Specifications

Security Target Version 1.0 9/29/2014
44
Component Assurance Activity:
The evaluator shall examine the TSS to determine that it contains a description, for each supported
method for remote administrative actions, of how successive unsuccessful authentication attempts
are detected and tracked. The TSS shall also describe the method by which the remote
administrator is prevented from successfully logging on to the TOE, and the actions necessary to
restore this ability. The evaluator shall also examine the operational guidance to ensure that
instructions for configuring the number of successive unsuccessful authentication attempts (1.1)
and time period (1.2, if implemented) are provided, and that the process of allowing the remote
administrator to once again successfully log on is described for each 'action' specified (if that
option is chosen). If different actions or mechanisms are implemented depending on the
authentication method (e.g., TSL vs. SSH), all must be described.
The evaluator shall perform the following tests for each method by which remote administrators
access the TOE (e.g., TLS, SSH):
Test 1 [conditional on first selection item]: The evaluator shall use the operational guidance to
configure the number of successive unsuccessful authentication attempts allowed by the TOE. The
evaluator shall test that once the limit is reached, attempts with valid credentials are not
successful. For each action specified by the requirement, the evaluator shall show that following
the operational guidance and performing each action to allow the remote administrator access are
successful.
Test 2 [conditional on second selection item]: The evaluator shall use the operational guidance to
configure the number of successive unsuccessful authentication attempts allowed by the TOE and
a time period after which valid logins will be allowed for a remote administrator. After exceeding
the specified number of invalid login attempts and showing that valid login is not possible, the
evaluator shall show that waiting for the interval defined by the time period before another access
attempt will result in the ability for the remote administrator to successfully log on using valid
credentials.
5.2.4.3 Password Management (FIA_PMG_EXT.1)
FIA_PMG_EXT.1.1
The TSF shall provide the following password management capabilities for administrative
passwords:
1. Passwords shall be able to be composed of any combination of upper and lower case
letters, numbers, and special characters (that include: '!', '@', '#', '$', '%', '^', '&', '*', '(', and
')');
2. Minimum password length shall be settable by the Authorized Administrator, and
support passwords of 8 characters or greater;
3. Passwords composition rules specifying the types and number of required characters
that comprise the password shall be settable by the Administrator.
4. Passwords shall have a maximum lifetime, configurable by the Authorized
Administrator.
5. New passwords must contain a minimum of 4 character changes from the previous
password.
Component Assurance Activity:
The evaluator shall examine the operational guidance to determine that it provides guidance to
administrators on the composition of strong passwords, and that it provides instructions on setting
the minimum password length; the formulation and specification of password composition rules
and how to configure these for the TOE; and how to configure the maximum lifetime for a
password. The evaluator shall also perform the following tests. Note that one or more of these
tests can be performed with a single test case.
Test 1: The evaluator shall configure the TOE with different password composition rules, as