The Target of Evaluation (TOE) is Check Point Endpoint Security E80.30 (build 8.1.327) product with the following software blades: Full Disk Encryption Blade; Media Encryption & Port Protection Blade; Firewall & Application Control Blade; Compliance Blade; and VPN Blade. The Check Point WebCheck Blade and the Check Point Anti-malware blades are excluded from the evaluated configuration and are not to be used.
\r\nCheck Point Endpoint Security is a workstation security software product that is installed on user desktop and laptop hosts in an enterprise setting. Supported operating systems include: Windows 7 Enterprise, Professional, Ultimate editions (32-bit and 64-bit).
\r\nThe product provides pre-boot user authentication, cryptographic protection for data stored on hard disks and removable media, enforces defined security policies on all host I/O interfaces (USB, serial, etc.), and provides information flow control for network traffic entering and departing the host. In addition, the product can be configured to invoke third-party components installed on the host that perform malware scanning and analysis.
\r\nCheck Point Endpoint Security can be used to enforce corporate security compliance policies. The client analyzes the host’s compliance status (e.g. patch levels, anti-virus updates, etc.) and can be configured to prevent a non-compliant workstation from gaining access to network resources.
\r\nA remote access client virtual private networking (VPN) capability (using the included Endpoint Connect VPN client) supports establishment of a secure channel between the Check Point Endpoint Security client and a Check Point Security gateway, using the IKE/IPSec security protocols.
","evaluation_configuration":"","security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process. The criteria against which the Check Point Endpoint Security E80.30 (build 8.1.327) TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 3. The evaluation methodology used by the Evaluation Team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1, Revision 3. Leidos Corporation determined that the evaluation assurance level (EAL) for the product is the EAL2 assurance requirements package, augmented with ALC_FLR.3 (Flaw reporting procedures). The product satisfies all of the security functional requirements stated in the Check Point Endpoint Security E80.30 Security Target, when configured as specified in the evaluated guidance documentation.
\r\nA validation team on behalf of the CCEVS Validation Body monitored the evaluation carried out by Leidos. The evaluation was completed in December 2013. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID10343-2013), prepared by CCEVS.
","environmental_strengths":"Check Point Endpoint Security E80.30 (build 8.1.327) provides a low to moderate level of independently assured security in a conventional TOE and is suitable for a relatively benign environment with good physical access security and competent administrators.
\r\nCheck Point Endpoint Security E80.30 (build 8.1.327) supports the following security functions:
\r\nSecurity Audit
\r\nSecurity-relevant events from all Check Point Endpoint Security suite components (except for VPN) can be logged in the local audit trail. This audit trail is also transmitted to an external central administrative location where they are stored and can be viewed by remote authorized administrators. Local audit review does not satisfy Common Criteria audit requirements; therefore, the local review of audit data was not evaluated and was not tested..
\r\nSecurity Management (Trusted path/channels)
\r\nCheck Point Endpoint Security provides a management application that allows the local user to access and modify product security settings for all Check Point Endpoint Security suite components, and to review the audit trail. Remote users are authenticated by their certificates in the context of the establishment of the IKE or TLS secure channel.
\r\nIn addition, Check Point Endpoint Security provides interfaces for remote users to perform management operations from remote management servers (outside of the TOE) after being identified and authenticated by Check Point Endpoint Security. Audit log records are sent to the remote host, and security policy settings downloaded from the management server update the locally-defined policy.
\r\nBlade Security:
\r\nFull Disk Encryption (FDE):
\r\nFull Disk Encryption (FDE) encrypts the entire hard disk, including all operating system and user areas. Because encryption is performed on a sector by sector basis instead of on the basis of file and directory encryption, all disk contents are protected, including, in addition to normal data files, system files, swap files, temporary files, deleted files, and unused space. This ensures that an unauthorized user that gains physical access to the disk (e.g. in the case of a stolen laptop) cannot access or modify any information.
\r\nUsers are authenticated by the Pre-Boot Environment, using fixed passwords or smart cards. In addition, a remote help feature allows the user to receive a one-time password that allows the user to login in the case of mislaid authentication credentials, as well as changing a fixed password that has been forgotten. The Pre-Boot Environment maintains an authentication failure counter. When the administrator-configurable threshold is exceeded, the TOE marks the user’s account record as locked, so that further login attempts to this account are denied until the account is unlocked by an authorized administrator or until a preset time interval has passed.
\r\nOnce authenticated, Check Point Endpoint Security boots up the operating system normally, installing a kernel driver that decrypts disk contents on the fly, transparently to the user, as well as transparently encrypting any updated disk sectors. Encryption is performed using encryption keys that are derived from user credentials. This ensures that Full Disk Encryption is maintained at all times, even when the workstation powers down unexpectedly. It also obviates the need to do a full disk overwrite on discarded disks – the data on the disk is unreadable without the user credentials.
\r\nFIPS 140-2 validated cryptography (FIPS 140-2 certificate #770) is used for Full Disk Encryption, using either 256-bit AES or Triple DES as encryption algorithms.
\r\nEncryption Policy Manager (EPM):
\r\nThe Encryption Policy Manager (EPM) provides a configurable Removable Media Encryption capability that extends cryptographic protection to removable media devices. When a removable media device is inserted into a protected workstation, Check Point Endpoint Security can be configured to restrict access only to an encrypted storage area on the device, or conversely to allow only read-only access to prevent information from leaking onto an insecure device.
