PD-0040: Warning Banner Must Be Human Readable Text

This decision represents a long-term technical decision based on an OD, and may not be the same as the final results of the source OD. With respect to published criteria documentation and scheme documents, it provides suggested guidance on evaluation direction, but is not authoritative. Authoritative decisions are provided through the published criteria documents and published scheme and international interpretations thereof. With respect to published PPs, PDs are authoritative corrections to the PP, based on input from the PP author (if available), that are in force until the publication of the next revision of that PP.

Issue

If FTA_TAB.1 is identified as a security functional requirement in a ST, wherein an advisory warning regarding the unauthorized use of the TOE is mandated, would it be acceptable to provide that warning by not using human readable text (e.g., via use of an audio beep or visual light indicator)?

Resolution

No. A non-human readable message can not be used as a warning banner to provide clear warning regarding the unauthorized use of the TOE.

Support

FTA_TAB.1 default TOE access banners requirement clearly states "This component requires that there is an advisory warning regarding the unauthorized use of the TOE". The advisory warning message is meant to advise the user about the policy or legal consequence of unauthorized access to the TOE. A non-human readable message can not provide warning regarding the unauthorized use of the TOE.

Modification History:

2004-08-12

Updated effective date to reflect the date the PD was issued. (August 2004 NIB 6.c.xiv)

References:

• CC v2.1

Related NIs:

• None

Related CCIMB-INTERPs:

• None

Source OD: 0177