Tivoli Security Operations Manager (TSOM) supports the following security functions: Audit, Identification and Authentication, User Data Protection, Security Management, Protection of the TSF, IDS.
\r\n\r\n
TSOM is a security event management software solution designed to provide a comprehensive and coherent view of enterprise security. TSOM correlates event data from disparate machines outside TSOM, called sensors. Sensors are third-party products such as firewalls, intrusion detection systems, computer systems, and routers. Once data is correlated from sensors, TSOM analyzes the data to uncover legitimate threats to the enterprise.
\r\nUser activity on TSOM is audited and stored in the underlying database in the IT environment of the TSOM. Audit information may be accessed through the User Interface. Access to audit information is restricted to authorized administrators.
\r\n\r\n
User identification and authentication is required to access the user interface of TSOM. The user is always prompted for user name and password credentials before accessing the system. The user login process performs authentication as well as providing system privileges that are defined on a per-user or per-role basis. Access to the User Interface is allowed through support for HTTP using Internet Explorer 5.5 or greater. Transmission security is maintained by using HTTPS (SSL) between the end user and the Web-based Console Manager (otherwise referred to as “the system”). TSOM includes a FIPS validated module (certificate #409) to implement SSL.
\r\nTSOM enforces an access control policy which defines the objects that an authorized user of TSOM will have permission to manage and configure. These objects includes security domains, rules that can be defined within TSOM, hosts, networks, events, tickets, and firewall rules.
\r\nTSOM is designed to provide threat management for security incidents, which require handling many-to-one relationships. The Central Management System (CMS) in turn correlates the data, determines the threat and presents the relevant information to the authorized user through a GUI interface. TSOM provides the user interface utilized by the authorized administrator to manage the security and network event data collection functions and attributes.
\r\nTSOM provides various mechanisms to ensure that the access control policy is always enforced and the data transmitted between TSOM components is protected using the cryptographic functionality from an included FIPS validated module (certificate #409) Additionally, TSOM ensures that all TSF data is made available to distributed parts of TSOM.
","evaluation_configuration":"TSOM must be installed and configured according to the following guidance documents
\r\n\r\n
Tivoli Security Operations Manager Version 4.1.1 Installation Guide, July 2008
\r\nTivoli Security Operations Manager Common Criteria Guide Version 4.1.1
\r\nThe IBM TSOM TOE is supported by hardware and software in the IT environment. The IT Environment of the TOE consists of the following:
\r\n\r\n
\r\n
\r\n
\r\n
\r\n
","security_evaluation_summary":"
\r\n The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 2.3. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 2.3. Science Application International Corporation (SAIC) determined that the evaluation assurance level (EAL) for Tivoli Security Operations Manager 4.1.1 achieved EAL3. The TOE, configured as specified in the installation guide, satisfies all of the security functional requirements stated in the Security Target. Several validators on behalf of the CCEVS Validation Body monitored the evaluation carried out by SAIC. The evaluation was completed in September 2008. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report IBM Tivoli Security Operations Manager 4.1.1 prepared by CCEVS.
The IBM Tivoli Security Operations Manager TOE is a commercial product that supports Audit, Identification and Authentication, User Data Protection, Security Management, and Protection of the TOE security functions. The IBM Tivoli Security Operations Manager TOE provides a level of protection that is appropriate for IT environments where the TOE and the platform upon which is installed can be appropriately protected from physical attacks.
","features":[]}