@@ -1200,6 +1200,221 @@ The assessment criteria for each security requirements are described in a struct
## 6.13 Logging and monitoring
REFERENCE: ACC_PKI_LOG_001
- OBJECTIVE: Verify that the product records within each audit record the required information, and that these records do not include any secret key or other secret parameter in plaintext form.
- PREPARATION: Ability to trigger auditable events, and ability to audit events.
- ACTIVITIES: Trigger an auditable event. Access the corresponding audit record.
- Verify the audit record contains at least:
a) the date and time of the event;
b) the type of the event;
c) the subject identity (if applicable);
d) the outcome of the event.
- Perform the above for each audit event type, and verify that the audit record additionally contains the additional information specified by the developper.
- For each information verified to be present, verify it matches the expected value given when and how the event was triggered.
- For each of the generated audit record, verify that no private or symmetric key, as well as no other secret parameter is present in plaintext form.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE: The way the events were triggered and at what time, and the corresponding audit records.
- REFERENCE: ACC_PKI_LOG_002
- OBJECTIVE: Verify that the product employs reliable time stamps.
- PREPARATION: Ability to trigger auditable events, and ability to audit events. Obtain access to a trusted time stamp origin. Determine how the product determines its time stamps.
- ACTIVITIES: Trigger an auditable event. Access the corresponding audit record. Verify the date and time of the event to match the trusted time stamp origin.
- Repeat the above several times from different accesses to the product in parallel and verify the produced time stamps from the product to be monotonic.
- If the product may determine its time stamps by querying time information from a source it trusts, verify that it authenticates that source messages using state of the art mechanisms.
- If the product may increment temporary or long-term time information stored locally, verify that the time information may not be used in data issued by the product until it has been properly been incremented, or alternatively that the service responsible for it cannot fail.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE:
a) The way the events were triggered and at what time, and the corresponding audit records;
b) arguments relating to the authentication of a trusted source (if applicable);
c) arguments relating to the monotonicity of local time information (if applicable).
- REFERENCE: ACC_PKI_LOG_003
- OBJECTIVE: Verify that the product records within each audit record resulting from actions of identified users the corresponding user information.
- PREPARATION: Ability to identify to the product as a given user. Ability to trigger auditable events as a user, and ability to audit events.
- ACTIVITIES: Identify to the product as the given user. Trigger an auditable event as the given user. Access the corresponding audit record.
- Verify the audit record contains the identity of the user that caused the event.
- Verify this identity to match that of the given user.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE:
a) The identity of the given user used for the test;
b) the way the event was triggered and at what time, and the corresponding audit record.
- REFERENCE: ACC_PKI_LOG_004
- OBJECTIVE: Verify product protections from unauthorised deletion to be active and functional.
- PREPARATION: Ability to identify to the product as a given user, unauthorised to perform audit record deletion. Ability to trigger auditable events as a user, and ability to audit events. Determine all actions that may result in deletion of an audit record. Depending on this list of actions, several distinct users with distinct authorizations may be used.
- ACTIVITIES: Identify to the product as the given user. Trigger an auditable event as the given user. Access and copy audit records separately.
- Attempt to perform all actions identified as possibly resulting in an audit record deletion; re-identifying to the product as necessary.
- Access audit records and verify they match the copy performed previously.
- VERDICT: SUCCESS if the verification passes; else FAIL.
- EVIDENCE:
a) The identity of the given user(s) used for the test;
b) the list of identified actions that may result in deletion of an audit records;
c) the way the actions were attempted, including the corresponding user identity;
d) the copies of existing audit records, before and after attempts.
- REFERENCE: ACC_PKI_LOG_005
- OBJECTIVE: Verify the product's ability to detect unauthorised modifications to the stored audit records during the audit.
- PREPARATION: Ability to trigger auditable events as a user, and ability to audit events. Ability to directly modify the contents of existing audit records.
