Cisco Security Appliance. Security Target. Version 1.0. October 2014

Transcription

1 Cisco Security Appliance Security Target Version 1.0 October 2014 Americas Headquarters: Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA USA 2014 Cisco Systems, Inc. All rights reserved.

2 Cisco Security Appliance Security Target Table of Contents 1 SECURITY TARGET INTRODUCTION ST and TOE Reference TOE Overview TOE Product Type Supported non-toe Hardware/ Software/ Firmware TOE DESCRIPTION TOE Evaluated Configuration Physical Scope of the TOE Logical Scope of the TOE Security Audit Cryptographic Support Full Residual Information Protection Identification and authentication Security Management Protection of the TSF TOE Access Trusted path/channels Excluded Functionality Conformance Claims Common Criteria Conformance Claim Protection Profile Conformance Protection Profile Conformance Claim Rationale TOE Appropriateness TOE Security Problem Definition Consistency Statement of Security Requirements Consistency SECURITY PROBLEM DEFINITION Assumptions Threats Organizational Security Policies SECURITY OBJECTIVES Security Objectives for the TOE Security Objectives for the Environment SECURITY REQUIREMENTS Conventions TOE Security Functional Requirements SFRs Drawn from NDPP ONLY Security audit (FAU) Cryptographic Support (FCS) User data protection (FDP) Identification and authentication (FIA) Security management (FMT) Protection of the TSF (FPT) TOE Access (FTA)

3 Cisco Security Appliance Security Target Trusted Path/Channels (FTP) TOE SFR Dependencies Rationale for SFRs Found in NDPP Security Assurance Requirements SAR Requirements Security Assurance Requirements Rationale Assurance Measures TOE Summary Specification TOE Security Functional Requirement Measures Annex B: References

4 Cisco Security Appliance Security Target List of Tables TABLE 1 ACRONYMS... 5 TABLE 2 TERMINOLOGY... 6 TABLE 3 ST AND TOE IDENTIFICATION... 8 TABLE 4 IT ENVIRONMENT COMPONENTS... 9 TABLE 5 TOE MODELS AND SPECIFICATIONS TABLE 6 FIPS REFERENCES TABLE 7 TOE PROVIDED CRYPTOGRAPHY TABLE 8 EXCLUDED FUNCTIONALITY TABLE 9 PROTECTION PROFILES TABLE 10 TOE ASSUMPTIONS TABLE 11 THREATS TABLE 12 ORGANIZATIONAL SECURITY POLICIES TABLE 13 SECURITY OBJECTIVES FOR THE TOE TABLE 14 SECURITY OBJECTIVES FOR THE ENVIRONMENT TABLE 15 SECURITY FUNCTIONAL REQUIREMENTS TABLE 16 AUDITABLE EVENTS TABLE 17: ASSURANCE MEASURES TABLE 18 ASSURANCE MEASURES TABLE 19 HOW TOE SFRS ARE MET TABLE 21: REFERENCES List of Figures FIGURE 1 TOE EXAMPLE DEPLOYMENT

5 Cisco Security Appliance Security Target Acronyms The following acronyms and abbreviations are common and may be used in this Security Target: Table 1 Acronyms Acronyms / Definition Abbreviations ACL Access Control Lists AES Advanced Encryption Standard BRI Basic Rate Interface CC Common Criteria for Information Technology Security Evaluation CEM Common Evaluation Methodology for Information Technology Security CM Configuration Management CSU Channel Service Unit DHCP Dynamic Host Configuration Protocol DSU Data Service Unit EAL Evaluation Assurance Level EHWIC Ethernet High-Speed WIC ESP Encapsulating Security Payload GE Gigabit Ethernet port HTTP Hyper-Text Transport Protocol HTTPS Hyper-Text Transport Protocol Secure ICMP Internet Control Message Protocol ISDN Integrated Services Digital Network ESA Security Appliance IT Information Technology MTA Mail Transfer Agent NDPP Network Device Protection Profile OS Operating System PBKDF2 Password-Based Key Derivation Function version 2 PoE Power over Ethernet POP3 Post Office Protocol PP Protection Profile SA Security Association SFP Small form-factor pluggable port SHS Secure Hash Standard SIO Cisco Security Intelligence SIP Session Initiation Protocol SSHv2 Secure Shell (version 2) ST Security Target TCP Transport Control Protocol TOE Target of Evaluation TSC TSF Scope of Control TSF TOE Security Function TSP TOE Security Policy UDP User datagram protocol WAN Wide Area Network WIC WAN Interface Card 5

6 Cisco Security Appliance Security Target Terminology Term Authorized Administrator Role Security Administrator User Vty Table 2 Terminology Definition Any user which has been assigned to a privilege level that is permitted to perform all TSFrelated functions. An assigned role gives a user varying access to the management of the TOE. Synonymous with Authorized Administrator for the purposes of this evaluation. Any entity (human user or external IT entity) outside the TOE that interacts with the TOE. vty is a term used by Cisco to describe a single terminal (whereas Terminal is more of a verb or general action term). 6

7 Cisco Security Appliance Security Target DOCUMENT INTRODUCTION Prepared By: Cisco Systems, Inc. 170 West Tasman Dr. San Jose, CA This document provides the basis for an evaluation of a specific Target of Evaluation (TOE), the Security Appliance (ESA). This Security Target (ST) defines a set of assumptions about the aspects of the environment, a list of threats that the product intends to counter, a set of security objectives, a set of security requirements, and the IT security functions provided by the TOE which meet the set of requirements. Administrators of the TOE will be referred to as administrators, Authorized Administrators, TOE administrators, semi-privileged, privileged administrators, and security administrators in this document. The Common Criteria Functional Specification is met through the description of interfaces in this Security Target and the parameters described within the Common Criteria Guidance Documentation as well as the Cisco documentation for ESA. 7

