The TOE is a network device consisting of several components that coordinate with one another to provide automated centralization of log collection and event management. The TOE collects information from multiple log sources (such as syslog, snmp, netflow and sflow devices, Windows events, flat file, databases or applications). The product also provides File Integrity Monitoring and Machine Analytics, with Host and Network Forensics, in a unified Security Intelligence Platform. The only capabilities covered by the evaluation are those in the NDPP; all other capabilities are not covered.
","evaluation_configuration":"","security_evaluation_summary":"\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the LogRhythm Integrated Solution was judged is described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. Leidos (formerly SAIC) determined that the product, when delivered and configured as identified in the LogRhythm supplemental guidance document, satisfies all of the security functional requirements stated in the LogRhythm Integrated Solution 6.3.4 Security Target, Version 1.2, December 18, 2015. The project underwent CCEVS Validator review. The evaluation was completed December 2015. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"\r\n\r\nSecurity Audit
\r\nThe TOE is designed to be able to generate logs for a wide range of security relevant events including the events specified in the NDPP. The TOE can be configured to store the logs locally so they can be accessed by an administrator.
\r\nThe TOE operates as a log collector, receiving log events transmitted to it from a range of log sources. The TOE receives the logs over a trusted channel using IPsec, TLS, or TLS/HTTPS.
\r\nCryptographic Support
\r\nThe TOE is operated in FIPS mode and includes NIST-validated cryptographic algorithm implementations for asymmetric key generation, symmetric encryption and decryption, cryptographic signature services, cryptographic hashing services, keyed-hash message authentication services, deterministic random bit generation seeded from a suitable entropy source and key zeroization. The cryptographic algorithm implementations support cryptographic protocols used for secure communication—IPsec, TLS and HTTPS.
\r\nIdentification and Authentication
\r\nThe TOE requires users (i.e., administrators) to be successfully identified and authenticated before they can access any security management functions available in the TOE. The TOE provides both local and remote administrative access. Local access is via a direct console connection. Remote access is via a thick client (the LogRhythm Client Console) secured by TLS or web-based graphical user interface (the Web Console) secured by TLS/HTTPS.
\r\nThe TOE supports the local (i.e., on device) definition of administrators with usernames and passwords. Additionally, the TOE can be configured to use Active Directory to support, for example, centralized user administration.
\r\nSecurity Management
\r\nThe TOE provides a thick client (Client Console) and a web-based client (Web Console) as mechanisms to access its security management functions. Security management commands are limited to administrators and are available only after they have provided acceptable user identification and authentication data to the TOE.
\r\nProtection of the TSF
\r\nThe TOE implements a number of features designed to protect itself to ensure the reliability and integrity of its security features.
\r\nIt protects particularly sensitive data such as stored passwords and cryptographic keys so that they are not accessible even by an administrator. The TOE ensures that reliable time information is available (e.g., for log accountability) provided through the use of a NTP Server. The NTP server is considered part of the operational environment.
\r\nThe TOE uses FIPS 140-2 certified cryptographic algorithms to protect communications between distributed TOE components.
\r\nThe TOE includes functions to perform self-tests so that it might detect when it is failing. It also includes mechanisms so that the TOE itself can be updated while ensuring that the updates will not introduce malicious or other unexpected changes in the TOE.
\r\n\r\n\r\nTOE Access
\r\nThe TOE can be configured to display an informative banner that will appear prior to an administrator being permitted to establish an interactive session. The TOE subsequently will enforce an administrator-defined inactivity timeout value after which the inactive session will be terminated.
\r\nThe TOE provides users (local and remote) the ability to terminate their own interactive sessions, by logging off of the TOE.
\r\nTrusted Path/Channel
\r\nThe TOE protects interactive communication with remote administrators using HTTP over TLS or TLS. TLS ensures both integrity and disclosure protection. The TOE can be configured by an administrator to receive external log records over a secure (IPsec, TLS or HTTPS protected) trusted channel.
\r\nThe TOE supports external user authentication via Active Directory, over a secure IPsec communication between the TOE and Active Directory.
\r\nThe TOE provides an interface to the Knowledge Base server and can be configured to automatically check for Knowledge Base updates. Communications with the Knowledge Base server are protected using TLS/HTTPS.
","features":[]}