1.1. ST AND TOE IDENTIFICATION
The Security Target (ST) is the Xerox WorkCentre 6655/6655i 2016 Multi-Function Device, which is a Xerox ConnectKey Technology device. The Target of Evaluation (TOE) is the Xerox WorkCentre 6655/6655i 2016 Multi-Function Device, which includes the device's hardware, firmware, and software.
1.2. TOE OVERVIEW
The TOE is a multi-function device that provides printing, copying, scanning, and faxing capabilities. It has a user-friendly interface and supports various security features, including user access control, IP filtering, and encryption.
1.2.1. Usage and Security Features
The TOE has a variety of usage and security features, including:
- User access control: The TOE allows administrators to control user access to the device and its functions.
- IP filtering: The TOE filters incoming and outgoing network traffic based on IP addresses and ports.
- Encryption: The TOE supports encryption for data transmission and storage.
1.2.2. TOE Type
The TOE is a network device that provides various services, including printing, copying, scanning, and faxing.
1.2.3. Required Non-TOE Hardware, Software and Firmware
The TOE requires various non-TOE hardware, software, and firmware components, including:
- A network connection
- A power source
- A user interface
1.3. TOE DESCRIPTION
The TOE is a physical device that consists of:
- A printer
- A copier
- A scanner
- A fax machine
- A user interface
1.3.1. Physical Scope of the TOE
The physical scope of the TOE includes the device's hardware components, including the printer, copier, scanner, and fax machine.
1.3.2. Logical Scope of the TOE
The logical scope of the TOE includes the device's software and firmware components, including the operating system and application software.
2. CONFORMANCE CLAIMS
The TOE conforms to the following standards and guidelines:
- Common Criteria
- Protection Profile Claims
- Package Claims
3. SECURITY PROBLEM DEFINITION
The security problem definition includes:
- Definitions of users, objects, operations, and channels
- Assumptions about the TOE and its environment
- Threats addressed by the TOE and its environment
3.1. DEFINITIONS
The security problem definition includes the following definitions:
- Users: Individuals who interact with the TOE
- Objects: Assets that are protected by the TOE
- Operations: Actions that are performed on the TOE
- Channels: Communication paths between the TOE and other devices
3.2. ASSUMPTIONS
The security problem definition includes the following assumptions:
- The TOE is installed and configured correctly
- The TOE is used in a secure environment
3.3. THREATS
The security problem definition includes the following threats:
- Threats addressed by the TOE
- Threats addressed by the IT environment
4. SECURITY OBJECTIVES
The security objectives include:
- Security objectives for the TOE
- Security objectives for the operational environment
- Security objectives for the non-IT environment
4.1. SECURITY OBJECTIVES FOR THE TOE
The security objectives for the TOE include:
- Confidentiality
- Integrity
- Availability
4.2. SECURITY OBJECTIVES FOR THE OPERATIONAL ENVIRONMENT
The security objectives for the operational environment include:
- Confidentiality
- Integrity
- Availability
4.3. SECURITY OBJECTIVES FOR THE NON-IT ENVIRONMENT
The security objectives for the non-IT environment include:
- Confidentiality
- Integrity
- Availability
4.4. RATIONALE FOR SECURITY OBJECTIVES
The rationale for the security objectives includes:
- The need to protect sensitive information
- The need to ensure the integrity of the TOE and its environment
- The need to ensure the availability of the TOE and its environment
5. EXTENDED COMPONENTS DEFINITION
The extended components definition includes:
- FPTFDIEXP: Restricted forwarding of data to external interfaces
6. SECURITY REQUIREMENTS
The security requirements include:
- Conventions
- TOE security policies
- Security functional requirements
6.1. CONVENTIONS
The security requirements include the following conventions:
- The use of the Common Criteria vocabulary
- The use of the Protection Profile Claims vocabulary
6.2. TOE SECURITY POLICIES
The security requirements include the following TOE security policies:
- IP Filter SFP
- User Access Control SFP
- TOE Function Access Control SFP
6.2.1. IP Filter SFP
The IP Filter SFP is a security policy that filters incoming and outgoing network traffic based on IP addresses and ports.
6.2.2. User Access Control SFP
The User Access Control SFP is a security policy that controls user access to the TOE and its functions.
6.2.3. TOE Function Access Control SFP
The TOE Function Access Control SFP is a security policy that controls access to the TOE's functions.
6.3. SECURITY FUNCTIONAL REQUIREMENTS
The security requirements include the following security functional requirements:
- Class FAU: Security audit
- Class FCO: Communication
- Class FCS: Cryptographic support
- Class FDP: User data protection
- Class FIA: Identification and authentication
- Class FMT: Security management
- Class FPR: Privacy
- Class FPT: Protection of the TSF
- Class FTA: TOE access
- Class FTP: Trusted paths/channels
