Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual page 684

Security Requirements for the IT Environment
FMT_MSA.1.1 The IT environment shall enforce the CIMC IT Environment Access
Control Policy specified in "CIMC TOE Access Control Policy," on page 687 to restrict the
ability to modify the security attributes [user definitions and role assignments] to
Administrators.
FMT_MSA.2 Secure security attributes
FMT_MSA.2.1 The IT environment shall ensure that only secure values are accepted for
security attributes.
FMT_MSA.3 Static attribute initialization
FMT_MSA.3.1 The IT environment shall enforce the CIMC IT Environment Access
Control Policy specified in "CIMC TOE Access Control Policy," on page 687 to provide
[restrictive] default values for security attributes that are used to enforce the SFP.
FMT_MSA.3.2 The IT environment shall allow the Administrator to specify alternative
initial values to override the default values when an object or information is created.
FMT_MTD.1 Management of TSF data
FMT_MTD.1.1 The IT environment shall restrict the ability to view (read) or delete the
audit logs to Auditors.
FMT_SMR.2 Restrictions on security roles
FMT_SMR.2.1 The IT environment shall maintain the roles: Administrator, Auditor, and
Officer.
FMT_SMR.2.2 The IT environment shall be able to associate users with roles.
FMT_SMR.2.3 The IT environment shall ensure that:
no identity is authorized to assume both an Administrator and an Officer role;
1.
no identity is authorized to assume both an Auditor and an Officer role; and
2.
no identity is authorized to assume both an Administrator and an Auditor role.
3.
NOTE
684 Red Hat Certificate System Administrator's Guide • September 2005
The role definitions are listed below:
Administrator – role authorized to install, configure, and maintain the
1.
CIMC; establish and maintain user accounts; configure profiles and
audit parameters; and generate Component keys.
Officer – role authorized to request or approve certificates or
2.
certificate revocations.
Auditor – role authorized to view and maintain audit logs.
3.