@@ -1922,6 +1922,8 @@ Assessment requirements covering Monitoring are presented in section 6.13.
The validity of the cryptographic mechanisms used to encure those funtions is covered by annex K assessment requirement.
### 6.7.1 INT - Monitoring
- REFERENCE: ACC-PKI-INT-01
- OBJECTIVE:
- Verify that unauthorized modifications to stored audit records are detected using cryptographic integrity mechanisms conforming to Annex K.
@@ -1964,6 +1966,49 @@ The validity of the cryptographic mechanisms used to encure those funtions is co
- Integrity verification results.
- Audit logs.
- REFERENCE: ACC-PKI-INT-03
- OBJECTIVE:
- Verify that audit log integrity protection events are periodically created and include chaining of current and previous integrity protection events.
- PREPARATION:
- Audit signing specifications.
- Scheduler configuration.
- Prepare a test environment allowing audit event logging.
- ACTIVITIES:
- Generate audit entries.
- Trigger multiple signing events.
- Verify that cryptographic integrity protection include all entries since the previous signing event.
- Verify inclusion of the previous signature value.
- Verify that signing events occur even when no entries have been added.
- Verify that all cryptographic integrity protection mechanisms conform to Annex K assessment requirement.
- VERDICT:
- SUCCESS: Periodic signed audit chains are correctly created.
- FAIL: Signatures omit entries, omit previous signature values, or fail to execute.
- EVIDENCE:
- Scheduler configuration.
- Audit logs.
- Signature records.
- Integrity verification reports.
- REFERENCE: ACC-PKI-INT-04
- OBJECTIVE:
- Verify that the product ensures the integrity of audit logs using appropriate protection mechanisms whithout Annex Conformant cryptographic mechanisms.
- PREPARATION:
- Obtain logging architecture documentation.
- Obtain integrity protection configuration.
- ACTIVITIES:
- Review implemented integrity mechanisms.
- Attempt unauthorized modification, deletion, or insertion of log entries.
- Verify that integrity violations are prevented or detected.
- Verify operation of external logging mechanisms where implemented.
- VERDICT:
- SUCCESS: Audit log integrity is maintained and violations are detected.
- FAIL: Audit logs can be modified without detection.
