Nortel Networks 7.05, 7.11 manual TOE Security Environment, Assumptions, Threats to Security

Page 16

Security Target, Version 3.9

March 18, 2008

 

 

3 TOE Security Environment

This section describes the security aspects of the environment in which the TOE will be used and the manner in which the TOE is expected to be employed. Section 3.1 provides assumptions about the secure usage of the TOE, including physical, personnel, and connectivity aspects. Section 3.2 lists the known and presumed threats countered by either the TOE or by the security environment.

3.1 Assumptions

This section contains assumptions regarding the security environment and the intended usage of the TOE. The following specific conditions are required to ensure the security of the TOE and are assumed to exist in an environment where this TOE is employed.

A.TRAINED-ADMIN

It is assumed that administrators will be trained in the secure use of the TOE and will

 

follow the policies and procedures defined in the TOE documentation for secure

 

administration of the TOE. Administrators are assumed to be non-hostile.

A.TIMESTAMPS

It is assumed that the TOE relies on the operating environment of TOE to provide

 

accurate clock time in order to create an accurate time stamp for audit events.

 

Administrators are responsible for the maintenance of a reliable time source for use with

 

audit operations.

A.PHYSICAL

It is assumed that the TOE may be susceptible to physical attacks by an attacker. It is

 

assumed that the TOE will be housed within a physically secure environment in order to

 

mitigate this risk.

A.CERTIFICATE

It is assumed that the environment will provide the necessary infrastructure to ensure that

 

certificates can be validated when digital certificates are used for authentication. This

 

may mean the environment provides a connection to a trusted Certificate Authority, or

 

that the required certificates are otherwise available to the TOE. It is assumed that the

 

appropriate infrastructure is properly maintained in order to ensure the accuracy and

 

security of the certificates (e.g., certificates are revoked in a timely manner).

A.INSTALL

It is assumed that the TOE is delivered, installed, and setup in accordance with

 

documented delivery and installation/setup procedures.

A.ACCESS

It is assumed that the TOE has access to all of the Information Technology (IT) System

 

data it needs to perform its functions.

A.DOMSEP

It is assumed that the IT environment will maintain a security domain for the Nortel VPN

 

software that protects it from interference and tampering by untrusted subjects.

3.2 Threats to Security

This section identifies the threats to the IT assets (private networks) against which protection is required by the TOE or by the security environment. The threat agents are divided into two categories:

Nortel VPN Router v7.05 and Client Workstation v7.11

Page 16 of 67

© 2008 Nortel Networks

 

Page 15 Page 17
Image 16
Page 15 Page 17
Contents Nortel Networks Corsec Security, Inc Revision History Version Modification Date Modified By Description of ChangesTable of Contents Table of Figures Table of TablesProtection Profile Claims RationaleSecurity Target Introduction PurposeSecurity Target, TOE and CC Identification and Conformance ST, TOE, and CC Identification and ConformanceConventions, Acronyms, and Terminology ConventionsTerminology TerminologyPrimary Admin password Product Type TOE DescriptionProduct Description Branch Office Deployment Configuration of the TOE TOE Boundaries and Scope Physical BoundaryLogical Boundary TOE EnvironmentWorld EnterpriseCryptographic Support Security AuditUser Data Protection Identification and Authentication Security ManagementProtection of the TOE Security Functions Trusted Path/ChannelsExcluded TOE Functionality Assumptions TOE Security EnvironmentThreats to Security Threats Addressed by the TOE Threats Addressed by the TOE EnvironmentSecurity Objectives Security Objectives for the TOESecurity Objectives for the Environment IT Security ObjectivesNon-IT Security Objectives OE.TIMEIT Security Requirements TOE Security Functional RequirementsTOE Security Functional Requirements ST OperationDescription ST Operation Class FAU Security Audit FAUGEN.1 Audit Data GenerationFAUSAR.1 Audit review Auditable EventsDependencies FAUGEN.1 Audit data generation Class FCS Cryptographic Support FCSCKM.1a Cryptographic key generation Diffie-HellmanFCSCKM.1b Cryptographic key generation RSA FCSCKM.4 Cryptographic key destructionFCSCOP.1d Cryptographic operation random number generation FCSCOP.1b Cryptographic operation authenticationFCSCOP.1e Cryptographic operation hashing Security Target, Version March 18 FDPACC.2 Complete access control FDPACF.1 Security attribute based access controlClass FDP User Data Protection FDPIFC.2a Complete information flow control VPNFDPIFC.2b Complete information flow control Firewall FDPIFF.1a Simple security attributes VPNFDPIFF.1b Simple security attributes Firewall FDPUCT.1 Basic data exchange confidentiality FDPUIT.1 Data exchange integrityFDPUCT.1.1 FDPUIT.1.1Class FIA Identification and Authentication FIAUAU.1 Timing of authenticationFIAUAU.5 Multiple authentication mechanisms FIAUID.2 User identification before any actionDependencies No dependencies Class FMT Security Management FMTMOF.1a Management of security functions behaviourFMTMOF.1b Management of security functions behaviour FMTMSA.1a Management of security attributesFMTMSA.1c Management of security attributes FMTMSA.2 Secure security attributesFMTMSA.3a Static attribute initialisation FMTMSA.2.1FMTSMF.1 Specification of Management Functions FMTMSA.3b Static attribute initialisationFMTMSA.3c Static attribute initialisation FMTSMR.1 Security rolesFMTSMR.1.2 FPTAMT.1 Abstract machine testing FPTTST.1 TSF testingClass FPT Protection of the TSF FPTRPL.1 Replay detectionClass FTP Trusted Path/Channels FTPTRP.1 Trusted pathFTPTRP.1.1 FTPTRP.1.2Security Functional Requirements on the IT Environment FPTRVM.1 Non-bypassability of the TSPFPTSEP.1 TSF domain separation FPTSTM.1 Reliable time stampsSecurity Target, Version 3.9March 18 Assurance Components Assurance RequirementsAssurance Requirements TOE Summary Specification TOE Security FunctionsTOE Security Description FunctionConfiguration Log Security AuditAccounting Logs Security LogSystem Log Event LogCryptographic Support Fips Validated ModulesFIPS-Validated Cryptographic Algorithms Validation Modules Fips 140-2 Certificate #User Data Protection Identification and Authentication Security ManagementProtection of the TOE Security Functions Power-Up Self-TestsConditional Self-Tests TOE Security Assurance Measures Trusted Path/ChannelsTOE Security Functional Requirements Satisfied FTPTRP.1 Assurance Assurance Measure ComponentAugmentation to EAL 4+ assurance level Protection Profile Claims Protection Profile ReferenceRationale Security Objectives RationaleRelationship of Security Threats to Objectives TOE Objectives Environmental Objectives Non-ITHack Certificate Security Functional Requirements Rationale OE.CERTIFICATERelationship of Security Requirements to Objectives Objectives RequirementsFunctions and data EnvAble to access such functionality FMTMSA.3a,b,cReject packets based on their attributes IntegritySecurity Assurance Requirements Rationale Rationale for Strength of FunctionDependency Rationale Functional Requirements DependenciesFCSCOP.1 TOE Summary Specification Rationale Secure Delivery and Operation Configuration ManagementDevelopment Life Cycle Support Documents Guidance DocumentationTests Strength of Function Vulnerability and TOE Strength of Function AnalysesAcronyms AcronymsAcronym Definition DoDSHA
Top Page Image Contents