The Target of Evaluation (TOE) is the Imperva SecureSphere v11.5 Patch 5 software running on two or more of the Imperva appliances listed below, including one or more Management Servers and one or more Gateways:
\r\nHardware appliance:
\r\n· Gateway Appliances: X1010, X10K, X2010, X2510, X4510, X6510, X8510
\r\n· MX Management Server Appliances: M110, M160
\r\nVirtual Machine Appliances:
\r\n· V1000, V2500, V4500 (for Gateway)
\r\n· VM150 (for MX)
\r\nAnd optionally a SecureSphere Operations Manager (SOM) Management Server appliance or Virtual Machine Appliance:
\r\n· Appliances: M160
\r\n· Virtual Machine Appliance: VM150
\r\nThe TOE is Imperva SecureSphere v11.5 Patch 5, provided by Imperva, Inc. The product is a set of network security appliances for advanced threat detection with Intrusion Prevention System (IPS) capabilities. SecureSphere v11.5 Patch 5 provides protection from attacks against database, file, Web, and Web Services assets, both within the organization (insider attacks) and from without. Installed on the network as a transparent inline bridge or as an offline network monitor (sniffer), a SecureSphere v11.5 Patch 5 Gateway monitors application-level protocols for attacks, and reacts by blocking the attacks and/or reporting them to a centralized management server. Though the focus of this evaluation is on the TOE functionality supporting the claims in the Protection Profile for Network Devices this section includes descriptions of additional product security functionality for usage and context purposes.
\r\nThe product is deployed as one or more Gateway appliances controlled by a MX appliance. In multi-tier management configurations, one or more MX Management Servers may in turn be managed by a SecureSphere Operations Manager (SOM) Management Server.
\r\nAdministrators connect to the Management Server using a standard Web browser (outside of the Target of Evaluation). They are required to authenticate their identity before being allowed any further action.
\r\nThe different appliance models all run the same SecureSphere v11.5 Patch 5 software and provide all claimed security functionality, but may differ in throughput and storage capacity. SecureSphere v11.5 Patch 5 software (including management and/or Gateway components) may alternatively be installed on a Virtual Machine (VM) hosted by a VMware ESXi Hypervisor or on Amazon appliance in AWS environment. The Virtual Machine emulates the SecureSphere v11.5 Patch 5 appliance hardware. The VMware Hypervisor, and underlying hardware is considered to be outside of the boundaries of the Target of Evaluation. Amazon deployments are not included in the TOE.
\r\nImperva's Dynamic Profiling technology automatically builds a model of legitimate application behavior that is used by the product to identify illegitimate traffic. In addition, attack signatures are preconfigured into the product and can be periodically updated from an external Application Defense Center (ADC). The ADC also provides ADC Insights – these are pre-packaged security policy rules and reports for commonly used applications. This functionality is outside the scope of the TOE.
\r\nSecureSphere v11.5 Patch 5 applies different layers of intrusion detection logic to analyzed network traffic. Some of these layers are applicable to all network traffic; some are relevant only for Web traffic and/or database access protocols. In addition, Imperva's Correlated Attack Validation (CAV) technology examines sequences of events and identifies suspicious traffic based on a correlation of multiple analysis layers. Identified malicious traffic is blocked.
\r\nSecureSphere supports the following two blocking methods:
\r\nNote: TCP reset is considered inferior to inline blocking (see below) because it does not actively block the malicious traffic from reaching the server; blocking depends on the server’s correct and timely session termination behavior.
\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Imperva SecureSphere v11.5 Patch 5 Gateway Appliances: X1010, X10K, X2010, X2510, X4510, X6510, X8510 and MX Management Server Appliances: M110, M160 and Virtual Machine Appliances: V1000, V2500, V4500 (for Gateway), VM150 (for MX) and optionally a SecureSphere Operations Manager (SOM) Management Server appliance or Virtual Machine Appliance: Appliances: M160 and Virtual Machine Appliance: VM150 were judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. The product, when delivered and configured as identified in the Imperva SecureSphere Configuring Common Criteria Compliance User Guide, Version 11.5, November 2015 document, satisfies all of the security functional requirements stated in the Imperva SecureSphere Security Target, Version 0.4, 12 November 2015. The project underwent CCEVS Validator review. The evaluation was completed in December 2015. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
\r\n\r\n\r\n","environmental_strengths":"\r\n
Security Audit
\r\nThe TOE is designed to be able to generate logs for security relevant events including the events specified in NDPP. The TOE can be configured to store the logs locally so they can be accessed by an administrator and can also be configured to send the logs to a designated external log server.
\r\n\r\n
Cryptographic Support
\r\nThe TOE is operated in FIPS mode and includes both NIST-validated RSA B-Safe and NIST-validated OpenSSL cryptographic modules. The modules provide key management, random bit generation, encryption/decryption, digital signature and cryptographic hashing and keyed-hash message authentication features in support of higher level cryptographic protocols, including SSH, TLS and HTTP over TLS.
\r\n\r\n
User Data Protection
\r\nThe TOE is designed to ensure that it does not inadvertently reuse data found in network traffic.
\r\n\r\n
Identification and Authentication
\r\nThe TOE requires users (i.e., administrators) to be successfully identified and authenticated before they can access any security management functions available in the TOE. The TOE offers a network accessible GUI (HTTP over TLS) and console available locally and remotely via SSH for interactive administrator sessions.
\r\nThe TOE supports the local (i.e., on device) definition of administrators with usernames and passwords. Additionally, the TOE can be configured to use the services of a trusted LDAP server in the operational environment.
\r\n\r\n
Security Management
\r\nThe TOE provides remote access to a CLI using SSHv2 and a GUI to access the wide range of security management functions. Security management commands are limited to administrators and are available only after they have provided acceptable user identification and authentication data to the TOE.
\r\nThe TOE also provides the ability to manage the TOE locally via direct serial console connection. The direct serial console is used mainly for initial configuration and then the TOE is designed to be managed and monitored using the Web GUI from a remote HTTPS/TLS client; or using the CLI from an SSHv2 client. The TOE provides the Administrator role which corresponds to the NDPP Security Administrator.
\r\n\r\n
Protection of the TSF
\r\nThe TOE implements a number of features designed to protect itself to ensure the reliability and integrity of its security features.
\r\nIt protects particularly sensitive data such as stored passwords and cryptographic keys so that they are not accessible even by an administrator. The TOE includes its own time clock to ensure that reliable time information is available (e.g., for log accountability) but requires an NTP Server in the operational environment in order to synchronizes its clock with that of the external time server.
\r\nThe TOE uses HTTPS to protect communications between distributed TOE components (FPT_ITT.1).
\r\nThe TOE includes functions to perform self-tests so that it might detect when it is failing. It also includes mechanisms so that the TOE itself can be updated while ensuring that the updates will not introduce malicious or other unexpected changes in the TOE.
\r\n\r\n
TOE Access
\r\nThe TOE can be configured to display an informative banner that will appear prior to an administrator being permitted to establish an interactive session. The TOE subsequently will enforce an administrator-defined inactivity timeout value after which the inactive session will be terminated. Administrators can also terminate their own sessions by logging out.
\r\n\r\n
Trusted Path/Channels
\r\nThe TOE protects interactive communication with remote administrators using SSH or HTTP over TLS. TLS ensures both integrity and disclosure protection.
\r\nThe TOE uses TLS to ensure that any authentication operations, and exported audit records, are sent only to the configured Syslog or authentication servers so they are not subject to inappropriate disclosure or modification. TLS is also used to ensure TOE updates are transmitted securely.
\r\n","features":[]}