## 6 Evaluation Issues
### Validation example
#### 6.1.4 Identification of threats and security objectives which counter them  
For given threats, it is necessary to declare security objectives which counter them, for the TOE (IMBMS) and/or for its environment. Please note that this declaration expresses the responsibility in countering threats and decides about the future TOE shape and features, because the TOE built-in countermeasures (_i.e._, security functions) are derived from the TOE security objectives only. The key issue for the intelligent medical sensor is the possibility to compromise the mote by the intruder of high attack potential acting from the outside (WSN, base station) and exploiting vulnerabilities of the implemented network protocols. This compromising may lead to the sensor data and/or security-related data eavesdropping and/or their counterfeiting. These issues can be expressed by two predefined threat-type generics countered by four security objectives declared for the TOE only:  
TDA.NodeCompromise. Attacker [Sparam \(\Leftarrow\) SNA.HighPotIntrud] can: eavesdrop the traffic, inject packets or replay older messages because wireless communication generally is not secure. After the node compromising, all information it holds [Dparam \(<=\) DTO.SensorData, DTO.BioData, DIT.BaseStation] is known to the attacker and/or node operation or communication is broken [Dparam \(<=\) DTO.SensorService]. TDA.SensDataMdfy. Intruder [Sparam \(<=\) SNA.HighPotIntruder] modifies sensor data (falsifies them) [Dparam \(<=\) DTO.SensorData, DTO.BioData]. Security objectives declared for the TOE:  
OACC.Access. The sensor must control access of connected entities. OIDA.Authentication. The sensor must authenticate connected entities. OADT.Audit. The sensor must audit attempts to undermine its security and should trace them to the associated entities. OINT.Processing The sensor must ensure that the processing of input to derive output data [Dparam \(<=\) DTO.SensorData] is accurate. Applying a tampering attack, the intruder of high attack potential may intentionally compromise the physical or logical TOE integrity to get, modify or destroy the sensor data (any kind of data) and/or disrupt the intelligent sensor operation. Additionally, the monitored patient may unintentionally damage the more or disrupt the sensor operation, which may be considered as tampering too. This threat is expressed by one enhanced generic countered by two objectives for the TOE and two for its environment:  
TDA.Tamper. Intruder [Sparam \(<=\) SNA.HighPotIntrud, SAU.IntellSensorUser(1)] physically/logically compromises a sensor node to get assets [Dparam \(<=\) DTO.SensorData, DTO.BioData] or disrupt the node operation [Dparam \(<=\) DTO.SensorService]. Security objectives declared for the TOE:  
OINT.TamperResistance. The TOE guarantees its own physical/logical integrity. The means of detecting physical tampering must be provided (e.g., seals, tampering detection, special reinforced cases, intrinsically safe solutions). OAVB.Reliability. The sensor must provide reliable service. Applying fault tolerance methods and techniques. Security objectives declared for the TOE environment (the second was specially defined):  
OSMN.RegularInpections. The sensor must be periodically inspected and calibrated (if necessary). OEPH.PatientSecurity. The monitored patient is within the access-restricted area and the medical personnel or household members take care of her/him. The shortage of resources, especially energy, may be critical for long-term, permanent monitoring of the patient. It can be solved by remote reading of the resources status, watching equipment locally and reaction of responsible persons:  
TDA.LimitResour. Exploiting vulnerability related to the node limited resources [Dparam \(<=\) DTO.NodePowerRes, DTO.NodeProcessRes, DTO.NodeTransmRes], an intruder [Sparam \(<=\) SNA.HighPotIntruder] causes misbehaviour, disconnection or faults within the system. Security objectives declared for the TOE:  
OAVB.ResUnderControl.