The Target of Evaluation (TOE) is WhatsUp Gold Premium with Plug-Ins Version 16.1.99 from Ipswitch, Inc (hereinafter referred to generally as WhatsUp Gold). It provides capabilities to discover devices on a network, monitor discovered devices, and execute actions on device state changes[1], enabling the network administrator to identify and act on network failures. Changes that cross configured thresholds can generate alerts, notifying the network administrator of device issues. Additionally, WhatsUp Gold can discover and monitor applications running on devices on the network.
\r\nThe TOE includes only the following plug-ins[2] that extend the monitoring and reporting capabilities of the base product:
\r\nThe TOE also includes WhatsUp Gold Failover Manager, an application that provides user-configurable criteria to determine if WhatsUp Gold is in a failed state. The administrative user can choose to have the primary system go down if all services are disabled, or if any specified service is disabled.
\r\n\r\n
[1] The efficacy of these actions has not been subject to evaluation.
\r\n[2] Note that not all available WUG plug-ins are covered by the evaluation, and for included plugins, not all capabilities are covered. Please refer to the Security Target for specifics of what is covered and excluded.
","evaluation_configuration":null,"security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process. The criteria against which the WhatsUp Gold Premium Version 16.1.99 TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 3. The evaluation methodology used by the Evaluation Team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1, Revision 3. Leidos determined that the evaluation assurance level (EAL) for the product is the EAL2 assurance requirements package, augmented with ALC_FLR.1 (Basic Flaw Remediation). The product satisfies all of the security functional requirements stated in the WhatsUp Gold Premium Version 16.1.99 Security Target, when configured as specified in the evaluated guidance documentation.
\r\nA validation team on behalf of the CCEVS Validation Body monitored the evaluation carried out by Leidos. The evaluation was completed in January 2014. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID10487-2014), prepared by CCEVS.
","environmental_strengths":"The WhatsUp Gold Premium with Plug-Ins Version 16.1.99 TOE claims conformance to EAL2 augmented with ALC_FLR.1. EAL2 was selected as the assurance level because the TOE is a commercial product whose users require a low to moderate level of independently assured security. The TOE is targeted at an environment with good physical access security where it is assumed that attackers will have low attack potential. Augmentation was chosen to provide the added assurance that is provided by defining flaw remediation procedures.
\r\nWhatsUp Gold Premium with Plug-Ins Version 16.1.99 supports the following security functions:
\r\nSecurity Audit
\r\nThe TOE generates audit records when Authorized Users logon to and logoff from the TOE via its web interface, and many of the activities performed by Authorized Users via the web interface. The audit records include the identity of the Authorized User performing the auditable action, the action performed by the Authorized User, and the date and time the audit record was generated. The TOE relies on its operational environment to provide a reliable time stamp for inclusion in the audit record. The TOE provides a means for Authorized Users with appropriate user rights to view the contents of the audit log. Generated audit records are stored in the TOE’s database maintained in the operational environment.
\r\nIdentification and Authentication
\r\nThe TOE requires Authorized Users (who access the TOE via its web GUI) to be identified and authenticated before accessing any TOE functionality. In addition, the TOE supports external authentication using an LDAP or Active Directory server. Once logged on, Authorized Users are granted user rights that control their access to managed objects and determine what management actions they can perform. Users logged on to the TOE via the web interface have the capability to terminate their own interactive session.
\r\nCryptographic Support
\r\nThe TOE includes the FIPS 140-2 validated version of the OpenSSL FIPS Object Module by Open Source Software Institute (OpenSSL version 0.9.8r, FIPS 140-2 certificate 1051) to provide cryptographic functions to support: SSHv2 sessions between the TOE and network devices; SNMPv3 communications between the TOE and network devices; TLSv1.0 communications between the TOE and an external authentication server; and secure storage of authentication credentials in the operational environment.
\r\nThe TOE also relies on cryptographic capabilities provided by the operational environment. The TOE relies on the underlying operating system and web server for provision of HTTPS, which is required for Authorized Users to access the web interface of the TOE. The TOE also relies on .NET WCF in the operational environment to protect communications between WhatsUp Gold primary and secondary servers and between WhatsUp Gold server and remote pollers, using TLS.
\r\nUser Data Protection
\r\nThe TOE controls access by Authorized Users to the following controlled objects: device objects (the virtual representation of devices in the TOE); device groups; flow sources; flow monitors; monitor libraries; task library, task script library; action library; recurring action library; action policy library; dashboard views; dashboard reports; application profiles; and application instances. The TOE makes its access control decisions based on configured device group access rights, flow source access rights, and assigned user rights. Device group access rights are used to define access controls on devices and device groups. The access control policy does not apply to virtual devices accessed via the Virtual Map. Flow sources access controls are used to define access controls to flow sources. Assigned user rights are used to define access controls to all controlled objects, except flow sources.
\r\nSecurity Management
\r\nThe TOE provides capabilities to manage the TOE’s features and security functions. The capabilities available to Authorized Users (defined as users who logon to the TOE via its web GUI, and who are identified and authenticated in the process) are restricted based on assigned user rights and configured device group access rights.
\r\nFault Tolerance
\r\nThe TOE provides the capability, through the WhatsUp Gold Failover Manager application, to determine if the TOE has entered a failed state and to subsequently recover the TOE to a fully operational state. The TOE can be configured to provide failover in the event all its services are disabled, or if any specified services are disabled. Use of failover in the evaluated configuration is optional.
\r\nNetwork Monitoring
\r\nThe TOE provides the capabilities to discover network devices and applications, monitor the status of network devices and applications, generate alerts about the status of monitored network devices and applications, and perform actions in response to changes in the status of monitored network devices and applications.
\r\nIn order for the Network Monitoring function to operate effectively, network devices must respond to ICMP echo request packets (“ping” packets) or open TCP port requests (in order to be discovered by the TOE), network devices must be configured to respond to SNMP or WMI requests (in order for the TOE to be able to collect device information), and virtual network devices must be configured to respond to VMware vSphere API requests (in order for the TOE to be able to collect device information from them).
\r\nThe TOE relies on its operational environment for secure storage of scanning information, and the performance of device actions and alerts.
","features":[]}