8 Cisco Security Appliance Security Target 1 SECURITY TARGET INTRODUCTION The Security Target contains the following sections: Security Target Introduction [Section 1] Conformance Claims [Section 2] Security Problem Definition [Section 3] Security Objectives [Section 4] IT Security Requirements [Section 5] TOE Summary Specification [Section 6] The structure and content of this ST comply with the requirements specified in the Common Criteria (CC), Part 1, Annex A, and Part ST and TOE Reference This section provides information needed to identify and control this ST and its TOE. Table 3 ST and TOE Identification Name Description ST Title Security Appliance Security Target ST Version 1.0 Publication Date October 2014 Vendor and ST Author Cisco Systems, Inc. TOE Reference Security Appliance TOE Hardware Models C170, C370, C670, X1070, C380, C680, C000v, C100v, C300v, C600v TOE Software Version AsyncOS Keywords , Data Protection, Authentication, Network Device 1.2 TOE Overview The TOE, Cisco Security Appliance, is a scalable hardware and software solution that provides comprehensive protection services for . It is an protection product that monitors Simple Mail Transfer Protocol (SMTP) network traffic, analyzes the monitored network traffic using various techniques, and reacts to identified threats associated with messages (such as spam and inappropriate or malicious content). The TOE includes the hardware models as defined in Table 3 in section TOE Product Type The TOE is an protection product that can block spam, and threats that may be delivered via . ESA receives updates from the Cisco Security Intelligence (SIO) organization. Cisco SIO prevents zero-hour attacks by continually generating new rules that feed updates to the Cisco ESA. The updates occur every 3 to 5 minutes keeping the ESA threat database updated for current threats. Once a threat is detected through scanning, the TOE will take action based on authorized administrator configurable filters. encryption can also be applied to outbound s. 8

9 Cisco Security Appliance Security Target The Cisco ESA is designed to serve as the SMTP gateway or Mail Exchanger (MX), providing the Message Transfer Agent (MTA) role in the customer s network infrastructure. As such, the TOE should be installed between an external and an internal network, such that network traffic sent and received on TCP port 25 1 must pass through the TOE. The TOE provides separate physical interfaces allowing it to be connected to separate internal and external networks. The TOE can be configured to monitor network traffic sent from the internal network to the external network, and vice versa. The TOE provides two management interfaces: command line interface (CLI) and graphical user interface (GUI). An authorized administrator can administer the ESA appliance using both the web-based Graphical User Interface (GUI) and Command Line Interface (CLI). The GUI contains most of the functionality to configure and monitor the system. However, not all CLI commands are available in the GUI; some features are only available through the CLI. The TOE provides capabilities to manage its monitoring, analysis, and reaction functions, and controls access to those capabilities through the use of administrative roles with varying security management authorizations. All administrative users of the TOE are required to be identified and authenticated before accessing the TOE s management capabilities. In addition, all security relevant administrative actions are audited Supported non-toe Hardware/ Software/ Firmware The TOE supports (in some cases optionally) the following hardware, software, and firmware in its environment when the TOE is configured in its evaluated configuration: Component Required TOE Interface Management Yes Management Workstation with SSH Client Management Workstation using web browser for HTTPS Yes Table 4 IT Environment Components Management Local Console No Serial Console NTP Server No Management SMTP Server Yes Management, or 10/100/1000 Usage/Purpose Description for TOE performance This includes any IT Environment Management workstation with a SSH client installed that is used by the TOE administrator to support TOE administration through SSH protected channels. Any SSH client that supports SSHv2 may be used. This includes any IT Environment Management workstation with a web browser installed that is used by the TOE administrator to support TOE administration through HTTPS protected channels. Any web browser that supports TLSv1.0 with the supported ciphersuites may be used. This includes any IT Environment Console that is directly connected to the TOE via the Serial Console and is used by the TOE administrator to support TOE administration. The TOE supports communications with an NTP server in order to synchronize the date and time on the TOE with the NTP server s date and time. A solution must be used that supports secure communications with up to a 32 character key. This includes the IT environment SMTP servers that the TOE receives and sends . Syslog Server Yes Management This includes any syslog server to which the TOE would transmit 1 SMTP traffic typically is communicated on TCP port 25, but the TOE can be configured to monitor other ports for SMTP traffic. 9

