The FireEye HX series appliances enable security operations teams to correlate network and endpoint activity. Organizations can automatically investigate alerts generated by FireEye Threat Prevention Platforms, log management, and network security products, apply intelligence from FireEye to continuously validate Indicators of Compromises on the endpoints and identify if a compromise has occurred and assess the potential risk. Further, organizations can quickly triage the incident to understand the details and contain compromised endpoints with a single click and contain compromised devices within a single click workflow.
","evaluation_configuration":"","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the FireEye HX Series Appliances were evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. The product, when delivered configured as identified in the FireEye FIPS Mode and Common Criteria Addendum document, satisfies all of the security functional requirements stated in the FireEye HX Series Appliances Security Target. The project underwent CCEVS Validator review. The evaluation was completed in February 2016. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"\r\n\r\nSecurity audit
\r\nThe FireEye HX Series Appliances provide extensive auditing capabilities. The TOE generates a comprehensive set of audit logs that identify specific TOE operations. For each event, the TOE records the date and time of each event, the type of event, the subject identity, and the outcome of the event. Auditable events include: failure on invoking cryptographic functionality such as establishment, termination and failure of a TLS session; establishment, termination and failure of an SSH session; modifications to the group of users that are part of the authorized administrator roles; all use of the user identification mechanism; any use of the authentication mechanism; any change in the configuration of the TOE, changes to time, initiation of TOE update, indication of completion of TSF self-test, maximum sessions being exceeded, termination of a remote session; and initiation and termination of a trusted channel.
\r\nThe TOE is configured to transmit its audit messages to an external syslog server. Communication with the syslog server is protected using TLS and the TOE can determine when communication with the syslog server fails.
\r\nThe logs for all of the appliances can be viewed on the TOE via the TOE CLI. The records include the date/time the event occurred, the event/type of event, the user ID associated with the event, and additional information of the event and its success and/or failure. The TOE does not have an interface to modify audit records, though there is an interface available for the authorized administrator to clear audit data stored locally on the TOE.
\r\nUser Data Protection
\r\nThe TOE ensures that all information flows from the TOE do not contain residual information from previous traffic. Packets are padded with zeros. Residual data is never transmitted from the TOE.
\r\nIdentification and Authentication
\r\nThe TOE performs three types of authentication: device-level authentication of remote IT Environment devices (e.g., audit servers and LDAP servers) and user authentication for the Authorized Administrator of the TOE (both locally and remotely). Device-level authentication of remote IT Environment devices allows the TOE to establish a secure channel with an IT Environment trusted peer. The secure channel is established only after each device authenticates the other. This device-level authentication is performed via TLS authentication.
\r\nThe TOE provides authentication services for administrative users to connect to the TOEs secure GUI or CLI administrator interface. The TOE requires Authorized Administrators to authenticate prior to being granted access to any of the management functionality. In the Common Criteria evaluated configuration, the TOE is configured to require a minimum password length of 15 characters, as well as, mandatory password complexity rules. The TOE provides two administrator authentication methods:
\r\n· Authentication against a local user database
\r\n· Authentication via LDAP over TLS (part of the TOE IT environment)
\r\nPassword-based authentication can be performed on any TOE administrative interface including local CLI, remote CLI over SSH, and remote GUI over HTTPS.
\r\nSecurity Management
\r\nThe TOE provides secure administrative services for management of general TOE configuration and the security functionality provided by the TOE. Management can take place over a variety of interfaces including:
\r\n· Local console command line administration at each of the appliances
\r\n· Remote command line administration via SSHv2 at each of the appliances
\r\n· Remote GUI administration via TLS
\r\nWhile the TOE provides multiple interfaces to perform administration, all functionality available via the command line interface is limited. All general and security administration for all of the appliances will take place at one of several locations including,
\r\n· Remote GUI administration to the appliance being managed over HTTPS,
\r\n· Remote CLI administration to each appliance over an SSH tunnel over HTTPS,
\r\n· Local administration via direction connection.
\r\nThe TOE provides the ability to securely manage:
\r\n· All TOE administrative users;
\r\n· All identification and authentication;
\r\n· All audit functionality of the TOE;
\r\n· All TOE cryptographic functionality;
\r\n· The timestamps maintained by the TOE; and
\r\n· Update to the TOE.
\r\nThe TOE supports several administrator roles, including,
\r\n· Admin: The system administrator is a “super user” who has all capabilities.
\r\n· Monitor: The system monitor has read-only access
\r\n· Operator: The system operator has a subset of the capabilities associated with the admin role.
\r\n· Analyst: The system analyst focuses on data plane analysis.
\r\n· Auditor: The system auditor reviews audit logs and performs forensic analysis.
\r\nThese roles are collectively known as the “Authorized Administrator”
\r\nThe TOE supports the configuration of login banners to be displayed at time of login and inactivity timeouts to terminate administrative sessions after a set period of inactivity.
\r\nProtection of the TSF
\r\nThe TOE protects against interference and tampering by untrusted subjects by implementing identification, authentication, and access controls to limit configuration to Authorized Administrators. The TOE prevents reading of cryptographic keys and passwords. Additionally the TOE software is a custom-built hardened version of Linux and access to memory space is restricted to only required software services.
\r\nThe TOE internally maintains the date and time. This date and time is used as the timestamp that is applied to audit records generated by the TOE. Administrators can update the TOE’s clock manually, or can configure the TOE to use NTP to synchronize the TOE’s clock with an external time source. Finally, the TOE performs testing to verify correct operation of the security appliances themselves.
\r\nThe TOE verifies all software updates via digital signature and requires administrative intervention prior to the software updates being installed on the TOE to avoid the installation of unauthorized software.
\r\nTOE Access
\r\nThe TOE can terminate inactive sessions after an Authorized Administrator configurable time-period. Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session.
\r\nThe TOE also displays an Authorized Administrator configured banner on both the GUI and CLI management interfaces prior to allowing any administrative access to the TOE.
\r\nTrusted path/Channels
\r\nThe TOE supports several types of secure communications, including,
\r\n· Trusted paths with remote administrators over SSH,
\r\n· Trusted paths with remote administrators over TLS,
\r\n· Trusted channels with remote IT Environment audit servers over TLS,
\r\n· Trusted channels with remote IT Environment LDAP servers over TLS.
\r\nEach of these trusted paths/channels are secured using either TLS or SSH.
","features":[]}