NIAP: Compliant Product
NIAP/CCEVS
  NIAP  »»  Product Compliant List  »»  Compliant Product  
Compliant Product - Cisco ASA 9.6 with FirePOWER Service v6.1

Certificate Date:  2018.01.09

Validation Report Number:  CCEVS-VR-VID10793-2018

Product Type:    Firewall
   Virtual Private Network
   IDS/IPS
   Network Device

Conformance Claim:  Protection Profile Compliant

PP Identifier:    collaborative Protection Profile for Stateful Traffic Filter Firewalls Version 1.0
  collaborative Protection Profile for Network Devices Version 1.0
  Extended Package for Intrusion Prevention Systems Version 2.11
  Extended Package for VPN Gateways Version 2.1

CC Testing Lab:  Gossamer Security Solutions


CC Certificate [PDF] Security Target [PDF] Validation Report [PDF]

Assurance Activity [PDF]

Administrative Guide [PDF]

Administrative Guide [PDF]


Product Description

The TOE is comprised of both software and hardware.  The model is comprised of the following: ASA 5500 Series (5506-X, 5506H-X, 5506W-X, 5508-X, 5516-X), (5512-X, 5515-X, 5525-X, 5545-X, 5555-X), (5585-X SSP-10, 5585-X SSP-20, 5585-X SSP-40, 5585-X SSP-60), and FireSIGHT (FS750, FS1500, FS2000, FS3500, and FS4000). The software is comprised of the Adaptive Security Appliance software image version 9.6.2, with ASDM 7.6 and FirePOWER Service version 6.1 (two separate binaries).

The models that comprise the TOE have common hardware characteristics. These differing characteristics affect only non-TSF relevant functionality (such as throughput, processing speed, number and type of network connections supported, number of concurrent connections supported, and amount of storage) and therefore support security equivalency of the ASAs in terms of hardware.


Evaluated Configuration

The TOE consists of one or more ASA physical devices which include the Cisco ASA software, which in turn includes the ASDM software, and the FirePOWER Services software that is managed by one FMC physical device. Each instantiation of the TOE has two or more network interfaces, and is able to filter IP traffic to and through those interfaces.

The evaluated configuration consists of the following devices:

TOE Configuration

Hardware Configurations              

Software Version

ASA 5506-X

ASA 5506H-X

ASA 5506W-X

ASA 5508-X

ASA 5516-X

The Cisco ASA 5500-X Adaptive Security Appliance provides high-performance firewall, VPN, and IPS services and 4-8 Gigabit Ethernet interfaces, and support for up to 300 VPNs.

ASA release 9.6.2 with FirePOWER release 6.1

ASA 5512-X

C78-701253-00_Table-01_Figure-04ASA 5515-X

ASA 5525-X

ASA 5545-X

ASA 5555-X

The Cisco ASA 5500-X Adaptive Security Appliance provides high-performance firewall, VPN, and IPS services and 6-14 Gigabit Ethernet interfaces, and support for up to 5,000 VPNs.

ASA release 9.6.2 with FirePOWER release 6.1

ASA 5585-X SSP-10

ASA 5585-X SSP-20

ASA 5585-X SSP-40

ASA 5585-X SSP-60

The Cisco ASA 5585 Adaptive Security Appliance provides high-performance firewall, VPN, and IPS services and 6-16 Gigabit Ethernet interfaces, 2-10 10Gigabit Ethernet interfaces, and support for up to 10,000 VPNs.

ASA release 9.6.2 with FirePOWER release 6.1

FS750

FS1500

FS2000

FS3500

FS4000

The Cisco FireSIGHT Series provides centralized management console with up to 4 management interfaces, and up to 10 Gbps speed.

FirePOWER release 6.1

ASDM

Included on all ASA models with ASA 9.6.2

Release 7.6


Security Evaluation Summary

The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target.  The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 4, September 2012. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 4, July 2012.  The product, when delivered and configured as identified in the Cisco Common Criteria Supplemental User Guide for FirePOWER v6.1, Version 1.0, August 8, 2017 and Cisco Adaptive Security Appliance (ASA) 9.6 Preparative Procedures & Operational User Guide for the Common Criteria Certified configuration, Version 1.0, October 4, 2017 documents, satisfies all of the security functional requirements stated in the Cisco ASA with FirePOWER Services Security Target, Version 1.0, January 8, 2018.  The project underwent CCEVS Validator review.  The evaluation was completed in December 2017.  Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID10793-2017) prepared by CCEVS.


