Threat Description T.EAVESDROP If positioned on a wireless communications channel or elsewhere on the network, attackers may monitor and gain access to data exchanged between the Mobile Device and other endpoints. T.NETWORK An attacker may initiate communications with the Mobile Device or alter communications between the Mobile Device and other endpoints. T.PHYSICAL Loss of confidentiality of user data and credentials may be a result of an attacker gaining physical access to a Mobile Device. T.FLAWAPP Malicious or exploitable code could be used knowingly or unknowingly by a developer, possibly resulting in the capability of attacks against the platform’s system software. T.PERSISTENT An attacker gains and continues to have access the device, resulting it loss of integrity and possible control by both an adversary and legitimate owner. Table 2 MDF PP Threats Addressed By Windows Organizational Security Policies An organizational security policy is a set of rules or procedures imposed by an organization upon its operations to protect its sensitive data and IT assets. Table 3 describes organizational security policies which are necessary for conformance to the protection profile. Security Policy Description [None] There are no Organizational Security Policies for the protection profile. Table 3 Organizational Security Policies Secure Usage Assumptions Table 4 describes the core security aspects of the environment in which Windows is intended to be used. It includes information about the physical, personnel, procedural, and connectivity aspects of the environment. The following specific conditions are assumed to exist in an environment where the TOE is employed in order to conform to the protection profile: Assumption Description A.CONFIG It is assumed that the TOE’s security functions are configured correctly in a manner to ensure that the TOE security policies will be enforced on all applicable network traffic flowing among the attached networks.
Threat Description T.EAVESDROP If positioned on a wireless communications channel or elsewhere on the network, attackers may monitor and gain access to data exchanged between the Mobile Device and other endpoints. T.NETWORK An attacker may initiate communications with the Mobile Device or alter communications between the Mobile Device and other endpoints. T.PHYSICAL Loss of confidentiality of user data and credentials may be a result of an attacker gaining physical access to a Mobile Device. T.FLAWAPP Malicious or exploitable code could be used knowingly or unknowingly by a developer, possibly resulting in the capability of attacks against the platform’s system software. T.PERSISTENT An attacker gains and continues to have access the device, resulting it loss of integrity and possible control by both an adversary and legitimate owner. Table 2 MDF PP Threats Addressed By Windows Organizational Security Policies An organizational security policy is a set of rules or procedures imposed by an organization upon its operations to protect its sensitive data and IT assets. Table 3 describes organizational security policies which are necessary for conformance to the protection profile. Security Policy Description [None] There are no Organizational Security Policies for the protection profile. Table 3 Organizational Security Policies Secure Usage Assumptions Table 4 describes the core security aspects of the environment in which Windows is intended to be used. It includes information about the physical, personnel, procedural, and connectivity aspects of the environment. The following specific conditions are assumed to exist in an environment where the TOE is employed in order to conform to the protection profile: Assumption Description A.CONFIG It is assumed that the TOE’s security functions are configured correctly in a manner to ensure that the TOE security policies will be enforced on all applicable network traffic flowing among the attached networks.
windows%2010%20anniversary%20update%20mdf%20security%20target%20-%20public%20(april%203%202017).docx