Security Objectives Of Operational Environment; It Environment - Ricoh Aficio MP 7001 SP Manual

O.USER.AUTHORIZED
O.INTERFACE.MANAGED
O.SOFTWARE.VERIFIED Software verification
O.AUDIT.LOGGED
O.STORAGE.ENCRYPTED Encryption of storage devices
4.2

Security Objectives of Operational Environment

This section describes the security objectives of the operational environment.
4.2.1

IT Environment

OE.AUDIT_STORAGE.PROTECTED
OE.AUDIT_ACCESS.AUTHORIZED
OE.INTERFACE.MANAGED
Copyright (c) 2011 RICOH COMPANY, LTD. All rights reserved.
User identification and authentication
The TOE shall require identification and authentication of users and shall ensure that
users are authorised in accordance with security policies before allowing them to use the
TOE.
Management of external interfaces by TOE
The TOE shall manage the operation of external interfaces (Operation Panel, LAN,
telephone lines and USB) in accordance with security policies. The TOE shall control
the access to the Operation Panel, opened LAN ports and telephone lines. Also, the TOE
shall forward from external interfaces only data that are processed by the TOE.
The TOE shall provide procedures to self-verify executable code in the TSF.
Management of audit log records
The TOE shall create and maintain a log of TOE use and security-relevant events in the
MFP and prevent its unauthorised disclosure or alteration.
The TOE shall ensure the data is encrypted first and then stored on the HDD.
If audit logs are exported to a trusted IT product, the responsible manager of MFP shall
ensure that those logs are protected from unauthorised access, deletion and
modifications.
If audit logs are exported to a trusted IT product, the responsible manager of MFP shall
ensure that those logs can be accessed in order to detect potential security violations,
and only by authorised persons.
The IT environment shall provide protection from unmanaged access to TOE external
interfaces (LAN). The responsible manager of MFP shall give an instruction to
Audit log protection in trusted IT products
Audit log access control in trusted IT products
Management of external interfaces in IT environment
Page 35 of 87