NIAP Oversees Evaluations of Commercial IT Products for Use in National Security Systems

Short Name: pp_base_virtualization_v1.0

Technology Type: Virtualization

CC Version: 3.1

Date: 2016.11.22

Preceded By: pp_sv_v1.1

Succeeded By: pp_base_virtualization_v1.1

Sunset Date: 2021.12.14

Conformance Claim: None

Protection Profile 

PP OVERVIEW

The scope of this Protection Profile (PP) is to describe the security functionality of virtualization technologies in terms of [CC] and to define security functional and assurance requirements for such products. This PP is not complete in itself, but rather provides a set of requirements that are common to the Extended Packages (EP) for Server Virtualization and for Client Virtualization. These capabilities have been broken out into this generic ‘base’ PP due to the high degree of similarity between the two product types.

Due to the increasing prevalence of virtualization technology in enterprise computing environments, it is essential to ensure that this technology is implemented securely in order to mitigate the risk introduced by sharing multiple computers and their data across a single physical system.   

Assigned to the following Validated Products

• IBM z/VM Version 7 Release 2 for VPP
• Oracle Linux 7.6 UEK 5 KVM & Virtualization Manager 4.3

Archived Related Technical Decisions

• 0617 – TLSC wildcard testing
• 0605 – Updates to Certificate Revocation (FIA_X509_EXT.1) for Base Virtualization PP v1.1
• 0567 – Security Objectives Rationale, SFR Rationale, and Implicitly Satisfied SFRs
• 0526 – Updates to Certificate Revocation (FIA_X509_EXT.1)
• 0443 – FPT_VDP_EXT.1 Clarification for Assurance Activity
• 0433 – Assurance activity for FIA_X509_EXT.1.2
• 0432 – Corrections to FIA_AFL_EXT.1
• 0431 – Modification to Cipher Suites for TLS
• 0403 – Conditional Testing with TLS Session IDs
• 0363 – Access Banner and applicability to programmatic interfaces
• 0360 – AD Server configuration in FMT_MOF_EXT.1
• 0265 – Audit of TLS and HTTPS Session Terminations
• 0264 – Clarification of Auditable Events for FPT_RDM_EXT.1
• 0252 – Inaccurate statement in application note of FCS_TLSC_EXT.2.4
• 0250 – Hypercall Controls - FPT_HCL_EXT.1 Clarification
• 0249 – Applicability of FTP_ITC_EXT.1
• 0247 – FPT_VDP_EXT.1 Clarification for Assurance Activity
• 0230 – ALC Assurance Activities for Server Virtualization and Base Virtualization PPs
• 0213 – Corrections to App Note references to FCS_TLS, FCS_IPSEC, and FTP_ITC
• 0206 – Testing for Non-Existence of Disconnected Virtual Devices
• 0166 – Optional Authentication of TLS Client
• 0139 – Clarification of testing for FDP_RIP_EXT.2