Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

6.5 Computer Security Controls
6.5.1 Specific Computer Security Technical Requirements
The following computer security functions may be provided by the operating system, or through
a combination of operating system, software, and physical safeguards. The CA, CSA and RA
shall include the following functionality:
� Require authenticated logins
� Provide Discretionary Access Control, including managing privileges of users to limit
users to their assigned roles
� Provide a security audit capability (See Section 5.4)
� Prohibit object re-use
� Require use of cryptography for session communication and database security
� Require a trusted path for identification and authentication
� Provide domain isolation for processes
� Provide self-protection for the operating system
� Require self-test security related CA services (e.g., check the integrity of the audit
logs)
� Support recovery from key or system failure
When CA equipment is hosted on evaluated platforms in support of computer security
assurance requirements then the system (hardware, software, operating system) shall, when
possible, operate in an evaluated configuration. At a minimum, such platforms shall use the
same version of the computer operating system as that which received the evaluation rating.
The computer system shall be configured with minimum of the required accounts and network
services, and no remote login.
6.5.2 Computer Security Rating
See section 6.5.1.
6.6 Life-Cycle Technical Controls
6.6.1 System Development Controls
The System Development Controls for the CA and CSA are as follows:
� Use software that has been designed and developed under a formal, documented
development methodology.
� Hardware and software procured shall be purchased in a fashion to reduce the
likelihood that any particular device was tampered with (e.g., by ensuring the
equipment was randomly selected at time of purchase).
� Hardware and software developed shall be developed in a controlled environment,
and the development process shall be defined and documented. This requirement
does not apply to commercial off-the-shelf hardware or software.
66 7/25/2011