Again, I would like to get input
from the members of the CC-CMT on the following issue.
;)
Issue: For TOEs that do not have
an all powerful, root-like user, can the standard A.NO_EVIL (Administrators
are non-hostile, appropriately trained and follow all administrator guidance…)
assumption be used?
I have been told that the new
Guidance for writing Medium Robustness PPs implies that A.NO_EVIL is no longer
allowed or needed. Instead a threat should be used about having an all
powerful user and the TOE can mitigate this threat by using privileges or
limited administrative users/roles.
In my opinion, this assumption is
useful when accompanying such a threat. Even if the TOE does not have an all
powerful, root-like user, I still believe this is an important
assumption. I know there are many organizations who have had breaches
that would agree with me; I think this is a real world issue. Regardless of
the aspects of access control, privilege control and role-based control
enforced by the TOE, each individual administrator still has the obligation to
follow the administrative guidance supplied for their part in the
administration of the TOE and to be trustworthy/non-hostile.
An assumption defined in the ST
documents that there is an expectation that they do so, and provides the
employer and end user with the responsibility and ability to hold them
individually accountable. Why would we want to take the capability to hold the
administrative users accountable away from the employer and end user?
I look forward to reading your
opinions/experiences.
Thanks,
-
Michelle
Michelle
Ruppel
Saffire
Systems
maruppel@saffiresys.com