The Cisco Optical Networking Solution (ONS) and Network Convergence System (NCS) 2000 Series TOE provides dense wavelength-division multiplexing (DWDM) and time-division multiplexing (TDM) solutions and the evolved flex-spectrum reconfigurable optical add/drop multiplexer (ROADM) capabilities.
\r\nThe Optical Encryption Line Card provides the secure transport capability of the TOE. The card provides data confidentiality and data integrity over a fiber optic communication channel through the combination of cryptography and product architecture.
\r\nThe services include service transparency, flexible topology, completely reconfigurable traffic pattern, and simplified operations. The platform supports a variety of modules to enable wide deployment scenarios including access, metro, regional, and enterprise and ultra-long-haul optical networks. The traditional transport services such as Ethernet and IP are also supported by the TOE.
\r\n","evaluation_configuration":"","security_evaluation_summary":"\r\n\r\n\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Cisco Optical Networking Solution (ONS) and Network Convergence System (NCS) 2000 Series were evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. Acumen Security determined that the evaluation assurance level (EAL) for the product is EAL 1. The product, when delivered configured as identified in the Cisco Optical Networking Solution (ONS) and Network Convergence System (NCS) 2000 Series User Guidance and Preparative Procedures document, satisfies all of the security functional requirements stated in the Cisco Optical Networking Solution (ONS) and Network Convergence System (NCS) 2000 Series Security Target. The project underwent CCEVS Validator review. The evaluation was completed in January 2016. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
\r\n","environmental_strengths":"\r\n\r\n\r\nSecurity audit
\r\nThe Cisco ONS and NCS 2000 Series provides extensive auditing capabilities. The TOE can audit events related to cryptographic functionality, identification and authentication, and administrative actions. The Cisco ONS and NCS 2000 Series generates an audit record for each auditable event. Each security relevant audit event has the date, timestamp, event description, and subject identity. Auditing is always on to audit all events and therefore the administrator is only coupled with the management of the audit data storage and archive of the log files. The TOE provides the administrator with a circular audit trail or a configurable audit trail threshold to track the storage capacity of the audit trail. Audit logs are archived over secure HTTPS/TLS connection to an external audit server.
\r\nCryptographic Support
\r\nThe TOE provides cryptography in support of HTTPS/TLS and TLS connections for remote administrative management and transmission of syslog records, respectively.
\r\nUser Data Protection
\r\nThe TOE ensures that all information flows from the TOE do not contain residual information from previous traffic. Packets are padded with zeros. Residual data is never transmitted from the TOE.
\r\nIdentification and Authentication
\r\nThe TOE provides authentication services for administrative users to connect to the TOEs GUI administrator interface. The TOE requires Authorized Administrators to be successfully identified and authenticated prior to being granted access to any of the management functionality. The TOE can be configured to require a minimum password length of 15 characters, password expiration as well as mandatory password complexity rules. The TOE provides administrator authentication against a local user database using the GUI interface accessed via secure HTTPS connection.
\r\nSecurity Management
\r\nThe TOE provides secure administrative services for management of general TOE configuration and the security functionality provided by the TOE. All TOE administration occurs either through a secure HTTPS session or via a local console connection. The TOE provides the ability to securely manage:
\r\n· All TOE administrative users;
\r\n· All identification and authentication;
\r\n· All audit functionality of the TOE;
\r\n· All TOE cryptographic functionality;
\r\n· The timestamps maintained by the TOE; and
\r\n· Update to the TOE.
\r\nProtection of the TSF
\r\nThe TOE protects the communications between the Cisco Transport Controller, a GUI-based application used for configuration and management, and the Cisco ONS and NCS 2000 Series systems using TLS for a secure connection. The TOE also protects against interference and tampering by untrusted subjects by implementing identification, authentication, and access controls to limit configuration to Authorized Administrators. The TOE prevents reading of cryptographic keys and passwords. Additionally Cisco ONS and NCS 2000 Series is not a general-purpose operating system and access to Cisco ONS and NCS 2000 Series memory space is restricted to only Cisco ONS and NCS 2000 Series functions.
\r\nThe TOE internally maintains the date and time. This date and time is used as the timestamp that is applied to audit records generated by the TOE. The TOE may also be configured to synchronize time with an NTP server.
\r\nThe TOE performs testing to verify correct operation of the system itself and that of the cryptographic module.
\r\nFinally, the TOE is able to verify any software updates prior to the software updates being installed on the TOE to avoid the installation of unauthorized software.
\r\nTOE Access
\r\nThe TOE can terminate inactive sessions after an Authorized Administrator configurable time-period. Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session.
\r\nThe TOE can also be configured to display an Authorized Administrator specified banner on the GUI management interface prior to accessing the TOE.
\r\nTrusted path/Channels
\r\nThe TOE allows trusted paths to be established to itself from remote administrators over HTTPS and initiates secure HTTPS connections to transmit audit messages to remote syslog servers.
\r\n","features":[]}