NIAP Oversees Evaluations of Commercial IT Products for Use in National Security Systems

Short Name: pp_esm_icm_v2.1

Technology Type: Enterprise Security Management

CC Version: 3.1

Date: 2013.11.21

Preceded By: pp_esm_icm_v1.0

Conformance Claim: None

Protection Profile 

Control Mapping 

PP OVERVIEW

This protection profile focuses on the aspect of ESM that is responsible for enforcing identity and credential management. Identity and Credential Management products will generate and issue credentials for subjects that reside within the enterprise. They will also maintain the organizational attributes that are associated with these subjects. By providing a means for subjects to validate their identities and determining the relationship these subjects have to the enterprise, an Identity and Credential Management product is able to support enterprise accountability and access control.

The establishment of unique, unambiguous identities is an important foundational capability that enables issuance and management of credentials and authorization attributes. The notion of identity refers to that unique identifier assigned to an individual against which credential and attribute data can be associated.

In order for an individual to be identified as a user within the ESM system, they must be enrolled. Enrollment refers to the act of assigning a unique identifier to a subject, generating and issuing credentials, defining attributes for a user, and propagating that data to any repositories that use it. It is necessary for the TSF to be able to securely transmit this data to those components.

TOEs compliant with this PP are expected to exhibit the following behavior:

• Provisioning of subjects (enroll new subjects to an organizational repository, associate and disassociate subjects with organizationally-defined attributes)
• Issue and maintain credentials associated with user identities
• Publish and change credential status (such as active, suspended, or terminated)
• Establish appropriate trusted channels between itself and compatible Policy Management and Authentication Server ESM products
• Generate an audit trail of configuration changes and subject identification and authentication activities
• Write audit trail data to a trusted repository
• Securely transmit identity and credential attribute data via a trusted channel

This U.S. Government Approved Protection Profile is not assigned to any Validated Products

Active Related Technical Decisions

• 0794 – Correction to FCS_SSH_EXT.1.7 Test 2
  • References:  FCS_SSH_EXT.1.7
• 0621 – Corrections to FCS_TLS_EXT.1 in ESM PPs
  • References:  FCS_TLS_EXT.1
• 0576 – FTP_ITC and FTP_TRP Updated
  • References:  FTP_ITC.1, FTP_TRP.1
• 0574 – Update to FCS_SSH in ESM PPs
  • References:  FCS_SSH_EXT.1
• 0573 – Update to FCS_COP and FCS_CKM in ESM PPs
  • References:  FCS_CKM.1, FCS_COP.1
• 0079 – RBG Cryptographic Transitions per NIST SP 800-131A Revision 1
  • References:  PP_APP_v1.1
• 0066 – Clarification of FAU_STG_EXT.1 Requirement in ESM PPs
• 0055 – Move FTA_TAB.1 to Selection-Based Requirement
• 0042 – Removal of Low-level Crypto Failure Audit from PPs

Archived Related Technical Decisions

• 0575 – Update to FCS_TLS in ESM PPs
• 0541 – Update to cryptographic protocol SFRs in ESM PPs
• 0320 – TLS ciphers in ESM PPs
• 0245 – Updates to FTP_ITC and FTP_TRP for ESM PPs
• 0071 – Use of SHA-512 in ESM PPs