IBM Security QRadar Security Intelligence Platform is also known as the IBM QRadar Security Information and Event Management (SIEM). The QRadar SIEM is a network device intended to detect potential threats through the review of audit and event data collected from network sources. The TOE is the QRadar SIEM. The TOE is administered either locally or remotely. The QRadar product consolidates log source event data from thousands of devices endpoints and applications distributed throughout a network.
","evaluation_configuration":"\r\n\r\nThe TOE is the IBM, Corp. QRadar Security Intelligence Platform, Version 7.2.7 running on Dell Model 3128C.
\r\nThe evaluated product is a single All-in-one device running QRadar SIEM w/ QFlow enabled. A QRadar QFlow collectors collect network traffic passively through network taps and span ports. A QFlow collector can detect and collect information from networked applications. The All-in-One device is a self-contained appliance running the QRadar SIEM in a Red Hat RHEL 6.7 environment. The appliance makes only those interfaces offered by QRadar available.
\r\nThe IBM All-In-One: Dell 3128C, model utilizes an x86 64-bit CPU architecture, with 4 network interface cards, and varying amounts of memory.
","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 4, September 2012. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 4, July 2012. Gossamer Security Solutions determined that the evaluation assurance level (EAL) for the TOE is EAL 1. The product, when delivered and configured as identified in the QRadar National Information Assurance Partnership (NIAP) Admin Guide – August 2017 (Admin Guide) document, satisfies all of the security functional requirements stated in the QRadar Security Intelligence Platform (NDcPP10) Security Target, Version 0.6, August 23, 2017 (ST). The project underwent CCEVS Validator review. The evaluation was completed in September 2017. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID10804-2017) prepared by CCEVS.
","environmental_strengths":"\r\n\r\nThe logical boundaries of the IBM QRadar Security Intelligence Platform 7.2.7 are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\n\r\nThe TOE generates logs for a wide range of security relevant events. The TOE can be configured to store the logs locally so they can be accessed by an administrator and also to send the logs to a designated network peer using TLS to protect data while in transit. The TOE is also capable of acting as a log storage device and receiving TLS protected communication from network peers sending audit/event data.
\r\nCryptographic support:
\r\nThe TOE utilizes NIST validated cryptographic algorithms to support key management, random bit generation, encryption/decryption, digital signature and secure hashing and key-hashing features in support of higher level cryptographic protocols including SSH and TLS.
\r\nIdentification and authentication:
\r\nThe TOE requires users to be identified and authenticated before they can use functions mediated by the TOE, with the exception of reading the login banner. The TOE authenticates administrative users. In order for an administrative user to access the TOE, a user account including a user name and password must be created for the user.
\r\nSecurity management:
\r\nThe TOE provides Command Line Interface (CLI) commands and an HTTP over TLS (HTTPS) Graphical User Interface (GUI) to access the wide range of security management functions to manage its security policies. All administrative activity and functions including security management commands are limited to authorized users (i.e., administrators) only after they have provided acceptable user identification and authentication data to the TOE. The security management functions are controlled through the use of privileges associated with roles that can be assigned to TOE users.
\r\nProtection of the TSF:
\r\nThe TOE implements a number of features designed to protect itself to ensure the reliability and integrity of its security features.
\r\nIt protects particularly sensitive data such as stored passwords and cryptographic keys so that they are not accessible even by an administrator. It also provides its own timing mechanism to ensure that reliable time information is available (e.g., for log accountability).
\r\nNote that the TOE is a single appliance, and as such, no intra-TOE communication is subject to any risks that may require special protection (e.g., cryptographic mechanisms).
\r\nThe TOE includes functions to perform self-tests so that it might detect when it is failing. It also includes support for GNU Privacy Guard (GPG) is a public key software package. GPG is used to verify signatures on product updates. The GPG signature of an update is verified against a published GPG key for IBM which is installed in the TOE.
\r\nTOE Access
\r\nThe TOE can be configured to display a logon banner before a user session is established. The TOE also enforces inactivity timeouts for local and remote sessions.
\r\nTrusted path/channels:
\r\nThe TOE protects communication channels between itself and remote administrators using HTTPS/TLS and SSH. The SSH protocol is used to protect administrative connections utilizing the TOE’s command line interface (CLI). Additionally, a web-based GUI is available for remote administration and is protected using HTTP over TLS (HTTPS).
\r\nThe TOE also protects communication with network peers using TLS. Protected communication includes the TOE’s outbound connection to an external audit server.
","features":[]}