CC Certificate 

Security Target 

Validation Report 

Assurance Activity 

Administrative Guide: Cisco Identity Services Engine (ISE)v3.1 Common Criteria Operational User Guidance And Preparative Procedures 

Administrative Guide: Cisco Identity Services Engine CLI Reference Guide, Release 3.1 

Administrative Guide: Cisco Identity Services Engine Administrator Guide, Release 3.1 

Administrative Guide: Cisco Identity Services Engine Installation Guide, Release 3.1 

Administrative Guide: Cisco Secure Network Server 3500 Series Appliance Hardware Installation Guide 

Administrative Guide: Cisco Secure Network Server 3600 Series Appliance Hardware Installation Guide 

Administrative Guide: ISE Configuration for EAP-TLS Server (Supplement to the Common Criteria Operational User Guidance And Preparative Procedures for ISEv3.1) 

Administrative Guide: Public Key Infrastructure ConfigurationGuide, Cisco IOS Release 15MT 

The Cisco Identity Services Engine (ISE) V3.1, Target of Evaluation (TOE) deployment includes network devices utilizing the ISE authentication, authorization and accounting (AAA) features, remote administrator, local administrative console and a remote authentication store. Both the remote administrator and local administrator console capabilities must be supported.

The evaluated configuration of the TOE includes only one instance of ISE in a stand-alone deployment.

The following figure that shows a typical TOE deployment includes the following components:

• Nodes - An instance of Cisco ISE (SNS appliance or ISE-VM).
• Network devices – The clients that are provided authentication services by ISE
• Endpoints – Devices through which the administrators can log in and manage the TOE.
• Syslog Server - The TOE can be configured to send syslog events to the syslog server.

The evaluated configuration will include one ISE instance in a network. The TOE deployment includes network devices utilizing the ISE authentication, authorization and accounting (AAA) features, remote administrator, local administrative console and a remote authentication store. Both the remote administrator and local administrator console capabilities must be supported.

The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Cisco Identity Services Engine (ISE) V3.1 was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5.  The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5.  The product, when delivered configured as identified in the Cisco Identity Services Engine (ISE) v3.1 Common Criteria Operational User Guidance and Preparative Procedures, satisfies all of the security functional requirements stated in the Cisco Identity Services Engine (ISE) v3.1 Security Target. The project underwent CCEVS Validator review.  The evaluation was completed in September 2023.  Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.

The TOE is comprised of several security features. Each of the security features identified above consists of several security functionalities, as identified below.

1. Security Audit
2. Cryptographic Support
3. Communications
4. Identification and Authentication
5. Security management
6. Protection of the TSF
7. TOE Access
8. Trusted path/channels

These features are described in more detail in the subsections below.

1.      Security Audit

The TOE’s Audit security function supports audit record generation and review. The TOE provides date and time information that is used in audit timestamps. The events generated by the TOE include indication of the logging starting and stopping, cryptographic operations, attempts to log onto the TOE, all commands/ web-based actions executed by the Security Administrator, and other system events.

The TOE can store the generated audit data on itself and it can be configured to send syslog events to other devices, including other iterations of ISE, using a TLS protected collection method.  Logs are classified into various predefined categories.  The TOE also provides the capability for the administrator to customize the logging output by editing the categories with respect to their targets, severity level, etc.   The logging categories help describe the content of the messages that they contain.  Access to the logs is restricted only to the Security Administrator, who has no access to edit them, only to copy or delete (clear) them. Audit records are protected from unauthorized modifications and deletions.

The logs can be viewed by using the Operations -> Reports page on the ISE administration interface, then select the log from the left side and individual record (message).  The log record includes the category name, the message class, the message code (type of event), the message text (including a date/time stamp, subject (user) associated with the event, outcome of the event, etc.) and the severity level associated with the message. The previous audit records are overwritten when the allocated space for these records reaches the threshold.

2.      Cryptographic Support

The TOE provides cryptography support for secure communications and protection of information.    The cryptographic services provided by the TOE include: symmetric encryption and decryption using AES; asymmetric key generation; cryptographic key establishment using RSA-based and ECDSA key establishment schemes and DH key establishment; digital signature using RSA and ECDSA; cryptographic hashing using SHA1 (and other sizes); random bit generation using DRBG and keyed-hash message authentication using HMAC-SHA (multiple key sizes). ISE uses the CiscoSSL FIPS Object Module (FOM) Cryptographic Implementation as its cryptographic module. The TOE implements the secure protocols - SSH and TLS/HTTPS on the server side and TLS on the client side. The TOE provides IPsec session capabilities for ISE v3.1 to secure the channel between the TOE and NAS. The TOE leverages the IOS Common Cryptographic Module (IC2M) for IPsec capabilities.

