The TOE consists of several families of appliances working together to form the network protection solution. Collectively, the product families provide email, file, and network security with a centralized management platform. Each family performs a specific role in the overall network protection, as described below.
\r\nProduct Description: CM Series Appliances
\r\nThe FireEye® CM series is a group of management platforms that consolidates the administration, reporting, and data sharing of the FireEye NX, EX, and FX series in one, network-based platform. Within the FireEye deployment, the FireEye CM enables real-time sharing of the auto-generated threat intelligence to identify and block advanced attacks targeting the organization. It also enables centralized configuration, management, and reporting of FireEye platforms.
\r\nProduct Description: FX Series Appliances
\r\nThe FireEye® FX series is a group of threat prevention platforms that protect content against attacks originating in a wide range of file types. Web mail, online file transfer tools, the cloud, and portable file storage devices can introduce malware that can spread to file shares and content repositories. The FireEye FX platform analyzes network file shares and enterprise content management stores to detect and quarantine malware brought in by employees and others that bypass next-generation firewalls, IPS, AV, and gateways.
\r\nProduct Description: EX Series Appliances
\r\nThe FireEye® EX series secures against advanced email attacks. As part of the FireEye Threat Prevention Platform, the FireEye EX uses signature-less technology to analyze every email attachment and successfully quarantine spear-phishing emails used in advanced targeted attacks.
\r\nProduct Description: NX Series Appliances
\r\nThe FireEye® Network Threat Prevention Platform identifies and blocks zero-day Web exploits, droppers (binaries), and multi-protocol callbacks to help organizations scale their advanced threat defenses across a range of deployments, from the multi-gigabit headquarters down to remote, branch, and mobile offices. FireEye Network with Intrusion Prevention System (IPS) technology further optimizes spend, substantially reduces false positives, and enables compliance while driving security across known and unknown threats.
","evaluation_configuration":"","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the FireEye CM, FX, EX, and NX Series Appliances were evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. The product, when delivered configured as identified in the FireEye FIPS 140-2 and Common Criteria Addendum document, satisfies all of the security functional requirements stated in the FireEye CM, FX, EX, and NX Series Appliances Security Target. The project underwent CCEVS Validator review. The evaluation was completed in July 2015. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
\r\n","environmental_strengths":"\r\n\r\n
Security audit
\r\nThe FireEye CM, FX, EX, and NX Series Appliances provide extensive auditing capabilities. The TOE generates a comprehensive set of audit logs that identify specific TOE operations. For each event, the TOE records the date and time of each event, the type of event, the subject identity, and the outcome of the event. Auditable events include: failure on invoking cryptographic functionality such as establishment, termination and failure of a TLS session; establishment, termination and failure of an SSH session; modifications to the group of users that are part of the authorized administrator roles; all use of the user identification mechanism; any use of the authentication mechanism; any change in the configuration of the TOE, changes to time, initiation of TOE update, indication of completion of TSF self-test, maximum sessions being exceeded, termination of a remote session; and initiation and termination of a trusted channel.
\r\nThe TOE is configured to transmit its audit messages to an external syslog server. Communication with the syslog server is protected using TLS and the TOE can determine when communication with the syslog server fails.
\r\nThe logs for all of the appliances can be viewed on the TOE via the CM GUI. Audit record generated on LMS are sent to the CM for review via an SSH secured connection. The records include the date/time the event occurred, the event/type of event, the user ID associated with the event, and additional information of the event and its success and/or failure. The TOE does not have an interface to modify audit records, though there is an interface available for the authorized administrator to clear audit data stored locally on the TOE.
\r\nUser Data Protection
\r\nThe TOE ensures that all information flows from the TOE do not contain residual information from previous traffic. Packets are padded with zeros. Residual data is never transmitted from the TOE.
\r\nIdentification and Authentication
\r\nThe TOE performs three types of authentication: device-level authentication of remote IT Environment devices (e.g., audit servers and LDAP servers), device-level authentication between separate TOE components (e.g., CM to FX authentication and vice versa) and user authentication for the Authorized Administrator of the TOE. Device-level authentication of remote IT Environment devices allows the TOE to establish a secure channel with an IT Environment trusted peer. The secure channel is established only after each device authenticates the other. This device-level authentication is performed via TLS authentication. Device-level authentication for inter-TOE communications allows the TOE to establish a secure channel between separate TOE components to facilitate secure administration and audit transmission. The secure channel is established only after each device authenticates the other. This device-level authentication is performed via SSH authentication.
\r\nThe TOE provides authentication services for administrative users to connect to the TOEs secure GUI or CLI administrator interface. The TOE requires Authorized Administrators to authenticate prior to being granted access to any of the management functionality. In the Common Criteria evaluated configuration, the TOE is configured to require a minimum password length of 15 characters, as well as, mandatory password complexity rules. The TOE provides two administrator authentication methods:
\r\nPassword-based authentication can be performed on any TOE administrative interface including local CLI, remote CLI over SSH, and remote GUI over HTTPS.
\r\nSecurity Management
\r\nThe TOE provides secure administrative services for management of general TOE configuration and the security functionality provided by the TOE. Management can take place over a variety of interfaces including:
\r\nWhile the TOE provides multiple interfaces to perform administration, all functionality available via the command line interface is limited. All general and security administration for all of the appliances will take place at one of several locations including,
\r\nConfiguration changes associated with the paired LMS devices are pushed from the CM appliance to the associated LMS device over an SSHv2 secured channel.
\r\nThe TOE supports several administrator roles, including,
\r\nThese roles are collectively known as the “Authorized Administrator”
\r\nThe TOE supports the configuration of login banners to be displayed at time of login and inactivity timeouts to terminate administrative sessions after a set period of inactivity.
\r\nProtection of the TSF
\r\nThe TOE protects against interference and tampering by untrusted subjects by implementing identification, authentication, and access controls to limit configuration to Authorized Administrators. The TOE prevents reading of cryptographic keys and passwords. Additionally the TOE software is a custom-built hardened version of Linux and access to memory space is restricted to only required software services.
\r\nThe TOE internally maintains the date and time. This date and time is used as the timestamp that is applied to audit records generated by the TOE. Administrators can update the TOE’s clock manually, or can configure the TOE to use NTP to synchronize the TOE’s clock with an external time source. Finally, the TOE performs testing to verify correct operation of the security appliances themselves.
\r\nThe TOE verifies all software updates via digital signature and requires administrative intervention prior to the software updates being installed on the TOE to avoid the installation of unauthorized software.
\r\nTOE Access
\r\nThe TOE can terminate inactive sessions after an Authorized Administrator configurable time-period. Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session.
\r\nThe TOE also displays an Authorized Administrator configured banner on both the GUI and CLI management interfaces prior to allowing any administrative access to the TOE.
\r\nTrusted path/Channels
\r\nThe TOE supports several types of secure communications, including,
\r\nEach of these trusted paths/channels are secured using either TLS or SSH.
","features":[]}