HP Inc.
HP LaserJet Enterprise MFP M527 Series,
Color LaserJet Enterprise MFP M577 Series, and
PageWide Enterprise Color MFP 586 Series
Firmware with Jetdirect Inside Security Target
Version: 2.0 Copyright © 2008-2016 by atsec information security corporation and HP Inc. Page 47 of 98
Last update: 2016-06-07 or its wholly owned subsidiaries
Rationale for security objectives
protected environment for TOE external interfaces.
The OSP:
To restrict access to administrative tasks, the Device
Administrator Password will be set in the evaluated
configuration so that it is required to perform security-
relevant actions through EWS (HTTP), WS* Web
Services, OXPd Web Services, and at the Control Panel.
is enforced by:
OE.ADMIN.TRAINED which establishes responsibility of
the TOE Owner to provide appropriate Administrator
training.
The OSP:
To prevent ambiguous user names in the TOE's audit
trail, the Display Names of the Local Device Sign In
method users and the user names of the LDAP and
Windows Sign In method users must only contain ASCII
printable characters except for the double quote (22 hex)
and single quote (27 hex) characters (i.e., allowed ASCII
characters in hexadecimal: 20, 21, 23 - 26, 28 - 7E).
is enforced by:
OE.USERNAME.CHARACTER_SET which establishes
that the Display Names of all Local Device Sign In users
and the user names of all LDAP and Windows Sign In
methods users shall only contain ASCII printable
characters except for the double quote (22 hex) and
single quote (27 hex) characters (i.e., allowed ASCII
characters in hexadecimal: 20, 21, 23 - 26, 28 - 7E).
P.REMOTE_PANEL.DISALLOWED
The OSP:
To preserve operational accountability and security,
administrators must not use the Remote Control-Panel
feature.
is enforced by:
OE.ADMIN_TRAINED which establishes responsibility
of the TOE Owner to provide appropriate Administrator
training.
Table 22: Sufficiency of objectives enforcing Organizational Security Policies
To Next Page
Loading...