Download CA Layer 7 Security Target

CA Layer 7
#
Source
Security Target
Requirement
Assurance
Family
standard for the nation in which the evaluation is being conducted.
38. FTP_ITC.1(
2)
The evaluator shall test this capability by enabling secure communications on
the TOE and placing a packet sniffer on the local network. They shall then use
the TOE to perform actions that require communications to all trusted IT
products with which it communicates and observe the captured packet traffic
that is directed to or from the TOE to ensure that their contents are obfuscated.
ATE_IND
39. FTP_TRP.1
The evaluator shall check the operational guidance to verify that it discusses
the methods by which users will interact with the TOE such as a web
application via HTTPS. The evaluator shall check the operational guidance to
determine if it discusses the mechanism by which a trusted path to the TOE is
established and what environmental components (if any) the TSF relies on to
assist in this establishment.
AGD_OPE
40. FTP_TRP.1
The evaluator shall test this capability in a similar manner to the assurance
activities for FTP_ITC.1. If data transmitted between the user and the TOE is
obfuscated, the trusted path can be assumed to have been established.
ATE_IND
Annex A.2: ESM Access Control PP Assurance Activities
#
Source
Requirement
1.
FAU_GEN.1
As per ESM Policy Manager PP assurance activity, in addition:
Assurance
Family
ATE_IND
This testing may be done in conjunction with the exercise of other functionality.
For example, if the ST specifies that an audit record will be generated when an
access request is denied by a policy specified in FDP_ACF.1, then audit
records will be expected to be generated as a result of testing the policy’s
effectiveness. The evaluator shall also check to ensure that the content of the
logs are consistent with the activity performed on the TOE. For example, if a
test is performed such that an access request is denied by policy, the
corresponding audit record should correctly indicate the failure.
2.
FAU_SEL.1
The evaluator shall check the operational guidance in order to determine the
selections that are capable of being made to the set of auditable events, and
shall confirm that it contains all of the selections identified in the Security
Target.
3.
FAU_SEL.1
The evaluator shall test this capability by using a compatible Policy
Management product to configure the TOE in the following manners:
AGD_OPE
ATE_IND
- All selectable auditable events enabled
- All selectable auditable events disabled
- Some selectable auditable events enabled
For each of these configurations, the evaluator shall perform all selectable
auditable events and determine by review of the audit data that in each
configuration, only the enabled events are recorded.
Page 70 of 74