10 Cisco Security Appliance Security Target Component Required TOE Interface Update Server No Management Usage/Purpose Description for TOE performance syslog messages. This includes the Cisco IT environment update servers that are used to download the latest software updates for the TOE. 1.3 TOE DESCRIPTION This section provides an overview of the Cisco Security Appliance TOE. The TOE is a security appliance that utilizes hardware and software in an integrated appliance to scan traffic between an external network and the customer s internal network. Traffic flowing to and from the external network to the internal network is first routed through the TOE appliance. Through the intercept, scanning, and reporting functions, the TOE appliance can detect potentially malicious files of various types, filter traffic for restricted content, and containing spam messages or phishing attempts. ESA supports RFC 2821-compliant Simple Mail Transfer Protocol (SMTP) to accept and deliver messages. The TOE monitors SMTP network traffic and applies the following traffic analysis mechanisms: Signature analysis - the administrator can configure message filters, comprising rules describing how to handle messages and attachments as they are received. Filter rules identify messages based on message or attachment content, information about the network, message headers, or message body. Detection of spam - the TOE implements a layered mechanism to detecting and handling spam. The first layer of spam control is called reputation filtering, which allows for classifying senders and restricting access to infrastructures based on a sender s trustworthiness as determined by the TOE. The second layer comprises scanning of messages by the TOE s Anti-Spam engine. In addition, the administrator can create policies to deliver messages from known or highly reputable senders directly to the end user without any anti-spam scanning, while messages from less reputable or unknown senders are subjected to anti-spam scanning. The TOE can also be configured to throttle the number of messages it will accept from suspicious senders, reject connections or bounce messages. Anti-virus scanning - the TOE incorporates both Sophos and McAfee Anti-Virus virus scanning engines, which can be configured to scan messages and attachments for viruses on a per-mail policy basis and take the following actions based on the scan results: attempt to repair the attachment; drop the attachment; modify the subject header; add an additional header; send the message to a different address or mail host; archive the message; or delete the message. Application of content filters - the administrator can create content filters to be applied to messages on a per-recipient or per-sender basis. Content filters are similar to the message filters described above under Signature analysis, except that they are applied later in 10

11 Cisco Security Appliance Security Target the processing pipeline. messages can be quarantined, deleted, or have the flagged content filtered from the . The action taken on the is based on the content filtering policies configured by the authorized administrator. Application of virus outbreak filters - the TOE has the ability to compare incoming messages with administrator-configured Virus Outbreak Rules. Messages that match such rules are assigned a threat level and that threat level is compared to the threat level threshold set by the administrator. Messages meeting or exceeding the threshold are quarantined. Once a suspected infected or phishing attempt is detected, the TOE can then take one or more of the following actions in response as identified by the traffic analysis mechanisms: Generate an to an administrator containing an alarm Generate an alarm that is written to a log file that can be examined using the administrator console Drop the message Bounce the message Archive the message Add a blind-carbon copied recipient to the message Modify the message. The various administrator-configurable rule sets that control the behavior of spam detection, anti-virus scanning, content filtering and virus outbreak filtering are configured such that they are applied to specific groups of users based on message attributes (Envelope Recipients, Envelope Sender, From: header, or Reply-To: header) in order to perform each type of analysis as described above. The following figure provides a visual depiction of an example TOE deployment. The TOE boundary is surrounded with a hashed red line. 11

12 Cisco Security Appliance Security Target Figure 1 TOE Example Deployment The previous figure includes the following: TOE The following are considered to be in the IT Environment: o Management Workstation o NTP Server o Syslog Server o SMTP Server o Update Server 1.4 TOE Evaluated Configuration The TOE consists of one or more appliances as specified in section 1.5 below and includes the Cisco AsyncOS software. The Cisco AsyncOS configuration determines how packets are handled to and from the TOE s network interfaces. In addition, the appliance configuration determines how suspected malicious is handled. The TOE can optionally connect to an NTP server on its internal network for time services. Also, if the ESA is to be remotely administered, then the management station must be connected to an internal network, SSHv2 must be used to remotely connect to the appliance. A syslog server is also used to store audit records. If these servers are used, they must be attached to the internal (trusted) network. The internal (trusted) network is meant to be separated effectively from 12

13 Cisco Security Appliance Security Target unauthorized individuals and user traffic; one that is in a controlled environment where implementation of security policies can be enforced. 1.5 Physical Scope of the TOE The TOE is comprised of both software and hardware. The hardware is comprised of the following: C170, C370, C670, X1070, C380, C680, and C000v, C100v, C300v, C600v running on Cisco servers (blade or rack-mounted). The Cisco Security Appliance that comprises the TOE has common hardware characteristics. These characteristics affect only non-tsf relevant functions of the appliances (such as throughput and amount of storage) and therefore support security equivalency of the appliances in terms of hardware. The Cisco Content Security software appliance models have similar disk layouts, queue and cache sizes, and configurations as their physical hardware appliance counterparts. The software security appliances have been pre-configured with disk space, queue/cache space, memory, processor cores. These differences in the pre-configurations of the software appliances are the reason the software appliance images differ. The TOE guidance documentation that is considered to be part of the TOE can be found listed in the Cisco Security Appliance Common Criteria Operational User Guidance and Preparative Procedures document and are downloadable from the web site. The TOE is comprised of the following specifications as described in Table 5 below: 13

14 Model Table 5 TOE Models and Specifications X1070 C680 C670 C380 C370 C170 C000v C100v C300v C600v Processor 2x4 (2 quad cores) 2x6 (2 hexa cores) 2x4 (2 quad cores) 1x6 (1 hexa core) 1x4 (1 quad core) 1x2 (1 Dual Core) B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 Memory 4 GB 32 GB 4 GB 16 GB 4 GB 4 GB B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 Hard disk 1.8 TB (300 x 6), RAID TB (600 x 3), RAID TB (300 x 4), RAID TB (600 x 2), RAID GB (300 x 2), RAID GB, RAID 1 B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5