Environmental Strengths

The logical boundaries of the Cisco ASA with FirePOWER Services are realized in the security functions that it implements. Each of these security functions is summarized below.

Security Audit:

The TOE provides extensive auditing capabilities. The TOE can audit events related to cryptographic functionality, identification and authentication, and administrative actions.  The TOE generates an audit record for each auditable event.  The administrator configures auditable events, performs back-up operations, and manages audit data storage.  The TOE provides the administrator with a circular audit trail or a configurable audit trail threshold to track the storage capacity of the audit trail.  Audit logs are backed up over an encrypted channel to an external audit server.

Cryptographic support:

The TOE provides cryptography in support of other TOE security functionality.  The TOE provides cryptography in support of secure connections using IPsec and TLS, and remote administrative management via SSHv2 (FP Service), SSHv2 over IPsec (ASA), and TLS/HTTPS. The cryptographic random bit generators (RBGs) are seeded by an entropy noise source. Note IPsec is only supported on the ASA software, not FP Service.

Full residual information protection:

The TOE ensures that all information flows from the TOE do not contain residual information from previous traffic.  Packets are padded with zeros.  Residual data is never transmitted from the TOE.

Identification and authentication:

The TOE performs two types of authentication: device-level authentication of the remote device (VPN peers) and user authentication for the authorized administrator of the TOE.  Device-level authentication allows the TOE to establish a secure channel with a trusted peer.  The secure channel is established only after each device authenticates the other.  Device-level authentication is performed via IKE/IPsec X509v3 certificate based authentication or pre-shared key methods.  

The TOE provides authentication services for administrative users wishing to connect to the TOEs secure CLI and GUI administrator interfaces.  The TOE requires authorized administrators to authenticate prior to being granted access to any of the management functionality.  The TOE can be configured to require a minimum password length of 15 characters as well as mandatory password complexity rules. The TOE also implements a lockout mechanism if the number of configured unsuccessful threshold has been exceeded.  

The TOE provides administrator authentication against a local user database.  Password-based authentication can be performed on the serial console or SSH and HTTPS interfaces.  The SSHv2 interface also supports authentication using SSH keys.  The TOE optionally supports use of any RADIUS AAA server (part of the IT Environment) for authentication of administrative users attempting to connect to the TOE. Note SSH traffic to the ASA must be tunneled over IPsec in the evaluated configuration.

Security management:

The TOE provides secure administrative services for management of general TOE configuration and the security functionality provided by the TOE.  All TOE administration occurs either through a secure SSHv2 (FP Service), SSHv2 over IPsec (ASA), or TLS/HTTPS session, or via a local console connection.  The TOE provides the ability to securely manage all TOE administrative users; all identification and authentication; all audit functionality of the TOE; all TOE cryptographic functionality; the timestamps maintained by the TOE; TOE configuration file storage and retrieval, and the information flow control policies enforced by the TOE including encryption/decryption of information flows for VPNs.  The TOE supports an “authorized administrator” role, which equates to any account authenticated to an administrative interface (CLI or GUI, but not VPN), and possessing sufficient privileges to perform security-relevant administrative actions.

When an administrative session is initially established, the TOE displays an administrator- configurable warning banner.  This is used to provide any information deemed necessary by the administrator.  After a configurable period of inactivity, administrative sessions will be terminated, requiring administrators to re-authenticate.

Protection of the TSF:

The TOE protects against interference and tampering by untrusted subjects by implementing identification, authentication, and access controls to limit configuration to authorized administrators.  The TOE prevents reading of cryptographic keys and passwords. 

Additionally TOE is not a general-purpose operating system and access to the TOE memory space is restricted to only TOE functions.

