Зарубежные нормативные документы и критерии на английском / CCPART3V21
.pdfSecurity policy modeling (ADV_SPM) |
10 - Class ADV: Development |
ADV_SPM.1.1D
ADV_SPM.1.2D
ADV_SPM.1.1C
ADV_SPM.1.2C
ADV_SPM.1.3C
ADV_SPM.1.4C
ADV_SPM.1.1E
Developer action elements:
The developer shall provide a TSP model.
The developer shall demonstrate correspondence between the functional specification and the TSP model.
Content and presentation of evidence elements:
The TSP model shall be informal.
The TSP model shall describe the rules and characteristics of all policies of the TSP that can be modeled.
The TSP model shall include a rationale that demonstrates that it is consistent and complete with respect to all policies of the TSP that can be modeled.
The demonstration of correspondence between the TSP model and the functional specification shall show that all of the security functions in the functional specification are consistent and complete with respect to the TSP model.
Evaluator action elements:
The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence.
ADV_SPM.2 Semiformal TOE security policy model
ADV_SPM.2.1D
ADV_SPM.2.2D
ADV_SPM.2.1C
ADV_SPM.2.2C
ADV_SPM.2.3C
Dependencies:
ADV_FSP.1 Informal functional specification
Developer action elements:
The developer shall provide a TSP model.
The developer shall demonstrate correspondence between the functional specification and the TSP model.
Content and presentation of evidence elements:
The TSP model shall be semiformal.
The TSP model shall describe the rules and characteristics of all policies of the TSP that can be modeled.
The TSP model shall include a rationale that demonstrates that it is consistent and complete with respect to all policies of the TSP that can be modeled.
August 1999 |
Version 2.1 |
Page 123 of 208 |
10 - Class ADV: Development |
Security policy modeling (ADV_SPM) |
ADV_SPM.2.4C The demonstration of correspondence between the TSP model and the functional specification shall show that all of the security functions in the functional specification are consistent and complete with respect to the TSP model.
ADV_SPM.2.5C
ADV_SPM.2.1E
Where the functional specification is at least semiformal, the demonstration of correspondence between the TSP model and the functional specification shall be semiformal.
Evaluator action elements:
The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence.
ADV_SPM.3 Formal TOE security policy model
ADV_SPM.3.1D
ADV_SPM.3.2D
ADV_SPM.3.1C
ADV_SPM.3.2C
ADV_SPM.3.3C
ADV_SPM.3.4C
Dependencies:
ADV_FSP.1 Informal functional specification
Developer action elements:
The developer shall provide a TSP model.
The developer shall demonstrate or prove, as appropriate, correspondence between the functional specification and the TSP model.
Content and presentation of evidence elements:
The TSP model shall be formal.
The TSP model shall describe the rules and characteristics of all policies of the TSP that can be modeled.
The TSP model shall include a rationale that demonstrates that it is consistent and complete with respect to all policies of the TSP that can be modeled.
The demonstration of correspondence between the TSP model and the functional specification shall show that all of the security functions in the functional specification are consistent and complete with respect to the TSP model.
ADV_SPM.3.5C Where the functional specification is semiformal, the demonstration of correspondence between the TSP model and the functional specification shall be semiformal.
ADV_SPM.3.6C Where the functional specification is formal, the proof of correspondence between the TSP model and the functional specification shall be formal.
Page 124 of 208 |
Version 2.1 |
August 1999 |
Security policy modeling (ADV_SPM) |
10 - Class ADV: Development |
Evaluator action elements:
ADV_SPM.3.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence.
August 1999 |
Version 2.1 |
Page 125 of 208 |
10 - Class ADV: Development |
Security policy modeling (ADV_SPM) |
Page 126 of 208 |
Version 2.1 |
August 1999 |
Part 3: Security assurance requirements
11 |
Class AGD: Guidance documents |
|
|
||||||
370 |
The guidance documents class provides the requirements for user and administrator |
||||||||
|
guidance documentation. For the secure administration and use of the TOE it is |
||||||||
|
necessary to describe all relevant aspects for the secure application of the TOE. |
||||||||
371 |
Figure 11.1 shows the families within this class, and the hierarchy of components |
||||||||
|
within the families. |
|
|
||||||
|
|
|
|
|
|
|
|
|
|
|
|
Class AGD: Guidance documents |
|
|
|
|
|
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
AGD_ADM Administrator guidance |
|
|
1 |
|
|
|
|
|
|
|
|
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
AGD_USR User guidance |
|
|
1 |
|
|
|
|
|
|
|
|
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Figure 11.1 - Guidance documents class decomposition |
|||||
August 1999 |
Version 2.1 |
Page 127 of 208 |
11 - Class AGD: Guidance documents |
Part 3: Security assurance requirements |
11.1Administrator guidance (AGD_ADM)
|
Objectives |
372 |
Administrator guidance refers to written material that is intended to be used by |
|
those persons responsible for configuring, maintaining, and administering the TOE |
|
in a correct manner for maximum security. Because the secure operation of the TOE |
|
is dependent upon the correct performance of the TSF, persons responsible for |
|
performing these functions are trusted by the TSF. Administrator guidance is |
|
intended to help administrators understand the security functions provided by the |
|
TOE, including both those functions that require the administrator to perform |
|
security-critical actions and those functions that provide security-critical |
|
information. |
|
Component levelling |
373 |
This family contains only one component. |
|
Application notes |
374 |
The requirements AGD_ADM.1.3C and AGD_ADM.1.7C encompass the aspect |
|
that any warnings to the users of a TOE with regard to the TOE security |
|
environment and the security objectives described in the PP/ST are appropriately |
|
covered in the administrator guidance. |
375 |
The concept of secure values, as employed in AGD_ADM.1.5C, has relevance |
|
where an administrator has control over security parameters. Guidance needs to be |
provided on secure and insecure settings for such parameters. This concept is related to the use of the component FMT_MSA.2 from CC Part 2.
