The TOE is a software agent that resides on a host platform. The software received policies from an external HX series appliance (validated separately, VID10675). These policies are used to identify potential intrusions on the host platform. The TOE uses these policies to scan the host Operating System to identify indicators of compromise. The TOE is an enterprise managed agent that runs in the background of an endpoint platform. It is intended that the user will have no interaction with the software and will not be alerted of communications with the external HX appliance.
","evaluation_configuration":"","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the FireEye Endpoint Agent was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. Acumen Security determined that the evaluation assurance level (EAL) for the product is EAL 1. The product, when delivered configured as identified in the AGD, satisfies all of the security functional requirements stated in the FireEye Endpoint Agent Security Target. The project underwent CCEVS Validator review. The evaluation was completed in July 2016. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"\r\n\r\nCryptographic Support
\r\nThe TOE provides cryptographic support for the following features,
\r\n· TLS connectivity with the following entities:
\r\no HX Series Appliance
\r\n· Digital certificate generation
\r\nThe cryptographic services provided by the TOE are described below.
\r\n| \r\n Cryptographic Method \r\n | \r\n\r\n Use within the TOE \r\n | \r\n
| \r\n RSA Signature Services \r\n | \r\n\r\n Used in TLS session establishment. \r\nUsed in secure software update. \r\n | \r\n
| \r\n SP 800-90 DRBG \r\n | \r\n\r\n Used in TLS session establishment. \r\nUsed in digital certificate generation. \r\n | \r\n
| \r\n SHS \r\n | \r\n\r\n Used in secure software update. \r\nUsed in digital certificate generation. \r\n | \r\n
| \r\n HMAC-SHS \r\n | \r\n\r\n Used to provide TLS traffic integrity verification. \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n Used to encrypt TLS traffic \r\nSecure certificate storage \r\n | \r\n
TOE Provided Cryptography
\r\nEach of these cryptographic algorithms have been validated for conformance to the requirements specified in their respective standards, as identified below. Each of these algorithms are implemented as part of the OpenSSL cryptographic library, version 1.0.1.
\r\n| \r\n Algorithm \r\n | \r\n\r\n Standard \r\n | \r\n\r\n CAVP Certificate # \r\n | \r\n\r\n Processor \r\n | \r\n
| \r\n RSA \r\n | \r\n\r\n FIPS PUB 1864 (Signature generation/verification) \r\n | \r\n\r\n Cert. #1976, 1977 \r\n | \r\n\r\n Intel Xeon \r\n | \r\n
| \r\n SP 800-90 DRBG \r\n | \r\n\r\n SP 800-90 \r\n | \r\n\r\n Cert. #1103, 1104 \r\n | \r\n\r\n Intel Xeon \r\n | \r\n
| \r\n SHS \r\n | \r\n\r\n FIPS Pub 1804 \r\n | \r\n\r\n Cert. #3194, 3195 \r\n | \r\n\r\n Intel Xeon \r\n | \r\n
| \r\n HMAC-SHS \r\n | \r\n\r\n FIPS Pub 1981, FIPS Pub 1804 \r\n | \r\n\r\n Cert. #2517, 2518 \r\n | \r\n\r\n Intel Xeon \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n NIST SP 80038A \r\n | \r\n\r\n Cert. #3873, 3874 \r\n | \r\n\r\n Intel Xeon \r\n | \r\n
CAVP Algorithm Testing References
\r\nSecure Software Update
\r\nThe TOE is distributed as a Microsoft .MSI file providing a consistent and reliable versioning. After initial installation, all updates to the xAgent are distributed as .MSI. Each TOE installation and update is signed by FireEye and can only come from the HX Series appliance associated with the TOE.
\r\nProtection of the TSF
\r\nThe TOE employs several mechanisms to ensure that it is secure on the host platform. The TOE never allocates memory with both write and execute permission. The TOE is designed to operate in an environment in which the following security techniques are in effect, Data execution prevention, Mandatory address space layout randomization (no memory map to an explicit address), Structured exception handler overwrite protection, Export address table access filtering, Anti-Return Oriented Programming, and SSL/TLS certificate trust pinning. This allows the TOE to operate in an environment in which the Enhanced Mitigation Experience Toolkit is also running. During compilation the TOE is built with several flags enabled that check for engineering flaws. The TOE is built with the /GS flag enabled. This reduces the possibilities of stack-based buffer overflows in the product.
\r\nTrusted Path/Channels
\r\nThe TOE receives scanning policies from the associated HX Series appliance over the network which it uses on the host platform. This connection is always secured using TLS.
","features":[]}