Xerox WorkCentre 5135/5150 Multifunction ... - Common Criteria

Xerox WorkCentre 5135/5150
Multifunction Systems Security Target
1.3.2.7. User Data Protection – IP Filtering
(TSF_FDP_FILTER)
The TOE provides the ability for the system administrator to configure a
network information flow control policy based on a configurable rule set.
The information flow control policy (IPFilter SFP) is generated by the
system administrator specifying a series of rules to “accept,” “deny,” or
“drop” packets. These rules include a listing of IP addresses that will be
allowed to communicate with the TOE. The IP Filter supports the
construction of both IPv4 and IPv6 filtering policies. Additionally rules can
be generated specifying filtering options based on port number given in
the received packet. IP Filtering is not available for IPv6, AppleTalk or
IPX; however, the effect of IP Filtering can be accomplished for IPv6 by
configuring IPSec associations.
Note: The TOE cannot enforce the IP Filtering (TSF_FDP_FILTER)
security function when it is configured for IPv6, AppleTalk or IPX
networks.
1.3.2.8. Information Flow Security (TSF_FLOW)
The TOE controls and restricts the information flow between the PSTN
port of the optional FAX processing board (if installed) and the network
controller (which covers the information flow to and from the internal
network). Data and/or commands cannot be sent to the internal network
via the PSTN. A direct connection from the internal network to external
entities by using the telephone line of the TOE is also denied.
If the optional FAX board is not installed, an information flow from or to the
FAX port is not possible at all.
1.3.2.9. Security Management (TSF_FMT)
Only authenticated system administrators can enable or disable the Image
Overwrite function, enable or disable the On Demand Image Overwrite
function, change the system administrator password, and start or cancel
an On Demand Image Overwrite operation.
While IIO or ODIO can be disabled, doing so will remove the TOE from its
evaluated configuration.
Additionally, only authenticated system administrators can assign
authorization privileges to users, establish a recurrence schedule for “On
Demand” image overwrite, enable/disable SSL support, create/install
X.509 certificates, enable/disable and download the audit log,
enable/disable and configure (rules) IP filtering, enable/disable disk
encryption, enable/disable use of Common Access Cards or
enable/disable and configure IPv6.
16
Copyright 2009 Xerox Corporation, All rights reserved