The AhnLab MDS protection system mitigates Advanced Persistent Threat (APT) attacks by identifying known and unknown malware, detecting suspicious traffic, and removing the detected threats. The AhnLab MDS is a malware detection system that inspects network traffic and initiates intrusion mitigation. It is not a network communication filtering device (i.e., not a firewall).
\r\nThe Target of Evaluation (TOE) is the AhnLab MDS, MDS with MTA, and MDS Manager V2.1 as follows:
\r\n| \r\n Product Series \r\n | \r\n\r\n Specific Product Device \r\n | \r\n
| \r\n MDS \r\n | \r\n\r\n MDS 1000 \r\n | \r\n
| \r\n MDS 2000 \r\n | \r\n|
| \r\n MDS 6000 \r\n | \r\n|
| \r\n MDS10000 \r\n | \r\n|
| \r\n MDS with MTA \r\n | \r\n\r\n MDS 6000 \r\n | \r\n
| \r\n MDS 10000 \r\n | \r\n|
| \r\n MDS Manager \r\n | \r\n\r\n MDS Manager 2000 \r\n | \r\n
| \r\n MDS Manager 5000R \r\n | \r\n|
| \r\n MDS Manager 10000R \r\n | \r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
AhnLab Malware Defense System (MDS) and MDS with MTA are network devices that provide malware detection for enterprise network security, protecting networks from Advanced Persistent Threat attacks, and provide the capability to immediately respond to remediate infected end-point systems. MDS with MTA also provides MTA functionality via purchase of separate license. MDS Manager is a network device without malware detection capabilities. In a distributed architecture, the MDS Manager Series Appliances also provide the capability to remotely manage multiple MDS and MDS/MTA appliances. However since distributed architectures are not included in the TOE, this capability is not evaluated. Each network device in the TOE: MDS, MDS with MTA, and MDS Manager provides all of the security requirements defined by the NDcPP including Security Audit, Cryptographic Support, Identification and Authentication, Security Management, Protection of the TSF, TOE Access, and Trusted path/channels.
\r\nThe TOE consists of the following appliances: MDS, or MDS with MTA, or MDS Manager identified above; and the software installed on the appliance. Each TOE instance consists of a single appliance and is capable of providing all security functions specified in NDcPP.
","evaluation_configuration":"","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the AhnLab MDS, MDS with MTA, and MDS Manager V2.1 were judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. The product, when delivered and configured as identified in the AhnLab MDS V2.1, MDS Manager V2.1, and MDS (MTA License Applied) V2.1 Configuring Common Criteria Compliance Guide, satisfies all of the security functional requirements stated in the AhnLab MDS, MDS with MTA, and MDS Manager V2.1 Security Target, Version 0.3, April 26. 2017. The project underwent CCEVS Validator review. The evaluation was completed in April 2017. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"\r\n\r\nSecurity Audit
\r\nThe TOE generates security relevant audit records including administrative activity. The audit records are stored on the TOE, protected from unauthorised deletion and can be sent to a remote audit server for storage. The connection for transmission of audit records uses TLS.
\r\nCryptographic support
\r\nThe TOE includes cryptographic functionality that provide random bit-generation, encryption/decryption, digital signature, secure hashing and key-hashing features. These features support cryptographic protocols including SSH, TLS and HTTPS.
\r\nIdentification and Authentication
\r\nThe TOE identifies and authenticates all users prior to granting them access to the Web Management or Command Line interfaces. The TOE provides the ability to define administrative accounts that have permission to view and/or modify TOE configuration variables. Each of these administrative accounts has its own password.
\r\nThe TOE provides Password Management restrictions including support for minimum characters, and restrictions for character usage.
\r\nThe TOE provides X.509 Certificate Validation, Authentication, and X.509 Certificate Requests for certificates used in trusted channel protocols.
\r\nSecurity Management
\r\nThe TOE offers two administrative interfaces a Command Line Interface (CLI) provided at a local console as well as through SSH and a graphical user interface provided through TLS/HTTPS. Both interfaces require a username and password prior to allowing any administrative actions to define accounts and configure TOE functionality. SSH also supports authentication via public-key. The System Administrator is considered to be the authorized Security Administrator of the TOE (as defined in the [NDcPP]). The TOE provides functions to manage the TOE and TOE data.
\r\nProtection of the TSF
\r\nThe TOE implements a number of features designed to protect itself to ensure the reliability and integrity of its security features.
\r\nThe TOE ensures that sensitive information such as passwords and cryptographic keys are stored such that they are not accessible even to an administrator. The TOE provides its own internal clock which it uses to provide a reliable time source for audit records.
\r\nThe TOE includes functions to perform self-tests and mechanisms for the update of the TOE software/firmware.
\r\nTOE Access
\r\nThe TOE can be configured to display an informative banner when an administrator establishes an interactive session. The TOE can also enforce an administrator-defined inactivity timeout value after which the inactive session (local or remote) will be terminated. Finally, the TOE allows administrators to terminate their own session.
\r\nTrusted Path/Channels
\r\nThe TOE protects administrator communications from network workstations using SSHv2, TLS v1.1 and TLS v1.2 depending upon the interface being accessed. The administrative Command Line Interface is access through the SSHv2 protocol, while TLS/HTTPS is used for the Web Management interface. In each case, both integrity and disclosure protection is ensured by the protocol being used. If the negotiation of an encrypted session fails or if the user does not have authorization for remote administration, an attempted connection is not established.
\r\nThe TOE protects communication with an external log server to prevent unintended disclosure or modification of audit records.
","features":[]}