The Target of Evaluation (TOE) is AppDetective Pro v5.8.0, hereinafter referred to as AppDetective Pro, as configured in accordance with the supplied guidance documentation.
\r\nAppDetective Pro is a software application that runs in the context of a commercial operating system. AppDetective Pro discovers database applications within an organization’s network infrastructure and scans them for potential vulnerabilities. AppDetective Pro utilizes a library of known vulnerabilities and misconfiguration signatures. AppDetective Pro includes modules for the following database applications:
\r\nAppDetective Pro performs the following operations:
\r\nAppDetective Pro includes a number of built-in Audit and Pen Test Policies that represent useful collections of checks to be performed against targeted database applications. It should be noted the evaluation has not assessed the efficacy of any specific built-in policy or its compliance with any regulatory requirements implied by the policy. Rather, the evaluation has assessed the ability of AppDetective Pro to perform specific types of checks that can detect particular types of vulnerability to which a targeted database may be susceptible. However, the evaluation did not analyze the signatures, templates, and other mechanisms used in the Penetration Test and Audit operations for suitability to task or completeness.
\r\nAppDetective Pro is designed to operate in the context of the following operating systems: Microsoft Windows XP Professional SP2 or greater; Microsoft Windows Server 2003 Standard Edition; Microsoft Windows Server 2003 Enterprise Edition; Microsoft Windows Server 2003 Enterprise; Microsoft Windows Vista (Business, Enterprise and Ultimate editions); and Microsoft Windows 7 (Professional, Enterprise, and Ultimate editions).
\r\nAppDetective Pro can be configured to use Microsoft SQL Server 2000 SP4, Microsoft SQL Server 2005, Microsoft SQL Server 2008, Microsoft SQL Express, or MSDE 2000 as its Backed Database, which is its repository in the IT environment for storing scan data and scan results. This database can be on the same machine as AppDetective Pro, or on a remote machine.
\r\nAdditionally, AppDetective Pro requires the following components in the IT environment (and will install them if not already present at installation time):
\r\nAppDetective Pro relies on the IT environment in which it operates for the following security and other functionality:
\r\nAdditionally, AppDetective Pro relies on its host to facilitate communication with target database applications and operating system products for the purposes of scanning and auditing.
","evaluation_configuration":null,"security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process. The criteria against which the AppDetective Pro v5.8.0 TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 2.3. The evaluation methodology used by the Evaluation Team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 2.3. Science Applications International Corporation (SAIC) determined that the evaluation assurance level (EAL) for the product is the EAL2 family of assurance requirements, augmented with ALC_FLR.2 (Flaw reporting procedures) and AVA_MSU.1 (Examination of guidance). The product satisfies all of the security functional requirements stated in the AppDetective Pro v5.8.0 Security Target, when configured as specified in the supplied guidance documentation.
\r\nA validation team on behalf of the CCEVS Validation Body monitored the evaluation carried out by SAIC. The evaluation was completed in March 2011. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID10257-2011), prepared by CCEVS.
\r\n","environmental_strengths":"
AppDetective Pro v5.8.0 provides a low to moderate level of independently assured security in a conventional TOE and is suitable for a cooperative non-hostile environment with good physical access security and competent administrators.
\r\nAppDetective Pro v5.8.0 supports the following security functions:
\r\nAppDetective Pro can discover database applications within the network infrastructure and assess them for potential vulnerabilities. Without requiring any agents on the target systems, AppDetective Pro can perform audits and simulate attacks against discovered and targeted applications to uncover security vulnerabilities and misconfigurations, and report the results to the authorized administrator.
\r\nAppDetective Pro has the ability to generate audit records for its security-relevant events, including initiation of Discovery, Audit and Pen Test scans. AppDetective Pro records within each audit record at least the following information: Date, Time, Event Type, Success or Failure, and User ID (obtained from the underlying operating system) of the user. AppDetective Pro relies on the IT environment to protect and store the audit records, provide the ability to review the audit records, and to provide a reliable timestamp.
\r\nAppDetective Pro provides a Graphical User Interface and a Command Line Interface for managing its security functions and data. The notion of an authorized administrator role that has full control and privileges to manage AppDetective Pro and its security functions is realized as any user that the IT environment allows to invoke AppDetective Pro. AppDetective Pro relies on the IT environment to perform identification and authentication of the authorized administrator.
","features":[]}