The TOE is an enterprise security management solution that provides centralized management and access control over web services and related resources. The TOE controls how web services are exposed to and accessed by external client applications. The Gateway is designed to protect web services and mediate communications between Service Oriented Architecture (SOA) clients and endpoints residing in different identity, security, or middleware domains.
","evaluation_configuration":"","security_evaluation_summary":"The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The evaluation demonstrated that the product meets the security requirements contained in the Security Target. The criteria against which the CA Layer 7 SecureSpan SOA Gateway v8.0 was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 3. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1, Revision 3. Computer Sciences Corporation determined that the product is conformant to requirements for ESM Protection Profiles; Standard Protection Profile for Enterprise Security Management Policy Management, v1.4 and Standard Protection Profile for Enterprise Security Management Access Control, v2.0. The product satisfies all of the security functional requirements stated in the Security Target. Two validators, on behalf of the CCEVS Validation Body, monitored the evaluation carried out by Computer Sciences Corporation. The evaluation was completed on 30 May 2014. Results of the evaluation can be found in the Evaluation Technical Report for CA Layer 7 SecureSpan SOA Gateway v8.0 prepared by Computer Sciences Corporation.
","environmental_strengths":"Communication between the Policy Manager and the Gateway is protected from disclosure and modification. A trusted channel is established to identify and authenticate each end point.
\r\nThe Gateway validates the integrity of the policy data it receives and rejects any invalid or replayed data. The Gateway generates evidence of receipt of policies.
\r\nThe TOE provides the ability to keep an audit/log trail to provide administrative insight into system management and operation, including identifying what policies are being defined and enforced. The TOE is capable of sending audit/log information to an external trusted entity.
\r\nAdministrative access to the TOE requires authentication and is governed by role based access control. The TOE protects against attacker attempts to illicitly authenticate using repeated guesses and enforces an administrator define password policy. The TOE displays a banner a login.
","features":[]}