOE (e.g., placement

in a specific directory).

3. Instructions for initiating the update process, as well as discerning whether the process was successful or unsuccessful. This includes

generation of the hash/digital signature.

The TOE will likely contain security functionality that does not fall in the scope of evaluation under this PP. The operational guidance shall make it

clear to an administrator which security functionality is covered by the evaluation activities.

AGD_PRE

As indicated in the introduction above, there are significant expectations with respect to the documentation—especially when configuring the

operational environment to support TOE functional requirements. The evaluator shall check to ensure the guidance provided for the TOE adequately

addresses all platforms claimed for the TOE in the ST.

ALC_CMC

The evaluator shall check the ST to ensure it contains an identifier (such as a product name/version number) that specifically identifies the version that

meets the requirements of the ST. Further, the evaluator shall check the AGD guidance and TOE samples received for testing to ensure the version

number is consistent with that in the ST. If the vendor maintains a web site advertising the TOE, the evaluator shall examine the information on the

web site to ensure the information in the ST is sufficient to distinguish the product.

ALC_CMS

The 'evaluation evidence required by the SARs' in the NDPP is limited to the information in the ST coupled with the guidance provided to

administrators and users under the AGD requirements. By ensuring the TOE is specifically identified and this identification is consistent in the ST and

in the AGD guidance (as done in the assurance activity for ALC_CMC.1), the evaluator implicitly confirms the information required by this

component.

1 2 ... 35 36 37 38 39 40 41 42 43 44 45 ... 65 66

Kommentare zu diesen Handbüchern

Keine Kommentare

HP A-Series Spezifikationen Seite 40

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für PC / Workstation Barebones HP A-Series