The Target of Evaluation (TOE) is the Brocade Communications Systems, Inc. Brocade Directors and Switches 7.3 family of products.
\r\nThe Target of Evaluation (TOE) is the Brocade Directors and Switches 7.3. The various models of the TOE identified below differ in performance, form factor and number of ports, but all run the same FabricOS version 7.3.0a1 software. The TOE is available in three form factors:
\r\nDirector models are composed of blades of several types. A ‘director blade model’ is a control blade (CP8), a core switch blade (CR8 or CR4S-8, CR16-4, CR16-8), and port blades (FC8-16, FC8-32, FC8-48, FC8-64, FC16-32, FC16-48) or application blades (FX8-24). Control blades contain the control plane for the chassis. A core switch blade contains the ASICs for switching between port blades. A port blade supports various numbers of ports and speeds. Application blades provide additional capabilities such as FC over Ethernet. The DCX, DCX-4S, DCX 8510-4 and DCX 8510-8 require at least one control blade and one core blade to make the director operational.
\r\nBrocade Directors and Switches are hardware appliances that implement what is called a “Storage Area Network” or “SAN”. SANs provide physical connections between machines in the environment containing a type of network card called a Host Bus Adapter (HBA) that are located in the environment and storage devices such as disk storage systems and tape libraries that are also located in the environment. The network connection between the storage devices in the environment, the TOE, and HBAs in the environment use high-speed network hardware. SANs are optimized to transfer large blocks of data between HBAs and storage devices. SANs can be used to replace or supplement server-attached storage solutions, for example.
\r\nHBAs communicate with the TOE using Fibre Channel (FC) or FC over IP (FCIP) protocols. Storage devices in turn are physically connected to the TOE using FC/FCIP interfaces. When more than one instance of the TOE is interconnected (i.e. installed and configured to work together), they are referred to collectively as a “SAN fabric”. A zone is a specified group of fabric-connected devices (called zone members) that have access to one another.
","evaluation_configuration":"The evaluated configuration consists of the Brocade Communications Systems, Inc. Brocade Directors and Switches operating with FabricOS version 7.3.0a1, including the following series and models:
\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Brocade Directors and Switches 7.3 was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. Gossamer Security Solutions determined that the evaluation assurance level (EAL) for the product is EAL 1. The product, when delivered and configured as identified in the Brocade – Fabric OS FIPS and Common Criteria Configuration Guide Supporting Fabric OS 7.3.0 for FIPS and 7.3.0a1 for Common Criteria, Publication #53-1003145-02, 13 February 2015 document, satisfies all of the security functional requirements stated in the Brocade Communications Systems, Inc. Brocade Directors and Switches 7.3 Security Target, Version 1.0, March 18, 2015. The project underwent CCEVS Validator review. The evaluation was completed in February 2015. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID10585-2014) prepared by CCEVS
","environmental_strengths":"The logical boundaries of the Brocade Directors and Switches 7.3 TOE are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\nSecurity Audit - The TOE generates audit events for numerous activities including policy enforcement, system management and authentication. A syslog server in the environment is relied on to store audit records generated by the TOE. The TOE generates a complete audit record including the IP address of the TOE, the event details, and the time the event occurred. The time stamp is provided by the TOE appliance hardware. When the syslog server writes the audit record to the audit trail, it applies its own time stamp, placing the entire TOE-generated syslog protocol message MSG contents into an encapsulating syslog record.
\r\nCryptographic Support - The TOE contains FIPS-certified cryptographic implementations that provide key management, random bit generation, encryption/decryption, digital signature and secure hashing and key-hashing features in support of higher level cryptographic protocols including SSH and TLS.
\r\nUser Data Protection - While implementing SAN and HBA protocols, the TOE is carefully designed to ensure that it doesn’t inadvertently release or leak residual data. When the TOE allocates a new buffer for either an incoming or outgoing a network packet, the new packet data will be used to overwrite any previous data in the buffer. If an allocated buffer exceeds the size of the packet, and additional space will be overwritten (padded) with zeros before the packet is forwarded (either to an external network of HBA or written to a storage device) on both Ethernet and FiberChannel connections.
\r\nIdentification and Authentication - The TOE authenticates administrative users. In order for an administrative user to access the TOE, a user account including a user name and password must be created for the user, and an administrative role must be assigned. Either the TOE performs the validation of the login credentials or the information is passed to a RADIUS or LDAP Server to perform the validation and the TOE enforces the decision. The administrator can configure the order in which the external authentication provider and the local credentials are checked.
\r\nSecurity Management - The TOE provides both serial terminal- and Ethernet network-based management interfaces. Each of the three types of interfaces provides equivalent management functionality. The TOE provides administrative interfaces to configure hard zoning, as well as to set and reset administrator passwords. By default, host bus adapters do not have access to storage devices.
\r\nTSF Protection - The TOE implements a number of features design to protect itself to ensure the reliability and integrity of its security features. It protects particularly sensitive data such as stored passwords and cryptographic keys so that they are not accessible even by an administrator. It also provides its own timing mechanism to ensure that reliable time information is available (e.g., for log accountability). Note that the TOE is a single appliance, and as such, no intra-TOE communication is subject to any risks that may require special protection (e.g., cryptographic mechanisms). The TOE includes functions to perform self-tests so that it might detect when it is failing. It also includes mechanisms (i.e., verification of the digital signature of each new image) so that the TOE itself can be updated while ensuring that the updates will not introduce malicious or other unexpected changes in the TOE.
\r\nTOE Access - The TOE provides an IP Filter policy that is a set of rules applied to the IP management interfaces. These rules provide the ability to control how and to whom the TOE exposes the management services hosted on a switch. They cannot affect the management traffic that is initiated from a switch. The TOE limits the number of concurrent login sessions for users, such that the number of simultaneous login sessions for each role is limited.
\r\nTrusted Path/Channels - The TOE enforces a trusted path between the TOE administrators and the TOE using SSH and HTTPS connections for Ethernet connections from the Administrator terminal to the TOE. The TOE encrypts commands sent from terminal applications by administrators using SSH for the command line interface and HTTPS for the Advanced Web Tools GUI interface.
","features":[]}