Ricoh Aficio MP 6001 SP Security Target - Page 37

of

87

appropriately configure the firewall according to the guidance document, and prevent

the attacks to the LAN from the Internet. Also, the responsible manager of MFP shall

instruct the MFP administrators to close the unused LAN ports and disable the USB use

at the time of installation according to the guidance document.

4.2.2

Non-IT Environment

OE.PHYSICAL.MANAGED Physical management

According to the guidance document, the TOE shall be placed in a secure or monitored

area that provides protection from physical access to the TOE by unauthorised persons.

OE.USER.AUTHORIZED

Assignment of user authority

The responsible manager of MFP shall grant login user name, login password and user

role (supervisor, MFP administrator or normal user) to persons who follow the security

policies and procedures of their organisation to be authorised to use the TOE.

OE.USER.TRAINED

User training

The responsible manager of MFP shall train users according to the guidance document

and ensure that users are aware of the security policies and procedures of their

organisation and have the competence to follow those policies and procedures.

OE.ADMIN.TRAINED

Administrator training

The responsible manager of MFP shall ensure that administrators are aware of the

security policies and procedures of their organisation; have the training, competence,

and time to follow the guidance document; and correctly configure and operate the TOE

according to those policies and procedures.

OE.ADMIN.TRUSTED

Trusted administrator

The responsible manager of MFP shall select administrators who will not use their

privileged access rights for malicious purposes according to the guidance document.

OE.AUDIT.REVIEWED

Log audit

The responsible manager of MFP shall ensure that audit logs are reviewed at appropriate

intervals according to the guidance document for detecting security violations or

unusual patterns of activity.

Copyright (c) 2011 RICOH COMPANY, LTD. All rights reserved.

Section	Page
1 ST Introduction	7
1.1 ST Reference	7
1.2 TOE Reference	7
1.3 TOE Overview	9
1.3.1 TOE Type	9
1.3.2 TOE Usage	9
1.3.3 Major Security Features of TOE	11
1.4 TOE Description	11
1.4.1 Physical Boundary of TOE	11
1.4.2 Guidance Documents	14
1.4.3 Definition of Users	17
1.4.3.1. Direct User	19
1.4.3.2. Indirect User	19
1.4.4 Logical Boundary of TOE	20
1.4.4.1. Basic Functions	20
1.4.4.2. Security Functions	23
1.4.5 Protected Assets	24
1.4.5.1. User Data	24
1.4.5.2. TSF Data	25
1.4.5.3. Functions	25
1.5 Glossary	25
1.5.1 Glossary for This ST	25
2 Conformance Claim	28
2.1 CC Conformance Claim	28
2.2 PP Claims	28
2.3 Package Claims	28
2.4 Conformance Claim Rationale	29
2.4.1 Consistency Claim with TOE Type in PP	29
2.4.2 Consistency Claim with Security Problems and Security Objectives in PP	29
2.4.3 Consistency Claim with Security Requirements in PP	29
3 Security Problem Definitions	32
3.1 Threats	32
3.2 Organisational Security Policies	33
3.3 Assumptions	33
4 Security Objectives	35
4.1 Security Objectives for TOE	35
4.2 Security Objectives of Operational Environment	36
4.2.1 IT Environment	36
4.2.2 Non-IT Environment	37
	37
4.3 Security Objectives Rationale	38
4.3.1 Correspondence Table of Security Objectives	38
4.3.2 Security Objectives Descriptions	39
5 Extended Components Definition	43
5.1 Restricted forwarding of data to external interfaces (FPT_FDI_EXP)	43
6 Security Requirements	45
6.1 Security Functional Requirements	45
6.1.1 Class FAU: Security audit	45
6.1.2 Class FCS: Cryptographic support	48
6.1.3 Class FDP: User data protection	49
6.1.4 Class FIA: Identification and authentication	53
6.1.5 Class FMT: Security management	56
6.1.6 Class FPT: Protection of the TSF	62
6.1.7 Class FTA: TOE access	62
6.1.8 Class FTP: Trusted path/channels	63
6.2 Security Assurance Requirements	63
6.3 Security Requirements Rationale	64
6.3.1 Tracing	64
6.3.2 Justification of Traceability	65
6.3.3 Dependency Analysis	71
6.3.4 Security Assurance Requirements Rationale	73

Ricoh Aficio MP 6001 SP Security Target - Page 37

OE.PHYSICAL.MANAGED Physical management

Page 37 highlights