PRODUCT DESCRIPTION

StillSecure VAM is a vulnerability management platform that identifies, tracks, and manages the remediation of network security vulnerabilities. StillSecure VAM systematically and regularly scans for network security vulnerabilities. Automated scans run on a regular, customizable schedule. The vulnerabilities found during scans are tracked and managed by VAM‘s exclusive Vulnerability Repair Workflow. VAM logs all scanning and repair activities and delivers a range of detailed reports targeted at auditors, managers, and IT staff members.

SECURITY EVALUATION SUMMARY

The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) processes and procedures. The TOE, StillSecure VAM V5.5, was evaluated against the criteria contained in the Common Criteria for Information Technology Security Evaluation, Version 2.2. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 2.2. CygnaCom Solutions has determined that the product meets the security criteria in the Security Target, which specifies an assurance level of EAL2. A validator, on behalf of the CCEVS Validation Body, monitored the evaluation. The evaluation was completed in January 2007.

ENVIRONMENTAL STRENGTHS

StillSecure VAM provides the following security features:

• Security audit — StillSecure VAM provides its own internal auditing capabilities separate from those of the Operating System. StillSecure VAM provides the ability to search and view its own audit records.
• Identification and authentication — StillSecure VAM provides user identification and authentication through the use of user accounts and the enforcement of password policies.
• Security management - StillSecure VAM provides security management through the use of the User Console. The TOE provides multiple administrative roles (FMT_SMR.1).
• Partial protection of the TSF — StillSecure VAM partially protects its programs and data from unauthorized access through its own interfaces.
• Vulnerability System — The TOE provides several features that map, scan, manage remediation, and report on vulnerabilities of the devices on the target network.
  • Map and Scan — Autodiscovery uses onboard scanners to map the network.  (VUL_SDC_EXP.1) The TOE is able to find all devices on the target network using ICMP pings with port and service scanners. Once the network is mapped, the onboard scanners scan for vulnerabilities of the devices on the target network.
  • Repair — Once the vulnerabilities have been mapped, the TOE provides a workflow process through its User Console to aid authorized users (FMT_SMR.1) in managing the patches and software updates that are necessary in correcting the found vulnerabilities. (FMT_MTD.1)
  • Report — The TOE provides reporting functionality to aid the authorized users in managing the found vulnerabilities and workflow process (VUL_DRS_EXP.1)

Vendor Information

StillSecure
Federal Sales
(303)-381-3830
sales@stillsecure.com

http://www.stillsecure.com