15 Model X1070 C680 C670 C380 C370 C170 C000v C100v C300v C600v Interfaces/ Server (1) USB Console (1) Serial Console (1) Management (3) 10/100/1000 (2) USB Console (1) Console (RJ-45 connect or) (1) Manage ment (4) 10/100/ 1000 (2) Power Supply (1) Remote Power Manage ment (1) USB Console (1) Serial Console (1) Manage ment (3) 10/100/ 1000 (2) Power Supply (2) USB Console (1) Console (1) Manage ment (4) 10/100/ 1000 (2) Power Supply (1) Remote Power Manage ment (1) USB Console (1) Serial Console (1) Manage ment (4) 10/100/ 1000 (2) Power Supply (2) USB Console (1) Console (1) Manage ment (2) 10/100/1 000 (1) Power Supply B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 B- Series 2 or C- Series 3 runnin g ESXi 5.1 or 5.5 B- Series 2 or C- Series 3 runnin g ESXi 5.1 or See the B-Series data sheets for details on the interfaces 3 See the C-Series data sheets for details on the interfaces 15

16 1.6 Logical Scope of the TOE The TOE is comprised of several security features. Each of the security features identified above consists of several security functionalities, as identified below. 1. Security Audit 2. Cryptographic Support 3. Full Residual Information Protection 4. Identification and Authentication 5. Security Management 6. Protection of the TSF 7. TOE Access 8. Trusted Path/Channels These features are described in more detail in the subsections below. In addition, the TOE implements all RFCs of the NDPP v1.1 as necessary to satisfy testing/assurance measures prescribed therein Security Audit The Cisco Security Appliance provides extensive auditing capabilities. The TOE can audit events related to cryptographic functionality, identification and authentication, and administrative actions. The Cisco Security Appliance generates an audit record for each auditable event. Each security relevant audit event has the date, timestamp, event description, and subject identity. The administrator configures auditable events, performs back-up operations, and manages audit data storage. The TOE provides the administrator with a circular audit trail or a configurable audit trail threshold to track the storage capacity of the audit trail. Audit logs are backed up over an encrypted channel to an external audit server Cryptographic Support The TOE provides cryptography in support of other Cisco ESA security functionality. This cryptography has been validated for conformance to the requirements of FIPS Level 2 (see Table 6 for certificate references). Table 6 FIPS References Algorithm Cert. # AES 1759 DSA 550 ECDSA 234 HMAC 1031 RNG 937 RSA 876 SHS (SHA-1) 1544 The TOE provides cryptography in support of remote administrative management via SSHv2. The cryptographic services provided by the TOE are described in Table 7 below.

17 Table 7 TOE Provided Cryptography Cryptographic Method Secure Shell Establishment (SSH) Transport Layer Security (TLS) AES RSA Signature Services HMAC RNG SHS (SHA-1) Use within the TOE Used to establish initial SSH session. Used in TLS session establishment. Used to encrypt TLS session traffic. Used to encrypt SSH session traffic. Used in TLS session establishment. Used in SSH session establishment. X.509 certificate signing Used for keyed hash, integrity services in TLS an SSH session establishment. Used for random number generation Used in TLS session establishment. Used in SSH session establishment. Used to provide TLS traffic integrity verification Used to provide SSH traffic integrity verification Full Residual Information Protection The TOE ensures that all information flows from the TOE do not contain residual information from previous traffic. Packets are padded with zeros. Residual data is never transmitted from the TOE Identification and authentication The TOE performs two types of authentication: device-level authentication of remote Message Transfer Agents (MTA) and user authentication for the Authorized Administrator of the TOE. Device-level authentication allows the TOE to establish a secure channel with another MTA over TLS. The secure channel is established only after each device authenticates the other with a X.509v3 certificate. The TOE provides authentication services for administrative users wishing to connect to the TOE s secure CLI and GUI administrative interfaces. The TOE requires Authorized Administrators to authenticate prior to being granted access to any of the management functionality. The TOE can be configured to require a minimum password length of 15 characters as well as mandatory password complexity rules that includes special characters. The TOE provides administrator authentication against a local user database. Password-based authentication can be performed on the serial console or remote interfaces. The SSHv2 interface also supports authentication using SSH keys. The remote GUI is protected using TLS. 17

18 1.6.5 Security Management The TOE provides secure administrative services for management of general TOE configuration and the security functionality provided by the TOE. All TOE administration occurs either through a secure SSHv2 session or via a local console connection. The TOE provides the ability to securely manage: All TOE administrative users; All identification and authentication; All audit functionality of the TOE; All TOE cryptographic functionality; The timestamps maintained by the TOE; Update to the TOE; and TOE configuration file storage and retrieval. The TOE provides capabilities to manage its security functions, and controls access to those capabilities through the use of administrative roles with varying security management authorizations. Administrators can create configurable login banners to be displayed at time of login, and can also define an inactivity timeout for each admin interface to terminate sessions after a set period of inactivity Protection of the TSF The TOE protects against interference and tampering by untrusted subjects by implementing identification, authentication, and access controls to limit configuration to Authorized Administrators. The TOE prevents reading of cryptographic keys and passwords. The TOE internally maintains the date and time. This date and time is used as the timestamp that is applied to audit records generated by the TOE. Administrators can update the TOE s clock manually, or can configure the TOE to use NTP to synchronize the TOE s clock with an external time source. Finally, the TOE performs testing to verify correct operation of the appliance itself and that of the cryptographic module. The TOE is able to verify any software updates prior to the software updates being installed on the TOE to avoid the installation of unauthorized software TOE Access The TOE can terminate inactive sessions after an Authorized Administrator configurable timeperiod. Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session. The TOE can also display an Authorized Administrator specified banner on the CLI and GUI management interfaces prior to allowing any administrative access to the TOE. 18

