NIAP: Compliant Product
  NIAP  »»  Product Compliant List  »»  Compliant Product  
Compliant Product - AhnLab MDS, MDS with MTA, and MDS Manager v2.1

CC Certificate [PDF] Security Target [PDF] * Validation Report [PDF]

Assurance Activity [PDF]

Administrative Guide [PDF]

* This is the Security Target (ST) associated with the latest Maintenance Release.  To view previous STs for this TOE, click here.

Product Description

The AhnLab MDS protection system mitigates Advanced Persistent Threat (APT) attacks by identifying known and unknown malware, detecting suspicious traffic, and removing the detected threats.  The AhnLab MDS is a malware detection system that inspects network traffic and initiates intrusion mitigation.  It is not a network communication filtering device (i.e., not a firewall).

The Target of Evaluation (TOE) is the AhnLab MDS, MDS with MTA, and MDS Manager V2.1 as follows:

Product Series

Specific Product Device


MDS 1000

MDS 2000

MDS 6000


MDS with MTA

MDS 6000

MDS 10000

MDS Manager

MDS Manager 2000

MDS Manager  5000R

MDS Manager 10000R








AhnLab Malware Defense System (MDS) and MDS with MTA are network devices that provide malware detection for enterprise network security, protecting networks from Advanced Persistent Threat attacks, and provide the capability to immediately respond to remediate infected end-point systems. MDS with MTA also provides MTA functionality via purchase of separate license.  MDS Manager is a network device without malware detection capabilities.  In a distributed architecture, the MDS Manager Series Appliances also provide the capability to remotely manage multiple MDS and MDS/MTA appliances. However since distributed architectures are not included in the TOE, this capability is not evaluated.  Each network device in the TOE: MDS, MDS with MTA, and MDS Manager provides all of the security requirements defined by the NDcPP including Security Audit, Cryptographic Support, Identification and Authentication, Security Management, Protection of the TSF, TOE Access, and Trusted path/channels. 

The TOE consists of the following appliances:  MDS, or MDS with MTA, or MDS Manager identified above; and the software installed on the appliance.  Each TOE instance consists of a single appliance and is capable of providing all security functions specified in NDcPP.  

Evaluated Configuration

Security Evaluation Summary

The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the AhnLab MDS, MDS with MTA, and MDS Manager V2.1 were judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4.  The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4.   The product, when delivered and configured as identified in the AhnLab MDS V2.1, MDS Manager V2.1, and  MDS (MTA License Applied) V2.1 Configuring Common Criteria Compliance Guide, satisfies all of the security functional requirements stated in the AhnLab MDS, MDS with MTA, and MDS Manager V2.1 Security Target, Version 0.3, April 26. 2017.  The project underwent CCEVS Validator review.  The evaluation was completed in April 2017.  Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.

Environmental Strengths

Security Audit

The TOE generates security relevant audit records including administrative activity.  The audit records are stored on the TOE, protected from unauthorised deletion and can be sent to a remote audit server for storage.  The connection for transmission of audit records uses TLS.

Cryptographic support

The TOE includes cryptographic functionality that provide random bit-generation, encryption/decryption, digital signature, secure hashing and key-hashing features.  These features support cryptographic protocols including SSH, TLS and HTTPS.  

Identification and Authentication

The TOE identifies and authenticates all users prior to granting them access to the Web Management or Command Line interfaces.  The TOE provides the ability to define administrative accounts that have permission to view and/or modify TOE configuration variables.  Each of these administrative accounts has its own password. 

The TOE provides Password Management restrictions including support for minimum characters, and restrictions for character usage.

The TOE provides X.509 Certificate Validation, Authentication, and X.509 Certificate Requests for certificates used in trusted channel protocols.

Security Management

The TOE offers two administrative interfaces a Command Line Interface (CLI) provided at a local console as well as through SSH and a graphical user interface provided through TLS/HTTPS.  Both interfaces require a username and password prior to allowing any administrative actions to define accounts and configure TOE functionality.  SSH also supports authentication via public-key.  The System Administrator is considered to be the authorized Security Administrator of the TOE (as defined in the [NDcPP]). The TOE provides functions to manage the TOE and TOE data.

Protection of the TSF

The TOE implements a number of features designed to protect itself to ensure the reliability and integrity of its security features.

The TOE ensures that sensitive information such as passwords and cryptographic keys are stored such that they are not accessible even to an administrator.  The TOE provides its own internal clock which it uses to provide a reliable time source for audit records.

The TOE includes functions to perform self-tests and mechanisms for the update of the TOE software/firmware.

TOE Access

The TOE can be configured to display an informative banner when an administrator establishes an interactive session. The TOE can also enforce an administrator-defined inactivity timeout value after which the inactive session (local or remote) will be terminated.  Finally, the TOE allows administrators to terminate their own session.

Trusted Path/Channels

The TOE protects administrator communications from network workstations using SSHv2, TLS v1.1 and TLS v1.2 depending upon the interface being accessed.  The administrative Command Line Interface is access through the SSHv2 protocol, while TLS/HTTPS is used for the Web Management interface.  In each case, both integrity and disclosure protection is ensured by the protocol being used.  If the negotiation of an encrypted session fails or if the user does not have authorization for remote administration, an attempted connection is not established.

The TOE protects communication with an external log server to prevent unintended disclosure or modification of audit records.

Vendor Information

David Eung-Soo, Kim
+82 32 722 7872
+82 32 722 8901
Site Map              Contact Us              Home