Content Manager is a data management system (content management system) that provides a foundation for managing, accessing, and integrating critical business information on demand. Content Manager is able to integrate many forms of data — document, Web, image, rich media — across diverse business processes and applications, including Siebel, PeopleSoft, and SAP, presenting the data in an integrated context for later use.
\r\nThe components of Content Manager include a Library Server; one or more Resource Managers, the Content Manager 8.4 Connector Application Programming Interfaces (APIs); the System Administration Client; and the Client for Windows.
\r\nThe Library Server is the key component of the Content Manager system. The Library Server resides on a DB2 Enterprise Server database environment. The Library Server manages the content metadata and is responsible for identification and authentication for non-administrative users and identification for administrative users requesting services from Content Manager and access control to the resources residing on Resource Managers.
\r\nThe Resource Manager stores resources for Content Manager. It can be on the same server as the Library Server, or it can be on its own computer. Resource Managers can be distributed across networks to provide convenient user access. Users store and retrieve digital resources on the Resource Manager by routing requests through the Library Server.
\r\nThe Content Manager 8.4 Connector APIs (used by WebSphere Application Server applications, the System Administration Client, and Clint for Windows) include a set of object-oriented APIs. The APIs allow applications and users to access the Library Server and Resource Manager(s).
\r\nThe System Administration Client oversees the entire Content Manager system. From the System Administration Client, an administrator performs various administrative functions, such as defining the data model, creating users and defining their access to the system and specific objects, and managing storage and storage objects in the system. The System Administration Client can be installed on any workstation with the other components or on its own workstation. The Client for Windows provides an interface that enables an application to import documents into Content Manager, view them, work with them, store them, and retrieve them
","evaluation_configuration":null,"security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the IBM® DB2® Content Manager Enterprise Edition V8.4 Fix Pack 1A TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 2.3. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 2.3. Science Applications International Corporation (SAIC) determined that the evaluation assurance level (EAL) for the product is EAL 4 augmented with ALC_FLR.2 family of assurance requirements. The product, when configured as specified in the IBM DB2 Content Manager Enterprise Edition Version 8 Release 4 Planning and Installing Your Content Management System and the IBM DB2 Content Manager Enterprise Edition System Administration Guide Version 8 Release 4, satisfies all of the security functional requirements stated in the IBM® DB2® Content Manager Enterprise Edition V8.4 Fix Pack 1A Security Target, Version 1.0. Two Validators on behalf of the CCEVS Validation Body monitored the evaluation carried out by SAIC. The evaluation was completed in November 2008. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report, (report number CCEVS-VR-VID10220-2009, dated 27 January 2009) prepared by CCEVS.
","environmental_strengths":"The TOE is a commercial product whose users require a low to moderate level of independently assured security. IBM® DB2® Content Manager Enterprise Edition V8.4 Fix Pack 1A is targeted at a relatively benign environment with good physical access security and competent administrators. Within such environments, it is assumed that attackers will have little attack potential. The security environment also assumes that the TOE components are physically protected.
\r\nIBM® DB2® Content Manager Enterprise Edition V8.4 Fix Pack 1A supports the following five security functions:
\r\nSecurity Audit
\r\nAll security-related events within Content Manager are logged. These are tied to the user/administrator that performed the action, the action performed, and the time it was performed. These audit records are stored in a central location in the IT Environment. The Client for Windows provides an interface for users to view audit records of events associated with a TOE resource.
\r\nUser Data Protection
\r\nAccess to the TOE’s resources is governed by the resource’s Access Control List (ACL), which identifies the user and the access allowed. The TOE uses privileges to define what operations a user is allowed to perform on the resources. The Library Server verifies that the user has the required privilege and the ACL associated to the requested object grants access.
\r\nIdentification and Authentication
\r\nContent Manager identifies and authenticates non-administrative users before any other actions can be performed. The non-administrative user is required to provide a user name and password, which will be verified by the Library Server database table. If the verification is successful, access into the TOE is granted.
\r\nSecurity Management
\r\nThe System Administration Client provides the authorized administrator the capability to manage the security-related functions and attributes, such as the audit function, management of users and their associated data.
\r\nProtection of the TSF
\r\nContent Manager provides the mechanism used to enforce the access control policy ensuring that only authorized users are given access to the resources.
","features":[]}