The evaluated version of the TOE is:
\r\nTOE Software Identification: The following Windows Operating Systems (OS):
\r\n· Microsoft Windows 8.1 Pro Edition (64-bit version) on Microsoft Surface 3
\r\n· Windows Phone 8.1 GDR2 on Microsoft Lumia 635 and Microsoft Lumia 830
\r\nWindows 8.1 is suited for business desktops, notebook, and convertible computers. It is the workstation product and while it can be used by itself, it is also designed to serve as a client within Windows domains.
\r\nWindows Phone 8.1 is based on the same core operating system as Windows 8.1 and provides a simplified user interface that makes Windows Phone a communications hub for voice, text, and web access.
\r\nIn terms of security, Windows 8.1 and Phone 8.1 share the same security characteristics
","evaluation_configuration":"","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme for the MDFPP, version 1.1. The criteria against which the Microsoft Windows 8.1 mobile device was judged are described in the Protection Profile Assurance Activities. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. The product, when delivered configured as identified in the guidance document, satisfies all of the security functional requirements stated in the Microsoft Windows 8.1 and Microsoft Windows Phone 8.1 Security Target, Version 1.0. The project underwent CCEVS validation team review. The evaluation was completed in August 2015. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"\r\n\r\nCryptographic Support
\r\nWindows provides FIPS 140-2 validated cryptographic functions that support encryption/decryption, cryptographic signatures, cryptographic hashing, cryptographic key agreement, and random number generation. The TOE additionally provides support for public keys, credential management and certificate validation functions and provides support for the National Security Agency’s Suite B cryptographic algorithms. Windows also provides extensive auditing support of cryptographic operations and a key isolation service designed to limit the potential exposure of secret and private keys. In addition to using cryptography for its own security functions, Windows offers access to the cryptographic support functions for user-mode and kernel-mode programs. Public key certificates generated and used by Windows authenticate users and machines as well as protect both user and system data in transit.
\r\n· Software-based disk encryption: Windows implements BitLocker to provide encrypted data storage for fixed and removable volumes and protects the disk volume’s encryption key with one or more intermediate keys and authorization factor
\r\n· IPsec: Windows implements IPsec to provide protected, authenticated, confidential, and tamper-proof networking between two peer computers.
\r\nUser Data Protection
\r\nIn the context of this evaluation, Windows protects user data at rest and provides secure storage of X.509v3 certificates.
\r\nIdentification and Authentication
\r\nIn the context of this evaluation, Windows provides the ability to use, store, and protect X.509 certificates that are used for IPsec and authenticates the user to their mobile device.
\r\nSecurity Management
\r\nWindows includes several functions to manage security policies. Policy management is controlled through a combination of access control, membership in administrator groups, and privileges.
\r\nProtection of the TSF
\r\nWindows provides a number of features to ensure the protection of TOE security functions. Windows protects against unauthorized data disclosure and modification by using a suite of Internet standard protocols including IPsec, IKE, and ISAKMP. Windows ensures process isolation security for all processes through private virtual address spaces, execution context, and security context. The Windows data structures defining process address space, execution context, memory protection, and security context are stored in protected kernel-mode memory. Windows includes self-testing features that ensure the integrity of executable program images and its cryptographic functions. Finally, Windows provides a trusted update mechanism to update Windows binaries itself.
\r\nSession Locking
\r\nWindows provides the ability for a user to lock their session either immediately or after a defined interval. Windows constantly monitors the mouse, keyboard, and touch display for activity and locks the computer after a set period of inactivity. Windows allows an authorized administrator to configure the system to display a logon banner before the logon dialog.
\r\nTrusted Path/Channels
\r\nWindows uses the IPsec suite of protocols to provide a Virtual Private Network Connection (VPN) between itself, acting as a VPN client, and a VPN gateway in addition to providing protected communications for HTTPS and TLS.
","features":[]}