The Cisco 1000V Cloud Services Router TOE is a software-only virtual form factor router that securely connects distributed sites within an organization. For example, the Cisco 1000V Cloud Services Router allows an organization to extend a remote branch office site to its data center. Alternatively, for cloud service providers, it connects a tenant’s network to the organization’s data center or headend site.
","evaluation_configuration":"","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Cisco CSR 1000V routers were judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. The product, when delivered configured as identified in the Cisco CSR Common Criteria Configuration Guide document, satisfies all of the security functional requirements stated in the Cisco Cloud Services Router VPN Client Security Target, Version 1.0. The project underwent CCEVS Validator review. The evaluation was completed in November 2016. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"\r\n\r\nCryptographic Support
\r\nThe TOE provides cryptography in support of:
\r\n· Symmetric cryptography for bulk AES encryption/decryption
\r\n· Diffie-Hellman key exchange
\r\n· DRBG
\r\n· Asymmetric cryptography for digital signatures (RSA/ECDSA), hashing, and HMAC services
\r\n· Asymmetric cryptography for IKE peer authentication using X.509 digital certificates
\r\nThe cryptographic algorithm implementation has been validated for CAVP conformance.
\r\nIdentification and Authentication
\r\nThe TOE performs device-level authentication of the remote device (IPsec peers or VPN Gateway). Device-level authentication allows the TOE to establish a secure channel with a trusted peer. The secure channel is established only after each device authenticates the other. Device-level authentication is performed via IKE/IPsec mutual authentication. The TOE uses X.509v3 certificates as defined by RFC 5280 to support authentication for IPsec sessions.
\r\nSecurity Management
\r\nThe TOE provides all the capabilities necessary to securely manage the TOE. The administrative user can connect to the TOE using the CLI to perform these functions via IPsec, SSH, a terminal server, or at the local console. Refer to the Guidance documentation for configuration syntax, commands, and information related to each of these functions. All of these functions can be performed via the CLI either locally or remotely.
\r\nProtection of the TSF
\r\nThe TOE runs a suite of self-tests during initial start-up to verify correct operation of cryptographic modules. If any of the tests fail, the Authorized Administrator will have to log into the CLI to determine which test failed and why. If the tests pass successfully the POST event logs will show successful for each test. During the system boot process (power on or reboot), all the Power on Startup Test (POST) components for all the cryptographic modules perform the POST for the software component.
\r\nThe TOE has specific versions that can be queried by an administrator. When updates are made available by Cisco, an administrator can obtain and install those updates. The updates can be downloaded from the Cisco.com web site. Authorized Administrators can download the Common Criteria evaluated software image file from Cisco.com onto a trusted computer system for usage in the trusted update functionality. Software images are available from Cisco.com at the following: http://www.cisco.com/cisco/software/navigator.html
\r\nWhen a replacement image is installed on the TOE, the digital signature will be validated and the image will be successfully installed. When an invalid image is attempted to be installed, the administrator, after loading the image onto the device, needs to perform a verify operation to confirm if it is valid. The TOE will identify if the image is valid or not, and then the administrator will manually reject a bad image and does not proceed with the installation.
\r\nTrusted Path/Channels
\r\nThe TOE implements IPsec to protect communications with peer devices.
\r\nUser Data Protection
\r\nThe TOE platform ensures that residual information from previously sent network packets processed through the platform are protected from being passed into subsequent network packets.
","features":[]}