19 1.6.8 Trusted path/channels The TOE allows trusted paths to be established to itself from remote administrators over SSHv2 for remote CLI access and HTTPS for remote GUI access. The TOE can push log files to an external syslog server using SCP over SSH. 1.7 Excluded Functionality The following functionality is excluded from the evaluation. Excluded Functionality Non-FIPS mode of operation on the Table 8 Excluded Functionality Exclusion Rationale This mode of operation includes non-fips allowed operations. These services will be disabled by configuration. The exclusion of this functionality does not affect compliance to the U.S. Government Protection Profile for Security Requirements for Network Devices Version

20 2 CONFORMANCE CLAIMS 2.1 Common Criteria Conformance Claim The TOE and ST are compliant with the Common Criteria (CC) Version 3.1, Revision 4, dated: September For a listing of Assurance Requirements claimed see section 5.5. The TOE and ST are CC Part 2 extended and CC Part 3 conformant. 2.2 Protection Profile Conformance The TOE and ST are conformant with the Protection Profiles as listed in Table 9 below: Table 9 Protection Profiles Protection Profile Version Date U.S. Government Protection Profile for Security Requirements for Network 1.1 June 8, 2012 Devices (NDPP) Security Requirements for Network Devices Errata #2 13 January Protection Profile Conformance Claim Rationale TOE Appropriateness The TOE provides all of the functionality at a level of security commensurate with that identified in the U.S. Government Protection Profile: U.S. Government Protection Profile for Security Requirements for Network Devices, Version TOE Security Problem Definition Consistency The Assumptions, Threats, and Organizational Security Policies included in the Security Target represent the Assumptions, Threats, and Organizational Security Policies specified in the U.S. Government Protection Profile for Security Requirements for Network Devices Version 1.1 for which conformance is claimed verbatim. All concepts covered in the Protection Profile Security Problem Definition are included in the Security Target Statement of Security Objectives Consistency. The Security Objectives included in the Security Target represent the Security Objectives specified in the NDPPv1.1 for which conformance is claimed verbatim. All concepts covered in the Protection Profile s Statement of Security Objectives are included in the Security Target Statement of Security Requirements Consistency The Security Functional Requirements included in the Security Target represent the Security Functional Requirements specified in the NDPPv1.1 for which conformance is claimed verbatim. All concepts covered in the Protection Profile s Statement of Security Requirements are included in this Security Target. Additionally, the Security Assurance Requirements included in this 20

21 Security Target are identical to the Security Assurance Requirements included in section 4.3 of the NDPPv

22 3 SECURITY PROBLEM DEFINITION This chapter identifies the following: Significant assumptions about the TOE s operational environment. IT related threats to the organization countered by the TOE. Environmental threats requiring controls to provide sufficient protection. Organizational security policies for the TOE as appropriate. This document identifies assumptions as A.assumption with assumption specifying a unique name. Threats are identified as T.threat with threat specifying a unique name. Organizational Security Policies (OSPs) are identified as P.osp with osp specifying a unique name. 3.1 Assumptions The specific conditions listed in the following subsections are assumed to exist in the TOE s environment. These assumptions include both practical realities in the development of the TOE security requirements and the essential environmental conditions on the use of the TOE. Assumption A.NO_GENERAL_PURPOSE A.PHYSICAL A.TRUSTED_ADMIN Table 10 TOE Assumptions Assumption Definition It is assumed that there are no general-purpose computing capabilities (e.g., compilers or user applications) available on the TOE, other than those services necessary for the operation, administration and support of the TOE. Physical security, commensurate with the value of the TOE and the data it contains, is assumed to be provided by the environment. TOE Administrators are trusted to follow and apply all administrator guidance in a trusted manner. 3.2 Threats The following table lists the threats addressed by the TOE and the IT Environment. The assumed level of expertise of the attacker for all the threats identified below is Enhanced-Basic. Threat T.ADMIN_ERROR T.TSF_FAILURE T.UNDETECTED_ACTIONS T.UNAUTHORIZED_ACCESS T.UNAUTHORIZED_UPDATE Table 11 Threats Threat Definition An administrator may unintentionally install or configure the TOE incorrectly, resulting in ineffective security mechanisms. Security mechanisms of the TOE may fail, leading to a compromise of the TSF. Malicious remote users or external IT entities may take actions that adversely affect the security of the TOE. These actions may remain undetected and thus their effects cannot be effectively mitigated. A user may gain unauthorized access to the TOE data and TOE executable code. A malicious user, process, or external IT entity may masquerade as an authorized entity in order to gain unauthorized access to data or TOE resources. A malicious user, process, or external IT entity may misrepresent itself as the TOE to obtain identification and authentication data. A malicious party attempts to supply the end user with an update to the product that may compromise the security features of the TOE. 22

23 Threat T.USER_DATA_REUSE Threat Definition User data may be inadvertently sent to a destination not intended by the original sender. 3.3 Organizational Security Policies The following table lists the Organizational Security Policies imposed by an organization to address its security needs. Policy Name P.ACCESS_BANNER Table 12 Organizational Security Policies Policy Definition The TOE shall display an initial banner describing restrictions of use, legal agreements, or any other appropriate information to which users consent by accessing the TOE. 23

