Maintenance Release(s): The “IMr12.5CommonCriteriaPatch” was applied to the product for this evaluation.
\r\nPRODUCT DESCRIPTION
\r\nThis Security Target (ST) defines the Information Technology (IT) security requirements for the CA Identity Manager. CA Identity Manager (IM) is an integrated identity management platform that automates the creation, modification, suspension or deletion of user identities and their access to enterprise resources. Through these functions, Identity Manager manages diverse user populations on a range of enterprise systems, from mainframes to web applications over a single tool. Identity Manager also provides TOE users with the functionality to manage and delegate Password Management, Provisioning/Deprovisioning, and Identity Administration to the level deemed necessary
","evaluation_configuration":"The TOE was evaluated on the following platforms:
\r\nIdentity Manager running on Window Server 2003 SP2, Windows Server 2003 R2 SP2, Windows Server 2008 (32 bits)
\r\n\r\n
Identity Manager running on Solaris 9, Solaris 10
\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) processes and procedures. CA Identity Manager r12.5 software was evaluated against the criteria contained in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 3. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 Revision 3. It has been determined that the product meets the security criteria in the Security Target, which specifies an assurance level of EAL3 augmented with ALC_FLR.1 and ASE_TSS.2. ). Validators, on behalf of the CCEVS Validation Body, monitored the evaluation. The evaluation was completed in July 2010.
","environmental_strengths":"Security Management
\r\nSecurity Management is handled by TOE users with the appropriate privileges as defined by their role. Management can be performed via the User Console or via a SOAP application over the Task Execution Web Services (TEWS) interface. The TEWS interface is expected to only be used by a user that has been assigned all privileges of the TOE. The TOE allows for actions such as management of users, creation of workflows, and the provisioning of endpoints.
\r\nIdentification and Authentication
\r\nThe TOE provides identification and authentication of users via its User Console interface. Identification and authentication is normally performed utilizing username and password, but can also be performed with other attributes. This is most apparent with the ability to self register to the TOE. The TOE will also enforce a password policy defined by its users with the appropriate privileges as defined by their role. The TOE will only identify a user via the Task Execution Web Services (TEWS) interface, which is required to be protected by a third party application that provides identification and authentication.
\r\nSecurity Audit
\r\nThe TOE generates audit records for selected security events. Events are tracked based on occurrence and who triggered them. Audit data is written to an environmental database which Identity Manager is connected to during configuration. The TOE does not provide the ability to provide the audit records for review, so anyone who wishes to review the audit data must have the associated privileges on the database.
\r\nCryptographic Support
\r\nThe TOE creates 256-bit AES keys to encrypt and decrypt utilizing the AES algorithm for user sessions, directory or environment export, user passwords, and database fields marked as requiring encrypt on write.
\r\nUser Data Protection
\r\nThe TOE utilizes Role-Based Access Control (RBAC) to authorize TOE users access to various functions based on that individual’s admin role. Whether or not a TOE user is assigned to an admin role is governed by one or more policies for that role.
","features":[]}