The TOE is an intrusion detection system consisting of a sensor, scanner, and analyzer to monitor IT systems for activity that may indicate inappropriate activity on the IT system. The TOE is an attribute change assessment product that also reconciles the changes against existing management systems and policies. The TOE provides three main capabilities: File Integrity Monitor, Compliance Policy Manager, Remediation Manager.
\r\nThe TOE consists of a server application component (Tripwire Enterprise Server), a client application component (Tripwire Enterprise Agent), and a client administrative console application component (Tripwire CLI). The product requires a database application to support the product’s storage needs (MySQL is bundled with TE v8). The product supports two different installation configurations and both are allowed in the evaluated configuration. With a single-system installation, the Tripwire Enterprise Server and database are installed on the same system. With a distributed installation, Tripwire Enterprise Server and database are installed on different systems. In the CC evaluated configuration, the Tripwire Enterprise Server must be configured to encrypt all communications between the Tripwire Enterprise Server and the database, or the database must reside on the same system as the Tripwire Enterprise server, or the database must reside on a system located on a private physical network that is not globally routable and is protected from attacks and from unauthorized physical access.
\r\nThere are two different cryptographic implementations used by the TOE. The TOE includes the FIPS-evaluated Tripwire Cryptographic Module (TCM) which is used to implement TLS to protect communications between distributed parts of the TOE. In the evaluated configuration, the TOE must be configured in the FIPS approved mode of operation. The TOE relies upon the JVM TLS implementation in the operational environment to protect communications between the TOE and the remote IT entities (e.g., the database, user’s browser, and user’s shell). The JVM is not FIPS compliant.
\r\nThe TOE includes web server functionality that supports HTTPS (HTTP over SSL) connections from a web browser to the TOE’s GUI and CLI. The Tripwire Enterprise Server, being a Java application, utilizes the TLS mechanism provided by the JVM in the operational environment as part of the HTTPS communication with the GUI and the CLI. The JVM is configured to use TLS for communications with the TOE. In the evaluated configuration, physical protection is assumed for all parts of the TOE and for remotely monitored nodes.
\r\nThe TOE also uses RMI (Remote Method Invocation) over mutually authenticated TLS v1 network connections to protect intra-TOE communication between TE Server and the TE Agents over an untrusted network.
","evaluation_configuration":null,"security_evaluation_summary":"The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 3. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 Revision 3. Science Application International Corporation (SAIC) determined that the evaluation assurance level (EAL) for the TOE is EAL 2 augmented with ALC_FLR.2. The TOE, configured as specified in the evaluated configuration guide, satisfies all of the security functional requirements stated in the Security Target and in the Intrusion Detection System System Protection Profile (IDSSYPP), Version 1.7, July 25, 2007. Validators on behalf of the CCEVS Validation Body monitored the evaluation carried out by SAIC. The evaluation was completed in June 2012. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report for Tripwire Enterprise, Version 8.1 prepared by CCEVS.
","environmental_strengths":"The Tripwire Enterprise is a commercial IT change audit assessment product that provides change audit, configuration assessment, audit, user data protection, security management, authentication and identification, and protection of the security functions features.
\r\n","features":[]}