24 4 SECURITY OBJECTIVES This Chapter identifies the security objectives of the TOE and the IT Environment. The security objectives identify the responsibilities of the TOE and the TOE s IT environment in meeting the security needs. This document identifies objectives of the TOE as O.objective with objective specifying a unique name. Objectives that apply to the IT environment are designated as OE.objective with objective specifying a unique name. 4.1 Security Objectives for the TOE The following table, Security Objectives for the TOE, identifies the security objectives of the TOE. These security objectives reflect the stated intent to counter identified threats and/or comply with any security policies identified. An explanation of the relationship between the objectives and the threats/policies is provided in the rationale section of this document. TOE Objective O.PROTECTED_COMMUNICATIONS O.VERIFIABLE_UPDATES O.SYSTEM_MONITORING O.DISPLAY_BANNER O.TOE_ADMINISTRATION O.RESIDUAL_INFORMATION_CLEARING O.SESSION_LOCK O.TSF_SELF_TEST Table 13 Security Objectives for the TOE TOE Security Objective Definition The TOE will provide protected communication channels for administrators, other parts of a distributed TOE, and authorized IT entities. The TOE will provide the capability to help ensure that any updates to the TOE can be verified by the administrator to be unaltered and (optionally) from a trusted source. The TOE will provide the capability to generate audit data and send those data to an external IT entity. The TOE will display an advisory warning regarding use of the TOE. The TOE will provide mechanisms to ensure that only administrators are able to log in and configure the TOE, and provide protections for logged-in administrators. The TOE will ensure that any data contained in a protected resource is not available when the resource is reallocated. The TOE shall provide mechanisms that mitigate the risk of unattended sessions being hijacked. The TOE will provide the capability to test some subset of its security functionality to ensure it is operating properly. 24

25 4.2 Security Objectives for the Environment All of the assumptions stated in section 3.1 are considered to be security objectives for the environment. The following are the Protection Profile non-it security objectives, which, in addition to those assumptions, are to be satisfied without imposing technical requirements on the TOE. That is, they will not require the implementation of functions in the TOE hardware and/or software. Thus, they will be satisfied largely through application of procedural or administrative measures. Environment Security Objective OE.NO_GENERAL_PURPOSE OE.PHYSICAL OE.TRUSTED_ADMIN Table 14 Security Objectives for the Environment IT Environment Security Objective Definition There are no general-purpose computing capabilities (e.g., compilers or user applications) available on the TOE, other than those services necessary for the operation, administration and support of the TOE. Physical security, commensurate with the value of the TOE and the data it contains, is provided by the environment. TOE Administrators are trusted to follow and apply all administrator guidance in a trusted manner. 25

26 5 SECURITY REQUIREMENTS This section identifies the Security Functional Requirements for the TOE. The Security Functional Requirements included in this section are derived from Part 2 of the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 4, dated: September 2012 and all international interpretations. 5.1 Conventions The CC defines operations on Security Functional Requirements: assignments, selections, assignments within selections and refinements. This document uses the following font conventions to identify the operations defined by the CC: Assignment: Indicated with italicized text; Refinement: Indicated with bold text; Selection: Indicated with underlined text; Iteration: Indicated by appending the iteration number in parenthesis, e.g., (1), (2), (3). Explicitly stated SFRs are identified by having a label EXT after the requirement name for TOE SFRs. Formatting conventions outside of operations and iterations matches the formatting specified within the NDPP. 5.2 TOE Security Functional Requirements This section identifies the Security Functional Requirements for the TOE. The TOE Security Functional Requirements that appear in the following table are described in more detail in the following subsections. Table 15 Security Functional Requirements Class Name Component Identification Component Name FAU: Security FAU_GEN.1 Audit data generation audit FAU_GEN.2 User Identity Association FAU_STG_EXT.1 External Audit Trail Storage FCS: FCS_CKM.1 Cryptographic Key Generation (for asymmetric keys) Cryptographic FCS_CKM_EXT.4 Cryptographic Key Zeroization support FCS_COP.1(1) Cryptographic Operation (for data encryption/decryption) FCS_COP.1(2) Cryptographic Operation (for cryptographic signature) FCS_COP.1(3) Cryptographic Operation (for cryptographic hashing) FCS_COP.1(4) Cryptographic Operation (for keyed-hash message authentication) FCS_HTTPS_EXT.1 Explicit: HTTPS FCS_RBG_EXT.1 Extended: Cryptographic Operation (Random Bit Generation) FCS_SSH_EXT.1 Explicit: SSH FCS_TLS_EXT.1 Explicit: TLS FDP: User Data FDP_RIP.2 Full Residual Information Protection Protection FIA: FIA_PMG_EXT.1 Password Management Identification and FIA_UIA_EXT.1 User Identification and Authentication authentication FIA_UAU_EXT.2 Extended: Password-based Authentication Mechanism FIA_UAU.7 Protected Authentication Feedback 26