AGD_ADM.1 Administrator guidance
Dependencies:
ADV_FSP.1 Informal functional specification
Developer action elements:
AGD_ADM.1.1D The developer shall provide administrator guidance addressed to system administrative personnel.
Content and presentation of evidence elements:
AGD_ADM.1.1C
AGD_ADM.1.2C
The administrator guidance shall describe the administrative functions and interfaces available to the administrator of the TOE.
The administrator guidance shall describe how to administer the TOE in a secure manner.
Page 128 of 208 |
Version 2.1 |
August 1999 |
Part 3: Security assurance requirements |
11 - Class AGD: Guidance documents |
AGD_ADM.1.3C
AGD_ADM.1.4C
AGD_ADM.1.5C
AGD_ADM.1.6C
The administrator guidance shall contain warnings about functions and privileges that should be controlled in a secure processing environment.
The administrator guidance shall describe all assumptions regarding user behaviour that are relevant to secure operation of the TOE.
The administrator guidance shall describe all security parameters under the control of the administrator, indicating secure values as appropriate.
The administrator guidance shall describe each type of security-relevant event relative to the administrative functions that need to be performed, including changing the security characteristics of entities under the control of the TSF.
AGD_ADM.1.7C
AGD_ADM.1.8C
AGD_ADM.1.1E
The administrator guidance shall be consistent with all other documentation supplied for evaluation.
The administrator guidance shall describe all security requirements for the IT environment that are relevant to the administrator.
Evaluator action elements:
The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence.
August 1999 |
Version 2.1 |
Page 129 of 208 |
11 - Class AGD: Guidance documents |
Part 3: Security assurance requirements |
11.2User guidance (AGD_USR)
|
Objectives |
376 |
User guidance refers to material that is intended to be used by non-administrative |
|
human users of the TOE, and by others (e.g. programmers) using the TOE’s |
|
external interfaces. User guidance describes the security functions provided by the |
|
TSF and provides instructions and guidelines, including warnings, for its secure |
|
use. |
377 |
The user guidance provides a basis for assumptions about the use of the TOE and a |
|
measure of confidence that non-malicious users, application providers and others |
|
exercising the external interfaces of the TOE will understand the secure operation |
|
of the TOE and will use it as intended. |
|
Component levelling |
378 |
This family contains only one component. |
|
Application notes |
379 |
The requirements AGD_USR.1.3.C and AGD_USR.1.5C encompass the aspect |
|
that any warnings to the users of a TOE with regard to the TOE security |
|
environment and the security objectives described in the PP/ST are appropriately |
|
covered in the user guidance. |
380 |
In many cases it may be appropriate that guidance is provided in separate |
|
documents: one for human users, and one for application programmers and/or hard- |
|
ware designers using software or hardware interfaces. |
AGD_USR.1 User guidance
AGD_USR.1.1D
AGD_USR.1.1C
AGD_USR.1.2C
AGD_USR.1.3C
Dependencies:
ADV_FSP.1 Informal functional specification
Developer action elements:
The developer shall provide user guidance.
Content and presentation of evidence elements:
The user guidance shall describe the functions and interfaces available to the non-administrative users of the TOE.
The user guidance shall describe the use of user-accessible security functions provided by the TOE.
The user guidance shall contain warnings about user-accessible functions and privileges that should be controlled in a secure processing environment.
Page 130 of 208 |
Version 2.1 |
August 1999 |
Part 3: Security assurance requirements |
11 - Class AGD: Guidance documents |
AGD_USR.1.4C The user guidance shall clearly present all user responsibilities necessary for secure operation of the TOE, including those related to assumptions regarding user behaviour found in the statement of TOE security environment.
AGD_USR.1.5C
AGD_USR.1.6C
AGD_USR.1.1E
The user guidance shall be consistent with all other documentation supplied for evaluation.
The user guidance shall describe all security requirements for the IT environment that are relevant to the user.
Evaluator action elements:
The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence.
August 1999 |
Version 2.1 |
Page 131 of 208 |
11 - Class AGD: Guidance documents |
Part 3: Security assurance requirements |
Page 132 of 208 |
Version 2.1 |
August 1999 |