@@ -1642,14 +1642,12 @@ The assessment criteria for each security requirements are described in a struct
## 6.5 Authentication and access control
### 6.5.1 AC - General
- REFERENCE: ACC_PKI_AC_01
- REFERENCE: ACC_PKI_AC_01
- OBJECTIVE:
Verify the product allows to create different user profiles (users with different access rights to functions, configuration, and stored data) for the roles defined by PKI policies, each with distinct credentials.
- PREPARATION:
Access to the administrative and user interfaces of the product.
- ACTIVITIES:
- Create one account for each manageable profile (at least: PKI Administrator, PKI Operator, PKI Officer, PKI Auditor) with unique credentials.
- For each account:
@@ -1660,34 +1658,27 @@ The assessment criteria for each security requirements are described in a struct
- If the account is not authorized to, attempt to read configuration data
- If the account is not authorized to, attempt to modify stored data
- If the account is not authorized to, attempt to modify configuration data
- VERDICT:
SUCCESS: if only correct identification and authentication allows access to the specific rights of a user profile, and only authorized users may read or modify stored data or configuration data, or perform protected actions.
FAIL: if unauthorized access or incorrect rights assignment is detected.
- SUCCESS: if only correct identification and authentication allows access to the specific rights of a user profile, and only authorized users may read or modify stored data or configuration data, or perform protected actions.
- FAIL: if unauthorized access or incorrect rights assignment is detected.
- EVIDENCE:
- Results of identification and authentication attempts (successful and failed).
- List of validated functionalities and data access rights for each user profile.
- Screenshots or logs of access attempts and rights verification.
- REFERENCE: ACC_PKI_AC_02
- OBJECTIVE:
- Verify that the product only allows identified and authenticated authorized users to perform access-controlled actions.
- PREPARATION:
- Access to the product interfaces.
- ACTIVITIES:
- Enumerate product interfaces and identify any interfaces without access control.
- Attempt to perform protected actions without being identified or authenticated.
- Log in as authorized users, then try to intercept and replay user authentication data or session authentication tokens.
- Systematically try all possible combinations of usernames, passwords, or other credentials to attempt unauthorized access.
- VERDICT:
- SUCCESS: No unauthorized users may read or modify stored data or configuration data, or perform protected actions.
- FAIL: If unauthorized access or incorrect rights assignment is detected.
- EVIDENCE:
- Results of identification and authentication attempts (both successful and failed).
- Screenshots or logs of access attempts, rights verification, or rejected actions.