27 Class Name Component Identification Component Name FMT: Security FMT_MTD.1 Management of 7TSF Data (for general TSF data) management FMT_SMF.1 Specification of Management Functions FMT_SMR.2 Restrictions on Security Roles FPT: Protection of the TSF FPT_SKP_EXT.1 Extended: Protection of TSF Data (for reading of all symmetric keys) FPT_APW_EXT.1 Extended: Protection of Administrator Passwords FPT_STM.1 Reliable Time Stamps FPT_TST_EXT.1 Extended: TSF Testing FPT_TUD_EXT.1 Extended: Trusted Update FTA: TOE FTA_SSL_EXT.1 TSF-initiated Session Locking Access FTA_SSL.3 TSF-initiated Termination FTA_SSL.4 User-initiated Termination FTA_TAB.1 Default TOE Access Banners FTP: Trusted FTP_ITC.1 Inter-TSF trusted channel Path/Channels FTP_TRP.1 Trusted Path 5.3 SFRs Drawn from NDPP ONLY Security audit (FAU) FAU_GEN.1 Audit data generation FAU_GEN.1.1 The TSF shall be able to generate an audit record of the following auditable events: a) Start-up and shutdown of the audit functions; b) All auditable events for the not specified level of audit; and c) All administrative actions; d) [Specifically defined auditable events listed in Table 16]. FAU_GEN.1.2 The TSF shall record within each audit record at least the following information: a) Date and time of the event, type of event, subject identity, and the outcome (success or failure) of the event; and b) For each audit event type, based on the auditable event definitions of the functional components included in the PP/ST, [information specified in column three of Table 16]. Table 16 Auditable Events SFR Auditable Event Additional Audit Record Contents Audit Events and Details from NDPP FAU_GEN.1 None. None. FAU_GEN.2 None. None. FAU_STG_EXT.1 None. None. FCS_CKM.1 None. None. FCS_CKM_EXT.4 None. None. FCS_COP.1(1) None. None. FCS_COP.1(2) None. None. FCS_COP.1(3) None. None. FCS_COP.1(4) None. None. FCS_HTTPS_EXT.1 Failure to establish an HTTPS session. Reason for failure. 27

28 SFR Auditable Event Additional Audit Record Contents Establishment/Termination of an HTTPS session. Non-TOE endpoint of connection (IP address) for both successes and failures. FCS_SSH_EXT.1 Failure to establish an SSH session Establishment/Termination of an SSH session. Reason for failure. Non-TOE endpoint of connection (IP address) for both successes and failures. FCS_RBG_EXT.1 None. None. FCS_TLS_EXT.1 Failure to establish an TLS session Establishment/Termination of an TLS session. Reason for failure. Non-TOE endpoint of connection (IP address) for both successes and failures. FDP_RIP.2 None. None. FIA_PMG_EXT.1 None. None. FIA_UIA_EXT.1 All use of the identification and authentication mechanism. Provided user identity, origin of the attempt (e.g., IP address). FIA_UAU_EXT.2 All use of the authentication Origin of the attempt (e.g., IP address). mechanism. FIA_UAU.7 None. None. FMT_MTD.1 None. None. FMT_SMF.1 None. None. FMT_SMR.2 None. None. FPT_SKP_EXT.1 None. None. FPT_APW_EXT.1 None. None. FPT_STM.1 Changes to the time. The old and new values for the time. Origin of the attempt (e.g., IP address). FPT_TUD_EXT.1 Initiation of update. No additional information. FPT_TST_EXT.1 None. None. FTA_SSL_EXT.1 Any attempts at unlocking of an No additional information. interactive session. FTA_SSL.3 The termination of a remote session by No additional information. the session locking mechanism. FTA_SSL.4 The termination of an interactive No additional information. session. FTA_TAB.1 None. None. FTP_ITC.1 Initiation of the trusted channel. Termination of the trusted channel. Failure of the trusted channel functions. FTP_TRP.1 Initiation of the trusted channel. Termination of the trusted channel. Failures of the trusted path functions. Identification of the initiator and target of failed trusted channels establishment attempt Identification of the claimed user identity FAU_GEN.2 User Identity Association FAU_GEN.2.1 For audit events resulting from actions of identified users, the TSF shall be able to associate each auditable event with the identity of the user that caused the event FAU_STG_EXT.1 External Audit Trail Storage FAU_STG_EXT.1.1 The TSF shall be able to [transmit the generated audit data to an external IT entity] using a trusted channel implementing the [SSH] protocol. 28

29 5.3.2 Cryptographic Support (FCS) FCS_CKM.1 Cryptographic Key Generation (for asymmetric keys) FCS_CKM.1.1 Refinement: The TSF shall generate asymmetric cryptographic keys used for key establishment in accordance with [ NIST Special Publication A, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography for finite field-based key establishment schemes; NIST Special Publication B, Recommendation for Pair-Wise Key Establishment Schemes Using Integer Factorization Cryptography for RSA-based key establishment schemes ] and specified cryptographic key sizes equivalent to, or greater than, a symmetric key strength of 112 bits FCS_CKM_EXT.4 Cryptographic Key Zeroization FCS_CKM_EXT.4.1 The TSF shall zeroize all plaintext secret and private cryptographic keys and CSPs when no longer required FCS_COP.1(1) Cryptographic Operation (for data encryption/decryption) FCS_COP.1.1(1) Refinement: The TSF shall perform [encryption and decryption] in accordance with a specified cryptographic algorithm [AES operating in [CBC] and cryptographic key sizes 128-bits and 256-bits that meets the following: FIPS PUB 197, Advanced Encryption Standard (AES) [NIST SP A, NIST SP D] FCS_COP.1(2) Cryptographic Operation (for cryptographic signature) FCS_COP.1.1(2) Refinement: The TSF shall perform cryptographic signature services in accordance with a [ (1) Digital Signature Algorithm (DSA) with a key size (modulus) of 2048 bits or greater, (2) RSA Digital Signature Algorithm (rdsa) with a key size (modulus) of 2048 bits or greater] that meets the following: Case: Digital Signature Algorithm FIPS PUB 186-3, Digital Signature Standard Case: RSA Digital Signature Algorithm FIPS PUB or FIPS PUB 186-3, Digital Signature Standard 29

