Validated Product - IronPort Messaging Gateway Version 5.1.2

PRODUCT DESCRIPTION

The IronPort Messaging Gateway Version 5.1.2 is a self-contained IT appliance that monitors Simple Mail Transfer Protocol (SMTP) email network traffic. The TOE monitors email traffic in the IT environment between an external and an internal network when the environment is configured to forward all enterprise email traffic for port 25 through the TOE.

The TOE performs the following email traffic analysis techniques:
- Signature analysis
- Detection of spam
- Application of content filters
- Application of virus outbreak filters

The TOE can take one or more of the following actions in order to enforce an email message policy (i.e. to enforce the implicit IDS security policy):
- Generate an email to an administrator containing an alarm
- Generate an alarm that is written to a log file that can be examined using the administrator console
- Drop the email message
- Bounce the email message
- Archive the email message
- Add a blind-carbon copied recipient to the email message
- Modify the email message

The TOE is controlled by rule sets that are specific to each analysis technique; there are administratively-configurable rule sets as follows:
- Anti-spam rules
- Content filter rules
- Virus outbreak filter rules

Anti-spam, content filter, and virus outbreak rules are each implemented as collections of TOE configuration settings that can be specified using administrator console interfaces. Rules are configured such that they are applied to specific groups of users based on email message attributes (Envelope Recipients, Envelope Sender, From: header, or Reply-To: header) in order to perform each type of analysis as described above.

SECURITY EVALUATION SUMMARY

The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the IronPort Messaging Gateway Version 5.1.2 TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 2.3. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 2.3. Science Applications International Corporation (SAIC) determined that the evaluation assurance level (EAL) for the product is EAL 2 family of assurance requirements. The product, when configured as specified in the IronPort AsyncOS 5.1 Advanced User Guide for IronPort Appliances, IronPort AsyncOS 5.1 User Guide for IronPort Appliances, and IronPort AsyncOS 5.1 Common Criteria Guide for IronPort Appliances, satisfies all of the security functional requirements stated in the IronPort Messaging Gateway Version 5.1.2 Security Target, Version 1.0. Two Validators on behalf of the CCEVS Validation Body monitored the evaluation carried out by SAIC. The evaluation was completed in March 2008. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report, (report number CCEVS-VR-VID10144-2008, dated 28 June 2008) prepared by CCEVS.