@@ -1212,6 +1212,28 @@ The assessment criteria for each security requirements are described in a struct
b) List of validated functionalities and data access rights for each user profile.
c) Screenshots or logs of access attempts and rights verification.
- REFERENCE: ACC_PKI_AC_002
- OBJECTIVE:
- Verify that the product only allows identified and authenticated authorized users to perform access-controlled actions.
- PREPARATION:
- Access to the product interfaces.
- ACTIVITIES:
- Enumerate product interfaces and identify any interfaces without access control.
- Attempt to perform protected actions without being identified or authenticated.
- Log in as authorized users, then try to intercept and replay user authentication data or session authentication tokens.
- Systematically try all possible combinations of usernames, passwords, or other credentials to attempt unauthorized access.
- VERDICT:
- SUCCESS: If only correct identification and authentication allows access to the specific rights of a user profile, and only authorized users may read or modify stored data or configuration data.
- FAIL: If unauthorized access or incorrect rights assignment is detected.
- EVIDENCE:
- Results of identification and authentication attempts (both successful and failed).
- Screenshots or logs of access attempts, rights verification, or rejected actions.