30 FCS_COP.1(3) Cryptographic Operation (for cryptographic hashing) FCS_COP.1.1(3) Refinement: The TSF shall perform [cryptographic hashing services] in accordance with a specified cryptographic algorithm [SHA-1, SHA-256, SHA-384, SHA-512] and message digest sizes [160, 256, 384, 512] bits that meet the following: FIPS Pub 180-3, Secure Hash Standard FCS_COP.1(4) Cryptographic Operation (for keyed-hash message authentication) FCS_COP.1.1(4) Refinement: The TSF shall perform [keyed-hash message authentication] in accordance with a specified cryptographic algorithm HMAC-[SHA-1], key size [160 bits], and message digest sizes [160] bits that meet the following: FIPS Pub 198-1, "The Keyed-Hash Message Authentication Code, and FIPS Pub 180-3, Secure Hash Standard FCS_HTTPS_EXT.1 Explicit: HTTPS FCS_HTTPS_EXT.1.1 The TSF shall implement the HTTPS protocol that complies with RFC FCS_HTTPS_EXT.1.2 The TSF shall implement HTTPS using TLS as specified in FCS_TLS_EXT FCS_RBG_EXT.1 Extended: Cryptographic Operation (Random Bit Generation) FCS_RBG_EXT.1.1 The TSF shall perform all random bit generation (RBG) services in accordance with [FIPS Pub Annex C: X9.31 Appendix 2.4 using AES] seeded by an entropy source that accumulated entropy from [a software-based noise]. FCS_RBG_EXT.1.2 The deterministic RBG shall be seeded with a minimum of [256 bits] of entropy at least equal to the greatest security strength of the keys and hashes that it will generate FCS_SSH_EXT.1 Explicit: SSH FCS_SSH_EXT.1.1 The TSF shall implement the SSH protocol that complies with RFCs 4251, 4252, 4253, 4254, and [no other RFCs]. FCS_SSH_EXT.1.2 The TSF shall ensure that the SSH protocol implementation supports the following authentication methods as described in RFC 4252: public key-based, password-based. FCS_SSH_EXT.1.3 The TSF shall ensure that, as described in RFC 4253, packets greater than [35,000] bytes in an SSH transport connection are dropped. FCS_SSH_EXT.1.4 The TSF shall ensure that the SSH transport implementation uses the following encryption algorithms: AES-CBC-128, AES-CBC-256, [no other algorithms]. 30

31 FCS_SSH_EXT.1.5 The TSF shall ensure that the SSH transport implementation uses [SSH_RSA] and [no other public key algorithms] as its public key algorithm(s). FCS_SSH_EXT.1.6 The TSF shall ensure that data integrity algorithms used in SSH transport connection is [hmac-sha1]. FCS_SSH_EXT.1.7 The TSF shall ensure that diffie-hellman-group14-sha1 and [no other methods] are the only allowed key exchange methods used for the SSH protocol FCS_TLS_EXT.1 Explicit: TLS FCS_TLS_EXT.1.1 The TSF shall implement one or more of the following protocols [TLS 1.0 (RFC 2246)] supporting the following ciphersuites: Mandatory Ciphersuites: TLS_RSA_WITH_AES_128_CBC_SHA Optional Ciphersuites: [TLS_RSA_WITH_AES_256_CBC_SHA] User data protection (FDP) FDP_RIP.2 Full Residual Information Protection FDP_RIP.2.1 The TSF shall ensure that any previous information content of a resource is made unavailable upon the [deallocation of the resource from] all objects Identification and authentication (FIA) FIA_PMG_EXT.1 Password Management FIA_PMG_EXT.1.1 The TSF shall provide the following password management capabilities for administrative passwords: 1. Passwords shall be able to be composed of any combination of upper and lower case letters, numbers, and the following special characters: #, $, %, ^, &, *, (, ) ; 2. Minimum password length shall settable by the Security Administrator, and support passwords of 15 characters or greater; FIA_UIA_EXT.1 User Identification and Authentication FIA_UIA_EXT.1.1 The TSF shall allow the following actions prior to requiring the non-toe entity to initiate the identification and authentication process: Display the warning banner in accordance with FTA_TAB.1; 31

32 [no other actions.] FIA_UIA_EXT.1.2 The TSF shall require each administrative user to be successfully identified and authenticated before allowing any other TSF-mediated action on behalf of that administrative user FIA_UAU_EXT.2 Extended: Password-based Authentication Mechanism FIA_UAU_EXT.2.1 The TSF shall provide a local password-based authentication mechanism, [public key certificate] to perform administrative user authentication FIA_UAU.7 Protected Authentication Feedback FIA_UAU.7.1 The TSF shall provide only obscured feedback to the administrative user while the authentication is in progress at the local console Security management (FMT) FMT_MTD.1 Management of TSF Data (for general TSF data) FMT_MTD.1.1 The TSF shall restrict the ability to manage the TSF data to the Security Administrators FMT_SMF.1 Specification of Management Functions FMT_SMF.1.1 The TSF shall be capable of performing the following management functions: Ability to administer the TOE locally and remotely; Ability to update the TOE, and to verify the updates using [published hash] capability prior to installing those updates; [Ability to configure the cryptographic functionality.] FMT_SMR.2 Restrictions on Security Roles FMT_SMR.2.1 The TSF shall maintain the roles: Authorized Administrator. FMT_SMR.2.2 The TSF shall be able to associate users with roles. FMT_SMR.2.3 The TSF shall ensure that the conditions Authorized Administrator role shall be able to administer the TOE locally; Authorized Administrator role shall be able to administer the TOE remotely; are satisfied. 32