Security Objectives Security Objectives for the Operational Environment The Operational Environment of the TOE implements technical and procedural measures to assist the TOE in correctly providing its security functionality. This part wise solution forms the security objectives for the Operational Environment and consists of a set of statements describing the goals that the Operational Environment should achieve. Note that these objectives supplement those that exist in the base-PP; both sets of objectives are expected to be satisfied by the Operational Environment defined in a conformant ST. (OE.SECURED_CONFIGURATION) The Management Server and remote endpoints are configured in accordance with its associated operational guidance so that the level of security that is provided by the TOE is consistent with its evaluated configuration. Rationale: The TSF may provide security mechanisms that require configuration to be performed after it has been installed. A trusted administrator will satisfy this objective by configuring the TOE in accordance with its operational guidance. The AA component of the TOE (i.e. one or more software instances that conforms to the may require environmental configuration prior to secure use. (OE.SECURED_ENVIRONMENT) The components of the Management Server’s underlying platform are configured in accordance with their associated operational guidance so that the TOE is deployed in an environment that is consistent with its evaluated configuration. Rationale: Administrators are trusted to follow the operational guidance that is provided for secure installation and configuration of the TOE, which includes any aspects of its underlying platform (such as an operating system, firewall, or database). (OE.PHYSICAL/SERVER) The Operational Environment will provide a secure physical computing space such than an adversary is not able to make modifications to the environment or to the TOE itself, which includes the Management Server. Rationale: The expected deployment of the TOE is in an enterprise computing environment. The Management Server can reasonably be expected to be deployed in a secured environment because it does not provide functionality that would necessitate its deployment in a high-risk public-facing environment.
FCS_SNI_EXT.1, Cryptographic Operation (Salt, Nonce, and Initialization Vector Generation), requires the generation of salts, nonces, and IVs to be used by the cryptographic components of the TOE to be performed in the specified manner. Management: FCS_SNI_EXT.1 No specific management functions are identified. Audit: FCS_SNI_EXT.1 There are no auditable events foreseen. FCS_SNI_EXT.1 Cryptographic Operation (Salt, Nonce, and Initialization Vector Generation) Hierarchical to: No other components Dependencies: FCS_RBG_EXT.1 Cryptographic Operation (Random Bit Generation) FCS_SNI_EXT.1.1 The TSF shall only use salts that are generated by a [selection: DRBG as specified in FCS_RBG_EXT.1, DRBG provided by the host platform]. FCS_SNI_EXT.1.2 The TSF shall only use unique nonces, with a minimum size of [assignment: number of bits] bits. FCS_SNI_EXT.1.3 The TSF shall create IVs in the following manner: CBC: IVs shall be non-repeating, CCM: Nonce shall be non-repeating, XTS: No IV. Tweak values shall be non-negative integers, assigned consecutively, and starting at an arbitrary non-negative integer, GCM: IV shall be non-repeating. The number of invocations of GCM shall not exceed 2^32 for a given secret key. FCS_SSHC_EXT SSH Client Protocol Family Behavior Components in this family describe the requirements for protecting remote communications using SSH when the TSF is the sender (client) for the communications. Component Leveling FCS_SSHC_EXT.1, SSH Client Protocol, requires the TSF to implement SSH as a client. Management: FCS_SSHC_EXT.1 The following actions could be considered for the management functions in FMT: