VNFRQTS - Reword Security Req SECCOM 1

Contains changes for VNFRQTS-304, 312, 339, 341, 354

Issue-ID: VNFRQTS-304

Change-Id: I88be8ebb4a9ea6538baa6f384c3eb29fc52cfc0e
Signed-off-by: Bozawglanian, Hagop (hb755d) <hagop.bozawglanian@att.com>

1 files changed, 14 insertions, 10 deletions

diff --git a/docs/Chapter4/Security.rst b/docs/Chapter4/Security.rst
index 1757be6..114772b 100644
--- a/docs/Chapter4/Security.rst
+++ b/docs/Chapter4/Security.rst
@@ -101,8 +101,9 @@ the product’s lifecycle.
     :keyword: SHOULD
     :updated: casablanca
 
-    The VNF **SHOULD** provide a mechanism for performing automated
-    system configuration auditing at configurable time intervals.
+    The VNF **SHOULD** provide a mechanism that enables the operators to
+    perform automated system configuration auditing at configurable time
+    intervals.
 
 .. req::
     :id: R-23882
@@ -140,8 +141,9 @@ the product’s lifecycle.
     :keyword: SHOULD
     :updated: casablanca
 
-    The VNF **SHOULD** support Layer 3 VPNs that enable segregation of
-    traffic by application (i.e., AVPN, IPSec VPN for Internet routes).
+    The VNF **SHOULD** support network segregation, i.e., separation of OA&M
+    traffic from signaling and payload traffic, using technologies such as
+    VPN and VLAN.
 
 .. req::
     :id: R-40813
@@ -253,7 +255,8 @@ Identity and Access Management Requirements
     :keyword: MUST
     :updated: casablanca
 
-    The VNF **MUST** allow the creation of multiple IDs so that
+    The VNF **MUST**, if not integrated with the Operator's Identity and
+    Access Management system, support the creation of multiple IDs so that
     individual accountability can be supported.
 
 .. req::
@@ -273,9 +276,9 @@ Identity and Access Management Requirements
     :keyword: MUST
     :updated: casablanca
 
-    Each layer of the VNF **MUST** support access restriction
-    independently of all other layers so that Segregation of Duties
-    can be implemented.
+    Each architectural layer of the VNF (eg. operating system, network,
+    application) **MUST** support access restriction independently of all
+    other layers so that Segregation of Duties can be implemented.
 
 .. req::
     :id: R-59391
@@ -283,8 +286,9 @@ Identity and Access Management Requirements
     :keyword: MUST NOT
     :updated: casablanca
 
-    The VNF **MUST NOT** not allow the assumption of the permissions of
-    another account to mask individual accountability.
+    The VNF **MUST NOT** allow the assumption of the permissions of another
+    account to mask individual accountability. For example, use SUDO when a
+    user requires elevated permissions such as root or admin.
 
 .. req::
     :id: R-64503