3.      Communications

The TOE has the ability to validate the NAS and prevent it from being spoofed. It receives the transmitted Access-Request and identifies where it’s sent from. The TOE is able to validate the authenticity of the NAS by verifying the Message Authenticator that is computed in part using a shared secret known to both the NAS and the TOE as defined in RFC 3579. It then returns a valid response to the NAS upon receipt of an Access-Request. The response contains the necessary information to the recipient of that message that identifies the TOE as the valid recipient of the original Access-Request and the Access-Request that elicited the response from the TOE.

4.      Identification and Authentication

All users wanting to use TOE services are identified and authenticated prior to being allowed access to any of the services other than the display of the warning banner. Once a user attempts to access the management functionality of the TOE, the TOE prompts the user for a user name and password for remote password-based authentication. The identification and authentication credentials are confirmed against a local user database or an optional remote authentication store (part of the IT Environment). Other authentication options include public key authentication. For remote X.509 certificate-based authentication to the administration application, a remote authentication store is required in order to perform the association of the credentials to an ISE Role Based Access Control role. For the SSH public key authentication method, the public keys configured by the EXEC CLI command "crypto key import" command will be used for signature verification. The user information is from the local user database. In all cases only after the Administrator presents the correct identification and authentication credentials will access to the TOE functionality be granted. The TOE uses X.509v3 certificates as defined by RFC 5280 to support authentication for TLS/HTTPS connections.

The TOE provides the capability to set password minimum length rules.  This is to ensure the use of strong passwords in attempts to protect against brute force attacks.  The TOE also accepts passwords composed of a variety of characters to support complex password composition. During authentication, no indication is given of the characters composing the password.

5.      Security Management

The TOE provides secure administrative services for management of general TOE configuration and the security functionality provided by the TOE. All TOE administration occurs either through a secure session, a terminal server or a local console connection. The TOE provides the ability to perform the following actions:

·       Administer the TOE locally and remotely

·       Configure the access banner

·       Configure the cryptographic services

·       Update the TOE and verify the updates using digital signature capability prior to installing those updates

·       Specify the time limits of session inactivity 

All of these management functions are restricted to the Security Administrator of the TOE, which covers all administrator roles (see table for FMT_SMR.2 in Section 6.1 of Security Target). The Security Administrators of the TOE are individuals who manage specific type of administrative tasks.  The Security Administrators are dependent upon the admin role assigned to them, which limits the network access or tasks they can perform (a role-based access approach).

The primary management interface is the HTTPS Cisco ISE user interface. The Cisco ISE user interface provides an integrated network administration console from which you can manage various identity services. These services include authentication, authorization, posture, guest, profiler, as well as monitoring, troubleshooting, and reporting. All of these services can be managed from a single console window called the Cisco ISE dashboard. The navigation tabs and menus at the top of the window provide point-and-click access to all other administration features. A Command Line Interface (CLI) is also supplied for additional administration functionality like system-level configuration in EXEC mode and other configuration tasks in configuration mode and to generate operational logs for troubleshooting. This interface can be used remotely over SSHv2.

6.      Protection of the TSF

The TOE can terminate inactive sessions after a Security Administrator configurable time-period.  Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session.  The TOE provides protection of TSF data (authentication data and cryptographic keys).  In addition, the TOE internally maintains the date and time. This date and time is used as the time stamp that is applied to TOE generated audit records.  This time can be set manually. The TOE is also capable of ensuring software updates are from a reliable source.  Finally, the TOE performs testing to verify correct operation.

In order for updates to be installed on the TOE, an administrator must use the digital signature mechanism to confirm the integrity of the product.

7.      TOE Access

The TOE can terminate inactive sessions after a Security Administrator configurable time-period. The TOE also allows users to terminate their own interactive session. Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session. 

The TOE can also display a Security Administrator specified banner on the CLI and the web-based management interface prior to allowing any administrative access to the TOE.

8.      Trusted path/channels

The TOE establishes a trusted path between the ISE and the administrative web-based UI using TLS/HTTPS, and between the ISE and the CLI using SSH.  The TOE also establishes a secure connection for sending syslog data to other IT devices using TLS and other external authentication stores using TLS-protected communications.

Vendor Information