The TOE internally maintains the date and time.  This date and time is used as the timestamp that is applied to audit records generated by the TOE.  Administrators can update the TOE’s clock manually, or can configure the TOE to use NTP to synchronize the TOE’s clock with an external time source.  Additionally, the TOE performs testing to verify correct operation of the appliance itself and that of the cryptographic module. Whenever any system failures occur within the TOE the TOE will cease operation.

TOE Access:

When an administrative session is initially established, the TOE displays an administrator- configurable warning banner.  This is used to provide any information deemed necessary by the administrator.  After a configurable period of inactivity, administrator and VPN client sessions will be terminated, requiring re-authentication. The TOE also supports direct connections from VPN clients, and protects against threats related to those client connections. The TOE disconnects sessions that have been idle too long, and can be configured to deny sessions based on IP, time, and day, and to NAT external IPs of connecting VPN clients to internal network addresses.

Trusted path/channels:

The TOE supports establishing trusted paths between itself and remote administrators using SSHv2 for CLI access (FP Service), SSHv2 over IPsec for CLI access (ASA), and TLS/HTTPS for GUI/ASDM and web UI access on the FMC.  The TOE supports use of TLS and/or IPsec for connections with remote syslog servers.  The TOE can use IPsec to encrypt connections with remote authentication servers (e.g. RADIUS).  The TOE can establish trusted paths of peer-to-peer VPN tunnels using IPsec, and VPN client tunnels using IPsec or TLS. Note that the VPN client is in the operational environment.

Filtering:

The TOE provides stateful traffic firewall functionality including IP address-based filtering (for IPv4 and IPv6) to address the issues associated with unauthorized disclosure of information, inappropriate access to services, misuse of services, disruption or denial of services, and network-based reconnaissance.  Address filtering can be configured to restrict the flow of network traffic between protected networks and other attached networks based on source and/or destination IP addresses.  Port filtering can be configured to restrict the flow of network traffic between protected networks and other attached networks based on the originating (source) and/or receiving (destination) port (service).  Stateful packet inspection is used to aid in the performance of packet flow through the TOE and to ensure that only packets are only forwarded when they’re part of a properly established session. The TOE supports protocols that can spawn additional sessions in accordance with the protocol RFCs where a new connection will be implicitly permitted when properly initiated by an explicitly permitted session. The File Transfer Protocol is an example of such a protocol, where a data connection is created as needed in response to an explicitly allowed command connection.  System monitoring functionality includes the ability to generate audit messages for any explicitly defined (permitted or denied) traffic flow.  TOE administrators have the ability to configure permitted and denied traffic flows, including adjusting the sequence in which flow control rules will be applied, and to apply rules to any network interface of the TOE.

The TOE also provides packet filtering and secure IPsec tunneling. The tunnels can be established between two trusted VPN peers as well as between remote VPN clients and the TOE. More accurately, these tunnels are sets of security associations (SAs). The SAs define the protocols and algorithms to be applied to sensitive packets and specify the keying material to be used. SAs are unidirectional and are established per the ESP security protocol. An authorized administrator can define the traffic that needs to be protected via IPsec by configuring access lists (permit, deny, log) and applying these access lists to interfaces using crypto map set.

Intrusion prevention system:

The TOE provides intrusion policies consisting of rules and configurations invoked by the access control policy. The intrusion policies are the last line of defense before the traffic is allowed to its destination. All traffic permitted by the access control policy is then inspected by the designated intrusion policy. Using intrusion rules and other preprocessor settings, these policies inspect traffic for security violations and, in inline deployments, can block or alter malicious traffic.

If the vendor-provided intrusion policies do not fully address the security needs of the organization, custom policies can improve the performance of the system in the environment and can provide a focused view of the malicious traffic and policy violations occurring on the network. By creating and tuning custom policies the administrators can configure, at a very granular level, how the system processes and inspects the traffic on the network for intrusions.

Using Security Intelligence, the administrators can blacklist—deny traffic to and from—specific IP addresses, URLs, and DNS domain names, before the traffic is subjected to analysis by the access control rules. Optionally, the administrators can use a “monitor-only” setting for Security Intelligence filtering.


Vendor Information

Logo
Cisco Systems, Inc.
Cert Team
4103094862
na
certteam@cisco.com

www.cisco.com
Site Map              Contact Us              Home