The TOE is a multi-function device (MFD) that copies, prints, scans and faxes. The MFD contains an internal hard disk drive. Standard security functions include SSL, IPSec, SNMPv3, a host-based firewall, and an internal audit log. Users may be authenticated to the network or locally at the device. The evaluated configuration includes the Image Overwrite Security package. The Image Overwrite Security package causes any temporary image files to be erased from the internal hard disk drive when those files are no longer needed or on demand at the discretion of the system administrator.
","evaluation_configuration":"","security_evaluation_summary":"The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The evaluation demonstrated that the product meets the security requirements contained in the Security Target. The criteria against which the Xerox WorkCentre™ 5735/5740/5745/5755/5765/5775/5790 were judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 2. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1, Revision 2. Computer Sciences Corporation determined that the evaluation assurance level (EAL) for the product is EAL 2+. The product satisfies all of the security functional requirements stated in the Security Target. Two validators, on behalf of the CCEVS Validation Body, monitored the evaluation carried out by Computer Sciences Corporation. The evaluation was completed in June 2012. Results of the evaluation can be found in the Evaluation Technical Report for a Target of Evaluation for Xerox WorkCentre™ 5735/5740/5745/5755/5765/5775/5790 prepared by Computer Sciences Corporation.
","environmental_strengths":"The TOE provides the following security features:
\r\nCommunications Security
\r\nThe TOE provides secure communications over the SSL, IPSec, and SNMPv3 protocols. Remote management of the device is secured from the Web User Interface using HTTPS/SSL. Alternatively secure remote management is provided using a manager that supports SNMPv3. Secure scanning to a repository is provided using HTTPS/SSL. Secure printing is provided by using IPSec.
\r\nDisk Encryption
\r\nAES data encryption is used to protect all areas of the hard drive where user jobs are temporarily stored for processing.
\r\nImage Overwrite
\r\nThe TOE can be configured to automatically overwrite files created during job processing. The TOE also has an on-demand function that overwrites the hard drive(s) on-demand of the system administrator. Contents stored on the hard disk are overwritten using a three pass overwrite procedure as described in DOD 5800.28-M.
\r\nAuthentication
\r\nA user must authenticate prior to being granted access to the Local User Interface or the Web User Interface. Upon successful authentication, users are granted access based on their role and predefined privileges. The system administrator can configure session timeouts to terminate an inactive session after some period of time. TOE supports password and usernames, smart card authentication, LDAP v4, Kerberos v5 (Solaris) and Kerberos v5 (Windows 2000/2003).
\r\nSecurity Audit
\r\nThe TOE generates audit logs that track events/actions (e.g., copy/print/scan/fax job completion) to identified users.
\r\nIP Filtering
\r\nThe TOE provides the ability for the system administrator to configure IPv4 filtering rules.
\r\nFax / Network Separation
\r\nThe TOE ensures separation between the optional fax processing board and the network controller. This architecture ensures that a malicious user cannot access network resources from the telephone line via the system’s optional fax modem.
\r\nSecurity Management
\r\nThe TOE restricts access to management functions and is capable of performing self-tests to verify integrity.
","features":[]}