Xerox WorkCentre 5632/5638/5645/5655 - Common Criteria

Xerox WorkCentre 5632/5638/5645/5655/5665/5675/5687
Multifunction Systems Security Target
Assumption
Description
Network Time Protocol (NTP)
Identification and Authentication
Authorization (LDAP, ADS, or other methods
of delegating user groups)
3.3. Threats
3.3.1. Threats Addressed by the TOE
This section identifies the threats addressed by the TOE. The various attackers of the
TOE are considered to be either authorized or unauthorized users of the TOE with
public knowledge of how the TOE operates. These users do not have any specialized
knowledge or equipment. The authorized users have physical access to the TOE.
Mitigation to the threats is through the objectives identified in Section 4, Security
Objectives.
Table 5: Threats Addressed by the TOE
Threat
T.RECOVER
T.COMM_SEC
Description
A malicious user may attempt to recover temporary or
stored document image data using commercially
available tools to read its contents.
This may occur because the attacker gets physical
access to the hard disk drive (e.g. as part the life-cycle of
the MFD (e.g. decommission)), or the document image
data can be read/recovered from the fax card flash
memory (e.g. as the result of a purposeful or inadvertent
power failure before the data could be erased.)
An attacker may break into a communications link
between the TOE and a remote trusted IT product in
order to intercept and/or modify management data
passed to/from/between the TOE and remote trusted IT
product.
T. INFAX During times when the FAX is not in use, a malicious
user may attempt to access the internal network by
connecting to the FAX card via PSTN and using publicly
available T.30 FAX transmission protocol commands for
the purpose of intercepting or modifying sensitive
information or data that may reside on resources
23
Copyright 2009 Xerox Corporation, All rights reserved