This section provides an overview of the Cisco Jabber Target of Evaluation (TOE). The TOE is a VoIP client application that protects voice data in transit across a public network between itself and a remote endpoint. The TOE implements Security Real-Time Transport Protocol (SRTP) to establish a cryptographic tunnel protecting the transmission of voice data to a remote VoIP Application. In addition, Cisco Jabber protects signaling channel communications between itself and the SIP Server by using Transport Layer Security (TLS). For SIP Server call-control and management, Cisco Jabber requires Cisco Unified Communications Manager (CUCM).
\r\nThe Cisco Jabber TOE allows users in an organization to securely make, receive, and control phone calls with a variety of call-control options including mute, call transfer, call forwarding, and impromptu conferencing.
\r\nThe TOE is a VoIP client application executing on a Microsoft Windows 10 platform. It requires one of the following Common Criteria certified Microsoft Windows 10 Operating System to run:
\r\n• Microsoft Windows 10 Home Edition (32-bit and 64-bit versions)
\r\n• Microsoft Windows 10 Pro Edition (32-bit and 64-bit versions)
\r\n• Microsoft Windows 10 Enterprise Edition (32-bit and 64-bit versions)
\r\nRefer to the Microsoft Windows 10 Security Target certified on 2016-04-05 for information regarding the evaluated configuration requirements.
","evaluation_configuration":"\r\n\r\nThe TOE requires support of Cisco Unified Communications Manager (CUCM), release 11.0 or later as the SIP Server. Cisco CUCM serves as the call-processing component for voice that includes IP telephony, mobility features and calls controls. In addition, there are configuration settings pushed to the Cisco Jabber TOE that are required in the evaluated configuration. This form of management is permitted in [VoIP PP].
\r\nThe Cisco CUCM is required to deploy Cisco Jabber for On-Premise deployment scenario, that is one in which the Administrator sets up, manages, and maintains all services on the organization’s network. Additionally, Cisco Jabber must be deployed in Phone Mode, where the user's primary authentication is to Cisco Unified Communications Manager. In Phone Mode, the user is provisioned with VoIP capabilities without the functionality of presence or instant messaging (IM).
","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which Jabber 11.8 was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. Acumen Security determined that the evaluation assurance level (EAL) for the product is EAL 1. The product, when delivered configured as identified in the Common Criteria Configuration Guide, satisfies all security functional requirements stated in the Cisco Jabber for Windows 10 Security Target. The project underwent CCEVS Validator review. The evaluation was completed in April, 2017. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"\r\n\r\nThe TOE is comprised of several security features. Each of the security features identified above consists of several security functionalities, as identified below.
\r\n• Cryptographic Support
\r\n• User Data Protection
\r\n• Identification and Authentication
\r\n• Security Management
\r\n• Protection of the TSF
\r\n• Trusted Channels
\r\nThese features are described in more detail in the subsections below. In addition, the TOE implements all RFCs of the [VoIP PP], as necessary to satisfy testing/assurance measures prescribed therein.
\r\nCryptographic Support
\r\nThe TOE provides cryptography in support of SIP connections via Security Real-Time Transport Protocol (SRTP) that has been established using the Session Description Protocol (SDP) and the Security Descriptions for Media Streams (SDES) for SDP. The TOE also protects communications between itself and the CUCM SIP Server by using a Transport Layer Security (TLS)-protected signaling channel.
\r\nThe cryptographic algorithm implementation has been validated for CAVP conformance. See Table 14 in section 6 for certificate references.
\r\nThe TOE Platform provides cryptography to support digital signature verification of X.509v3 certificates used to authenticate TLS and SDES/SRTP connections.
\r\nUser Data Protection
\r\nThe TOE ensures that voice data is not transmitted when a call is placed on hold, call placed on mute, and when not connected.
\r\nIdentification and authentication
\r\nThe TOE performs authentication using passwords for SIP Register functions. The passwords must be at least eight (8) characters in length and include the use of upper and lower case characters, numbers and special characters.
\r\nThe TOE Platform validates certificates using Online Certificate Status Protocol (OCSP). The certificates are used to support authentication for SDES/SRTP and TLS connections
\r\nSecurity Management
\r\nThe TOE provides the capability to manage the following functions:
\r\n• Specify/Prompt the SIP Server to use for connections;
\r\n• Specify/Prompt the user to enter VoIP client credentials to use for connections;
\r\n• Specify/Prompt the password requirements for SIP authentications;
\r\n• Configure cryptographic algorithms;
\r\n• Ability to query the current version of the TOE; and
\r\n• Action taken when connection to verify validity of certificate cannot be established.
\r\nThe TOE supports the administrative user to perform the above security relevant management functions.
\r\nThe TOE Platform provides the capability to manage the following functions:
\r\n• Load X.509v3 certificates;
\r\n• Configure certificate revocation check; and
\r\n• Ability to update the TOE, and to verify the updates.
\r\nThe TOE Platform supports the administrative user to perform the above security relevant management functions.
\r\nProtection of the TSF
\r\nThe TOE performs a suite of self-tests during initial start-up to verify correct operation of its CAVP validated algorithms. Upon execution, the integrity of the TOE’s software executables is also verified.
\r\nThe TOE Platform provides for verification of TOE software updates prior installation.
\r\nTrusted Channels
\r\nThe TOE’s implementation of SDES-SRTP allows secure voice communications between itself and a remote VoIP application. In addition, the TOE provides secure signaling communications between itself and a remote CUCM SIP Server using TLS.
","features":[]}