The Target of Evaluation (TOE) is the Aruba Mobility Controller and Access Point Series, running ArubaOS version 6.3.1.5-FIPS.
\r\nThe Aruba devices within the scope of the evaluation comprise the following Mobility Controllers and Access Points, all running ArubaOS version 6.3.1.5-FIPS:
\r\nAssurance Maintenance was conducted upon which the following ArubaOS, mobility controllers and access points were certified:
\r\nThe Aruba Mobility Controllers are wireless switch appliances that provide services and features including wireless and wired network mobility, centralized management, auditing, authentication, and remote access. The Aruba Access Point appliances service wireless clients. The ArubaOS is a suite of mobility applications that runs on all Aruba controllers and APs, and allows administrators to configure and manage the wireless and mobile user environment.
","evaluation_configuration":"","security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Aruba Mobility Controller and Access Point Series was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 3. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1, Revision 3. Leidos Inc. (formerly Science Applications International Corporation (SAIC)) determined that the TOE satisfies the requirements specified in Protection Profile for Wireless Local Area Network (WLAN) Access Systems, Version 1.0, 1 December 2011. The product, when installed and configured as identified in the product guidance documentation, satisfies all of the security functional requirements stated in Aruba Mobility Controller and Access Point Series Security Target, Version 1.0, 9/29/2014.
\r\nA validation team on behalf of the CCEVS Validation Body monitored the evaluation carried out by Leidos. The evaluation was completed in October 2014. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID10569-2014), prepared by CCEVS.
","environmental_strengths":"The evaluation of the Aruba Mobility Controller and Access Point Series TOE provides assurance that the security functions implemented by the TOE satisfy the security functional requirements specified in the Aruba Mobility Controller and Access Point Series Security Target and that the guidance documentation describes how to use the TOE in a secure fashion. Assurance was achieved by the performance of the assurance activities specified in Protection Profile for Wireless Local Area Network (WLAN) Access Systems, Version 1.0, 1 December 2011.
\r\nThe Aruba Mobility Controller and Access Point Series running ArubaOS version 6.3.1.5-FIPS implement the following security functions:
\r\nThe TOE may utilize its internal real-time clock chip and/or an external NTP server to provide a reliable timestamp and syslog server to store and protect the audit trail. The administrator is provided an interface in the operating environment to read audit logs and that interface is restricted.
\r\nThe TOE provides self-tests to ensure the correct operation of the cryptographic functions and TSF hardware. There is an option for the administrator to verify the integrity of stored TSF executable code.
\r\nThe TOE includes mechanisms so that the administrator can determine the TOE version and update the TOE securely using digital signatures and published hashes.
\r\nThe TOE can restrict the ability to connect to administrative interfaces based on time/date, location, and device MAC address and blacklist status.
\r\n