\r\nThe Device Encryption Key (DEK) is generated randomly and stored in encrypted form, wrapped by a Key Encryption Key (KEK) that is generated and stored on the management server (outside the TOE), or stored on the media encrypted in a password-based encryption format with a user-entered password, for supporting offline access to the data when the management server is not available. Encryption and decryption are performed transparently when data is written to or read from the removable device. FIPS 140-2 validated 256-bit AES (FIPS 140-2 certificate #784) is used for data encryption.
\r\nCheck Point Endpoint Security can also be configured to encrypt information written to CD and DVD removable media, when using the operating system’s built-in CD/DVD writing software.
\r\nDevice Manager:
\r\nDevice Manager controls user access to devices connected to various ports on the workstation, including USB, COM, LPT, PCMCIA, IrDA, Firewire and Bluetooth ports, as well as other devices such as modems, network adaptors, storage devices, etc.
\r\nThe administrator can determine for each device whether access is enabled for full access (Read/Write), disabled or set to Read-Only, and for removable media and removable media devices, whether the workstation may execute programs from the removable media.
\r\nRemovable Media Manager:
\r\nUnauthorized media inserted into a protected workstation may contain malware that might infect the workstation. Check Point Endpoint Security can be configured to reject access to unauthorized removable media devices and floppy disks, or to invoke a content scanner installed on the workstation (outside of the TOE, e.g. anti-virus software) to authorize the device.
\r\nCheck Point Endpoint Security stores a computed permutational hash on the device that represents the data written to the device from authorized Check Point Endpoint Security workstations. When a removable media device or floppy disk is inserted into a protected workstation that does not contain a hash, the Removable Media Manager concludes that this is the first time that the media is imported into Check Point Endpoint Security. When the hash on the device does not match the media contents, it has been modified on an external workstation. In either case, the media requires re-authorization for access to be allowed.
\r\nFirewall:
\r\nCheck Point Endpoint Security implements information flow control rules representing a Personal Firewall Policy that mediates all inbound and outbound network traffic from the protected workstation. Traffic can be allowed or blocked based on source and destination addresses, protocols and ports.
\r\nApplication Control:
\r\nIn addition to the information flow control defined by Firewall Rules, Check Point Endpoint Security implements network access control for programs on the workstation.
\r\nEach program can be allowed or blocked from establishing network connections, on the basis of the presumed identity of the peer host (trusted or otherwise), on the basis of whether the program is initiating the connection or listening for one (acting as a server), and the requested protocols and ports. Programs that violate the Application Control rules may also be automatically terminated. Programs are authenticated on execution and when attempting to connect to network resources by calculating a MD5 hash of the program’s components and comparing it to the hash stored in the program list.
\r\nThis feature can provide mitigation for Trojans and spyware that attempt to connect to malicious servers. It can also mitigate viruses that attempt to modify programs on the workstation. Application Control will detect a new or modified program and will prevent it from accessing the network.
\r\nThe application control blade also provides the capability to invoke third-party anti-virus software. The vendor has tested TOE invocation of the following third party anti-virus (AV) software: McAfee VirusScan and Kaspersky Antivirus. Invocation of other anti-virus products were not covered by this evaluation; Check Point’s support website provides solution id sk68080 which provides a current list of supported AntiVirus products. New releases are supported through the Flaw Remediation process. Due to the dynamic nature of AV products TOE users should contact Check Point Support for integration of new AV versions into the TOE. The anti-virus engines themselves are in the operational environment, and thus outside the TOE boundary.
\r\nProgram Advisor:
\r\nSmart Defense Program Advisor is a Check Point service that provides recommendations for Application Control. It can be used to reduce administrative workload by incorporating recommendations from Check Point security professionals about which permissions to assign to common programs.
\r\nCustomers download Program Advisor recommendations from Check Point into the management server, and may choose to either accept these permission settings or override them with custom settings. This interaction is entirely outside the TOE boundary.
\r\nEnforcement Rules (Protection of the TSF):
\r\nCheck Point Endpoint Security can be configured to monitor the protected workstation for compliance with policy restrictions defined as Enforcement Rules. Enforcement Rules may require a certain anti-virus application to be active, a minimum version of the Check Point Endpoint Security client itself, or the presence or absence of defined registry keys, files, or programs indicating the presence or absence, respectively of a security-relevant component on the workstation.
\r\nWhen an Enforcement Rule is found to be in non-compliance, the user or administrator may receive a notification, or the workstation may be restricted from accessing the network and/or other defined I/O devices, except for a defined “sandbox” area from which the user may download remediation resources.
\r\nVPN Client (Trusted path/channels):
\r\nCheck Point Endpoint Security can be configured to establish VPN trusted channels to Check Point gateway products, using the IKE/IPSec protocols. The gateways’ Encryption Domain (the set of addresses located behind the gateways) is downloaded from the gateway after it is authenticated by its public key certificate. Once the trusted channel is connected, all traffic to and from the gateway’s Encryption Domain is protected from disclosure and modification while traversing the network. The client can also be configured to route all traffic through the VPN tunnel to the gateway (Hub Mode), so that all traffic is filtered by the gateway. The Endpoint Connect VPN client is the one included in the TOE.
","features":[]}