CC Certificate 

Security Target 

Validation Report 

Assurance Activity 

Administrative Guide 

The Target of Evaluation (TOE) is IBM QRadar Security Intelligence Platform version 7.5.

IBM QRadar Security Intelligence Platform is also known as the IBM QRadar Security Information and Event Management (SIEM).  The QRadar SIEM is a network device intended to detect potential threats through the review of audit and event data collected from network sources.  The TOE is administered either locally or remotely.  The QRadar product consolidates log source event data from thousands of devices, endpoints, and applications distributed throughout a network.

The evaluated product is a single All-in-One device running QRadar SIEM with QFlow enabled.  A QRadar QFlow collector collects network traffic passively through network taps and span ports.  A QFlow collector can detect and collect information from networked applications.  The All-in-One device is a self-contained appliance running the QRadar SIEM in a Red Hat RHEL 7.9 environment.  The appliance makes only those interfaces offered by QRadar available.

The IBM All-In-One:  Dell 3128C, model utilizes an x86 64-bit CPU architecture, with 4 network interface cards, and varying amounts of memory.

The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance.  The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target.  The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017.  The product, when delivered and configured as identified in the IBM QRadar Version 7.5 Common Criteria for NIAP Revision 1.0, version 0.3, June 20, 2023 document, satisfies all the security functional requirements stated in the IBM QRadar Security Intelligence Platform Version 7.5 Security Target, Version 0.8, June 26, 2023.  The project underwent CCEVS Validator review.  The evaluation was completed in July 2023.  Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11376-2023) prepared by CCEVS.

The logical boundaries of the QRadar Security Intelligence Platform are realized in the security functions that it implements. Each of these security functions is summarized below.

Security audit:

The TOE generates logs for a wide range of security relevant events.  The TOE can be configured to store the logs locally so they can be accessed by an administrator and to send the logs to a designated network peer using TLS to protect data while in transit.  The TOE is also capable of acting as a log storage device and receiving TLS protected communication from network peers sending audit/event data.

Cryptographic support:

The TOE utilizes NIST validated cryptographic algorithms to support key management, random bit generation, encryption/decryption, digital signature and secure hashing and key-hashing features in support of higher-level cryptographic protocols, including SSH and TLS.

Identification and authentication:

The TOE requires users to be identified and authenticated before they can use functions mediated by the TOE, except for reading the login banner.  The TOE authenticates administrative users.  In order for an administrative user to access the TOE, a user account including a username and password must be created for the user.

Security management:

The TOE provides Command Line Interface (CLI) commands and an HTTP over TLS (HTTPS) Graphical User Interface (GUI) to access the wide range of security management functions to manage its security policies.  The TOE also offers HTTP over TLS protection for REST API interfaces that can be used for administration.  All administrative activity and functions including security management commands are limited to authorized users (i.e., administrators) only after they have provided acceptable user identification and authentication data to the TOE.  The security management functions are controlled using privileges associated with roles that can be assigned to TOE users.

Protection of the TSF:

The TOE implements several features designed to protect itself to ensure the reliability and integrity of its security features.

It protects particularly sensitive data such as stored passwords and cryptographic keys so that they are not accessible even by an administrator.  It also provides its own timing mechanism to ensure that reliable time information is available (e.g., for log accountability).

Note that the TOE is a single appliance, and as such, no intra-TOE communication is subject to any risks that may require special protection (e.g., cryptographic mechanisms).

The TOE includes functions to perform self-tests so that it might detect when it is failing.  It also includes support to verify signatures on product updates.  The signature of an update is verified against a known key for IBM which is installed in the TOE.

TOE access:

The TOE can be configured to display a logon banner before a user session is established.  The TOE also enforces inactivity timeouts for local and remote sessions.

Trusted path/channels:

The TOE protects communication channels between itself and remote administrators using HTTPS/TLS and SSH.  The SSH protocol is used to protect administrative connections utilizing the TOE’s command line interface (CLI).  Additionally, web-based GUI and REST API interfaces are available for remote administration which are protected using HTTP over TLS (HTTPS/TLS).

The TOE also protects communication with network peers using TLS.  Protected communication includes the TOE’s outbound connection to an external audit server.

Vendor Information