The Target of Evaluation (TOE) is RSA Identity Governance and Lifecycle v7.0.1.
\r\nRSA Identity Governance and Lifecycle is a platform that helps organizations meet their security, regulatory, and business access needs through a collaborative set of business processes. By automating manual access control tasks, providing access management workflows to gather the appropriate business approvals, and gathering evidence of compliance to access control policy, organizations can confidently manage, control, and enforce access to applications and data, across their organization. This functionality is enabled by a set of collectors that gather user credentials and access information from various repositories and store it in a central data repository. RSA Identity Governance and Lifecycle also provides a set of data connectors to provision external data repositories with updated information.
\r\nThe RSA Identity Governance and Lifecycle platform contains functionality that is not covered by Standard Protection Profile for Enterprise Security Management Identity and Credential Management. As with all evaluations claiming conformance to a NIAP-approved protection profile, only the functionality specified in the profile is evaluated. The RSA Identity Governance and Lifecycle v7.0.1 TOE consists of the following platform components:
\r\n· Access Certification Manager
\r\n· Business Role Manager
\r\n· Access Request Manager
\r\n· Rules
\r\n· Access Fulfillment Express (AFX)
\r\n· Collectors (agents)
\r\n· Graphical User Interface (GUI), and
\r\n· Web Services API.
\r\nThe TOE components identified above collectively provide functionality defined in the Standard Protection Profile for Enterprise Security Management Identity and Credential Management. Specifically the functionality included in the evaluation is:
\r\n· Provision subjects (enroll new subjects to an organizational repository, associate and disassociate subjects with organizationally-defined attributes)
\r\n· Issue and maintain credentials associated with user identities
\r\n· Publish and change credential status (such as active, suspended or terminated)
\r\n· Enforce password strength rules for enterprise users
\r\n· Establish appropriate trusted channels between itself and Authentication Server ESM products
\r\n· Generate an audit trail of configuration changes and subject identification and authentication activities
\r\n· Write audit trail data to a trusted repository
","evaluation_configuration":"","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the RSA Identity Governance and Lifecycle v7.0.1 was judged are described in Standard Protection Profile for Enterprise Security Management Identity and Credential Management (Version 2.1, 24 October 2013) and the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 revision 4 as refined by the assurance activities in the protection profile. The product satisfies all of the security functional requirements stated in the RSA Identity Governance and Lifecycle v7.0.1 Security Target, version 1.0, 11 April 2017, when delivered and configured as identified in the following documents:
\r\n· RSA Identity Governance and Lifecycle Supplemental Administrative Guidance V7.0.1
\r\n· RSA Identity Governance and Lifecycle7.0.1 Release Notes
\r\n· RSA Identity Governance and Lifecycle7.0.1 Installation Guide
\r\n· RSA Identity Governance and Lifecycle7.0.1 Upgrade and Migration Guide
\r\n· RSA Identity Governance and Lifecycle7.0.1 Help (Built-in Documentation)
\r\n· RSA Identity Governance and Lifecycle7.0.1 Database Setup and Management Guide
\r\n· RSA Identity Governance and Lifecycle7.0.1 Public Database Schema Reference
\r\n· RSA Identity Governance and Lifecycle Active Directory Application Guide, Version 1.1 | Nov 2016
\r\n· RSA Identity Governance and Lifecycle Connector Data Sheet for Oracle Database
\r\n· RSA Identity Governance and Lifecycle Collector Data Sheet for Oracle Database.
\r\nThe project underwent CCEVS Validator review. The evaluation was completed in May 2017. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"\r\n\r\nEnterprise Security Management
\r\nThe TOE maintains security attributes belonging to individual objects and relies on Active Directory in the operational environment to authenticate users.
\r\nThe TOE provides the capability to define and securely transmit identity and credential data for use with other ESM products: Oracle and Active Directory authentication servers. The TOE provides a password restriction policy mechanism to ensure secure passwords are defined for enterprise users.
\r\nSecurity Audit
\r\nThe TOE generates logs for security relevant events including the events specified in Standard Protection Profile for Enterprise Security Management Identity and Credential Management. The TOE sends the logs to an Oracle database external to the TOE for storage. Reliable timestamps are provided by the operational environment.
\r\nIdentification and Authentication
\r\nThe TOE associates roles, entitlements, and other user attributes with enterprise users and relies on the operational environment to authenticate enterprise users.
\r\nSecurity Management
\r\nThe TOE provides the management functions identified in the Standard Protection Profile for Enterprise Security Management Identity and Credential Management such as management of subject attributes; authentication data; configuration and management of the security functions; and management of the users that belong to a particular role. The TOE restricts access to the management functions to users with the following roles: the System Administrator Role, Application Administrator Role, Password Management Role, Role Administrator Role, and Access Request Administrator Role and to users with entitlements to the functions. The TOE maintains all Administrator roles.
\r\nProtection of the TSF
\r\nCredentials/keys used by the TOE are stored in the operational environment. The TOE does not offer any interfaces to view the credentials/keys.
\r\nTOE Access
\r\nThe TOE terminates local and remote interactive sessions after a System Administrator configurable time period of inactivity. It provides users the capability to terminate their own interactive sessions. An administrator can configure an advisory warning message regarding unauthorized use of the TOE, which the TOE displays before establishing a user session using the GUI.
\r\nTrusted Path/Channels
\r\nThe TOE provides trusted communication channels using TLS v1.1 and TLS v1.2 for Active Directory authentication and transfer of policy data.
\r\nThe TOE provides trusted communication paths using TLS v1.1 and TLS v1.2 for remote administrators and users accessing the GUI and for Web Service Clients accessing the Web Services API.
\r\nThe TOE relies on BSAFE Crypto-J 6.2.1 in the operational environment for cryptographic functions. In particular, the module is used for TLS v1.1 and v1.2 connections with trusted external IT entities, and with users accessing the TOE. The TOE itself does not implement any cryptographic functions. Consequently, the Cryptographic Support (class FCS) requirements from the Architectural Variations section of the ESM ICM PP do not apply to the TOE. The security target does not claim any requirements from the FCS class and so the FCS requirements were outside the scope of evaluation and were not evaluated.
","features":[]}