[2600] proposed new text for PP guide discussion of FMT_MSA.3
During the most recent P2600 meeting, we left an action item open to
gather more input from Canon and consider other changes to clause 6.6,
page 54, lines 33-44. Canon has supplied more information. I propose
that we replace lines 33-44 with the following text:
"FMT_MSA.3.2(a) allows an authorized role to alter the default
attribute values when an object or information is created.
Typically, either U.ADMINISTRATOR or Nobody will be allowed to alter
default attribute values. It is possible in some implementations
that a U.NORMAL will be allowed to alter default attribute values
associated with some of their own data, and such allowance should be
specified carefully so that access control is not compromised."
Keeping in mind that FMT_MSA.3.2 deals with permission to alter the
/default/ attribute values, I think that the most typical cases will be
that either U.ADMINISTRATOR is allowed or Nobody is allowed. Therefore,
I don't think we should spend much time on an unusual case in which a
normal user is allowed to change defaults on some attributes.
--
Regards,
Brian Smithson
PM, Security Research
PMP, CSM, CISSP, CISA, ISO 27000 PA
Advanced Imaging and Network Technologies
Ricoh Americas Corporation
(408)346-4435