
CRP-C0266-01
36
No. Overview of Penetration Testing
Anticipated
Vulnerability
T8
Ensured access via URL is denied, even if URLs for protected
assets and TOE resources are derived from URLs used by the
TOE.
V6, V7
T9
Ensured no access measures to the TOE are usable through
the Web interfaces without prior identification and
authentication of the user.
V5
T10
Ensured no Security Functions are usable through the Web
interfaces without prior identification and authentication of
the user.
V2, V3
T11
Ensured no access measures to the TOE are usable through
the operation panel without prior identification and
authentication of the user.
V4
c. Result
The executed evaluator penetration testing did not find any vulnerability exploitable by
attackers with the assumed attack potential.
7.4 Evaluated Configuration
In this evaluation, the configurations outlined in "7.3.2 Evaluator Independent Testing" and
Figure 7-2 were evaluated. The TOE will not be used in the configuration which is
significantly different from above configuration components. Therefore, the evaluator
determined the configuration of the above-evaluation is appropriate.
7.5 Evaluation Results
The evaluator had the conclusion that the TOE satisfies all work units prescribed in CEM by
submitting the Evaluation Technical Report.
In the evaluation, the following were confirmed.
- PP Conformance: none
- Security functional requirements: Common Criteria Part 2 Conformant
- Security assurance requirements: Common Criteria Part 3 Conformant
As a result of the evaluation, the verdict "PASS" was confirmed for the following assurance
components.
- All assurance components of EAL3 package
The result of the evaluation is applied to the composed by corresponding TOE to the
identification described in the chapter 2.
7.6 Evaluator Comments/Recommendations
The evaluator recommendations for users are not mentioned.
Comentários a estes Manuais