4.8.3 Secure system behavior with the countermeasures implemented
This subsection describes the behavior of a secure system with the countermeasures implemented.
The figure below outlines the behavior of the system when the countermeasures are implemented. Each countermeasure shown in this figure corresponds to one described in 4.8.2 Countermeasures to be implemented against expected threats.
|
The behavior of a system in which the countermeasures shown in this figure are implemented is described below for each user type.
- Organization of this subsection
(1) System administrator and System operator operations, and system behavior
The operations of the System administrator and System operator and the system behavior are outlined below.
- System administrator's operations
-
-
Uses Smart Composer functionality commands to configure the application server. However, for setup work for J2EE applications, resources, etc., server management commands are used.
-
Deploys and starts the application in which the user identification and authentication functions, the access control function, and the audit log function are implemented.
-
- System operator's operations
-
Uses Smart Composer functionality commands to operate the system. However, for log collection in the case of an error, the snapshotlog command is used.
- System behavior
-
Creates an audit log entry for each operation performed by the execution of a command.
- Tip
-
Some commands do not create an audit log entry. Before using a command, check whether it creates an audit log entry. For details about the commands that create audit log entries, see Chapter 6 in the uCosminexus Application Server Operation, Monitoring, and Linkage Guide.
(2) End-user operations and system behavior
System (J2EE application) behavior and end-user operations for using system-provided services are outlined below.
- End-users' operations
-
Uses a Web browser on a client terminal to send an HTTP request to the application server.
- System (J2EE application) behavior
-
-
Identifies the user information included in the HTTP request to authenticate the user.
-
Uses the Access Control function to check whether the authenticated user has permissions.
-
Executes the J2EE application service in accordance with the requests permitted by the Access Control function.
-
Compiles an audit log during processing.
-