{"product_id":10529,"v_id":10529,"product_name":"Windows 8, Windows RT, Windows Server 2012 IPsec VPN Client","certification_status":"Not Certified","certification_date":"2013-05-30T00:00:00Z","tech_type":"Virtual Private Network","vendor_id":{"name":"Microsoft Corporation","website":"https://www.microsoft.com"},"vendor_poc":"Mike Grimm","vendor_phone":"425-703-5683","vendor_email":"mgrimm@microsoft.com","assigned_lab":{"cctl_name":"Leidos Common Criteria Testing Laboratory"},"product_description":"<p>The Target of Evaluation (TOE) is the IPsec client and dependent functionality from the following Windows operating systems that is necessary to comply with the requirements of the Protection Profile for IPsec Virtual Private Network (VPN) Clients, as expressed in the Microsoft Windows 8, Microsoft Windows RT, Microsoft Windows Server 2012 IPsec VPN Client Security Target:</p>\r\n<ul>\r\n<li>Microsoft Windows 8 Edition (32-bit and 64-bit versions)</li>\r\n<li>Microsoft Windows 8 Pro Edition (32-bit and 64-bit versions)</li>\r\n<li>Microsoft Windows 8 Enterprise Edition (32-bit and 64-bit versions)</li>\r\n<li>Microsoft Windows RT</li>\r\n<li>Microsoft Windows Server 2012 Standard Edition </li>\r\n<li>Microsoft Windows Server 2012 Datacenter Edition.</li>\r\n</ul>\r\n<p>All critical security updates published as of February 2013 must be applied to the above products for the evaluated configuration.</p>\r\n<p>Evaluation testing took place on the following hardware platforms:</p>\r\n<ul>\r\n<li>Microsoft Surface RT</li>\r\n<li>Microsoft Surface Pro</li>\r\n<li>ASUS VivoTab RT</li>\r\n<li>Dell XPS 10</li>\r\n<li>Dell OptiPlex 755, 3.0 GHz Intel Core 2 Duo E8400, 64-bit.</li>\r\n</ul>\r\n<p>There are two mechanisms that invoke the IPsec VPN Client, all of which were tested as part of the evaluation: the Remote Access Service (RAS) VPN interface and the underlying (raw) IPsec interface.</p>","evaluation_configuration":"","security_evaluation_summary":"<p>The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Windows IPsec VPN Client was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1, Revision 4. Science Applications International Corporation (SAIC) determined that the TOE satisfies the requirements specified in the Protection Profile for IPsec Virtual Private Network (VPN) Clients, Version 1.1,30 December 2012.&nbsp; The product, when delivered and configured as identified in the Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria Supplemental Admin Guidance for IPsec VPN Clients, satisfies all of the security functional requirements stated in the Microsoft Windows 8, Microsoft Windows RT, Microsoft Windows Server 2012 IPsec VPN Client Security Target, Version 1.0, May 23, 2013.</p>\r\n<p>A validation team on behalf of the CCEVS Validation Body monitored the evaluation carried out by SAIC. The evaluation was completed in May 2013. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID10529-2013), prepared by CCEVS.</p>","environmental_strengths":"<p>The evaluation of the Microsoft Windows 8, Microsoft Windows RT, Microsoft Windows Server 2012 IPsec VPN Client TOE provides assurance that the security functions implemented by the TOE satisfy the security functional requirements specified in the Microsoft Windows 8, Microsoft Windows RT, Microsoft Windows Server 2012 IPsec VPN Client Security Target and that the guidance documentation describes how to use the TOE in a secure fashion. Assurance was achieved by the performance of the assurance activities specified in the Protection Profile for IPsec Virtual Private Network (VPN) Clients.</p>\r\n<p>Microsoft Windows 8, Microsoft Windows RT, Microsoft Windows Server 2012 IPsec VPN Client implements the following security functions:</p>\r\n<ul>\r\n<li><strong>Security Audit:</strong> Windows has the ability to collect audit data, review audit logs, protect audit logs from overflow, and restrict access to audit logs.&nbsp; Audit information generated by the system includes the date and time of the event, the user identity that caused the event to be generated, and other event-specific data.&nbsp; Authorized administrators can review audit logs and have the ability to search and sort audit records. Authorized administrators can also configure the audit system to include or exclude potentially auditable events to be audited based on a wide range of characteristics.</li>\r\n<li><strong>Cryptographic Protection:</strong>&nbsp; Windows provides FIPS-140-2 validated cryptographic functions that support encryption/decryption, cryptographic signatures, cryptographic hashing, cryptographic key agreement (which is not studied in this evaluation), and random number generation. The TOE additionally provides support for public keys, credential management and certificate validation functions and provides support for the National Security Agency&rsquo;s Suite B cryptographic algorithms. Windows also provides extensive auditing support of cryptographic operations, the ability to replace cryptographic functions and random number generators with alternative implementations,and a key isolation service designed to limit the potential exposure of secret and private keys. In addition to using cryptography for its own security functions, Windows offers access to the cryptographic support functions for user-mode and kernel-mode programs. Public key certificates generated and used by Windows authenticate users and machines as well as user protect and system data in transit.\r\n<ul>\r\n<li><strong>IPsec:</strong> Windows implements IPsec to provide protected, authenticated, confidential, and tamper-proof networking between two peer computers.</li>\r\n</ul>\r\n</li>\r\n<li><strong>User Data Protection</strong>: In this context of this evaluation, Windows provides object and subject residual information protection.</li>\r\n<li><strong>Identification &amp; Authentication</strong>: In the context of this evaluation, Windows provides the ability to use, store, and protect X.509 certificates that are used for IPsec. Windows also has the ability to use pre-shared keys for IPsec.</li>\r\n<li><strong>Security Management</strong>: Windows includes several functions to manage security policies.&nbsp; Policy management is controlled through a combination of access control, membership in administrator groups, and privileges.</li>\r\n<li><strong>Protection of the TOE&rsquo;s Security Functions</strong>: Windows provides a number of features to ensure the protection of TOE security functions.&nbsp;&nbsp; Windows protects against unauthorized data disclosure and modification by using a suite of Internet standard protocols including IPsec, IKE, and ISAKMP.&nbsp; Windows ensures process isolation security for all processes through private virtual address spaces, execution context, and security context.&nbsp; The Windows data structures defining process address space, execution context, memory protection, and security context are stored in protected kernel-mode memory. Windows includes self-testing features that ensure the integrity of executable program images and its cryptographic functions. Finally, Windows provides a trusted update mechanism to update Windows binaries itself.</li>\r\n<li><strong>Trusted Path for Communications</strong>: Windows uses the IPsec suite of protocols to provide a Virtual Private Network Connection (VPN) between itself, acting as a VPN client, and a VPN gateway.</li>\r\n</ul>","features":[]}