- ACTIVITIES: Trigger an auditable event. Access and copy the corresponding audit record separately.
- Directly modify the contents of the stored audit record in the product.
- Attempt to access the audit record.
- VERDICT: SUCCESS if the last audit fails; else FAIL.
- EVIDENCE:
a) the way the event was triggered, and the corresponding audit record which was copied;
b) the way the audit record was directly modified;
c) the way the last audit was attempted, and the corresponding response from the product.
- REFERENCE: ACC_PKI_LOG_006
- OBJECTIVE: Verify the product's prevention of auditable events, except those taken by the auditor, if the audit log is full.
- PREPARATION: Ability to trigger auditable events, and ability to audit events. The maximum size of the audit log may be reduced.
- ACTIVITIES: Do not identify as an auditor to the product. Trigger auditable events until the audit log is full, or nearly so.
- Verify that a given additional auditable event cannot be performed.
- Identify as an auditor to the product.
- Verify that a given additional auditable event may be triggered as the auditor.
- VERDICT: SUCCESS if the verification passes; else FAIL.
- EVIDENCE:
a) The configured maximum size of the audit log;
b) The size of the audit when full, or nearly so;
c) the way the additional event was attempted to be triggered, and the corresponding response from the product.
- REFERENCE: ACC_PKI_LOG_007
- OBJECTIVE: Verify the use of an audit log signing event by the product.
- PREPARATION: Ability to trigger auditable events, and ability to audit events.
- Determine the configured frequency of the audit log signing event and date of the audit log signing event. The frequency of the audit log signing event may be reduced; the event shall not be triggered manually.
- The list of auditable events may be reduced.
- Ability to verify the digital signatures, keyed hashes, or authentication codes used for the audit log signing event.
- Ability to modify audit records before verifying or re-verifying their digital signatures, keyed hashes, or authentication codes.
- ACTIVITIES: Trigger an auditable event.
- Wait until the next audit log signing event happens.
- Verify the signature, keyed hash or authentication code over the last entries, including the audit record of the triggered event, is present in the audit log.
- Verify the signature, keyed hash or authentication code over the last entries, including the audit record of the triggered event, is correct.
- Modify the audit record of the triggered event, and verify the signature, keyed hash or authentication code to fail over the last entries, including the triggered event.
- Verify the signature, keyed hash or authentication code to fail over the last entries, including the triggered event.
- Restore the audit record of the triggered event, if necessary.
- Modify the second-to-last signature, keyed hash or authentication code.
- Verify the signature, keyed hash or authentication code to fail over the last entries, including the triggered event.
- Restore the second-to-last signature, keyed hash or authentication code, if necessary.
- Wait until the next audit log signing event happens, ensuring no auditable event happens in the meantime.
- Verify a new signature, keyed hash or authentication code, including at least the previous signature, keyed hash or authentication code, is present in the audit log.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE:
a) The way the auditable event was triggered;
b) the last entries of the audit log, including all the entries impacting the third-to-last audit log signing event and its signature, keyed hash or authentication code;
c) the way the signatures, keyed hashes or authentication codes were verified, and the corresponding responses from the product;
d) the way the audit record of the triggered event was modified;
e) the way the second-to-last signature, keyed hash or authentication code was modified.
- REFERENCE: ACC_PKI_LOG_008
- OBJECTIVE: Verify the frequency of the audit log signing event by the product to be configurable.
- PREPARATION: Ability to trigger auditable events, and ability to audit events. Ability to configure the frequency of the audit log signing event.
- ACTIVITIES: Modify the frequency of the audit log signing event.
- Wait sufficiently such that 2 audit log signing events occur.
- Access audit records, and verify the time between the last 2 audit log signing events corresponds to the newly configured frequency.
- VERDICT: SUCCESS if the verification passes; else FAIL.
- EVIDENCE:
a) The new frequency which was configured;
b) the 2 last audit log signing events as they appear in the audit log, and their corresponding date and time.
