The FireEye CM Series is a group of management platforms that consolidates the administration, reporting, and data sharing of the FireEye NX Series in one easy-to-deploy, network-based platform. Within the FireEye deployment, the FireEye CM enables real-time sharing of the auto-generated threat intelligence to identify and block advanced attacks targeting the organization. It also enables centralized configuration, management, and reporting of FireEye platforms.
\r\nFireEye CM Series Appliances are network devices. Each appliance runs a custom-built hardened version of Linux with only the required services enabled. TOE Description
\r\nThe TOE is comprised of several models of the FireEye CM Series Appliances as shown below.
\r\n| \r\n \r\n | \r\n\r\n CM 4500 \r\n | \r\n\r\n CM 7500 \r\n | \r\n\r\n CM 9500 \r\n | \r\n
| \r\n Network Ports \r\n | \r\n\r\n 2x 10/100/1000BASE-T Ports \r\n | \r\n\r\n 2x 10/100/1000BASE-T Ports \r\n | \r\n\r\n 2x 10/100/1000BASE-T Ports \r\n | \r\n
| \r\n Storage \r\n | \r\n\r\n 4x 600 GB HDD, RAID 10, 2.5 inch \r\n | \r\n\r\n 4x 600 GB HDD, RAID 10, 2.5 inch \r\n | \r\n\r\n 4x 800 GB SSD, RAID 10, 2.5 inch \r\n | \r\n
| \r\n Enclosure \r\n | \r\n\r\n 1RU, Fits 19 inch Rack \r\n | \r\n\r\n 2RU, Fits 19 inch Rack \r\n | \r\n\r\n 2RU, Fits 19 inch Rack \r\n | \r\n
| \r\n Software \r\n | \r\n\r\n Version 8.0 \r\n | \r\n\r\n Version 8.0 \r\n | \r\n\r\n Version 8.0 \r\n | \r\n
\r\n
| \r\n \r\n | \r\n\r\n CM2500V \r\n | \r\n\r\n CM7500V \r\n | \r\n
| \r\n Hypervisor \r\n | \r\n\r\n VMWare ESXi \r\n | \r\n\r\n VMWare ESXi \r\n | \r\n
| \r\n Platform \r\n | \r\n\r\n Dell 630R \r\n | \r\n\r\n Dell 630R \r\n | \r\n
| \r\n Software \r\n | \r\n\r\n Version 8.0 \r\n | \r\n\r\n Version 8.0 \r\n | \r\n
The TOE evaluated configuration consists of one of the appliances listed above. The TOE supports secure connectivity with several IT environment devices as shown below.
\r\n| \r\n Component \r\n | \r\n\r\n Required \r\n | \r\n\r\n Usage/Purpose Description for TOE performance \r\n | \r\n
| \r\n Management Workstation with Web Browser/SSH Client \r\n | \r\n\r\n Yes \r\n | \r\n\r\n This includes any IT Environment Management workstation with a Web Browser and a SSH client installed that is used by the TOE administrator to support TOE administration through HTTPS and SSH protected channels. Any SSH client that supports SSHv2 may be used. Any web browser that supports TLS 1.1 or greater may be used. \r\n | \r\n
| \r\n NTP Server \r\n | \r\n\r\n No \r\n | \r\n\r\n The TOE supports communications with an NTP server to synchronize date and time. \r\n | \r\n
| \r\n Syslog server \r\n | \r\n\r\n No \r\n | \r\n\r\n The syslog audit server is used for remote storage of audit records that have been generated by and transmitted from the TOE. The syslog server must support communications using TLS 1.1 or TLS 1.2. \r\n | \r\n
| \r\n LDAP AAA Server \r\n | \r\n\r\n No \r\n | \r\n\r\n This includes any IT environment LDAP AAA server that provides authentication services to TOE administrators. The LDAP server must support communications using TLS 1.1 or TLS 1.2. \r\n | \r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the FireEye CM Series Appliances were evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. Acumen Security determined that the evaluation assurance level (EAL) for the product is EAL 1. The product, when delivered and configured as identified in the “FireEye CM Series Appliances Common Criteria Addendum,” satisfies all of the security functional requirements stated in the “FireEye CM Series Appliances Security Target.” The project underwent CCEVS Validator review. The evaluation was completed in January 2018. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"\r\n\r\nThe TOE provides the following security functions:
\r\no TLS connectivity with the following entities:
\r\n§ External LDAP Server (with device level authentication)
\r\n§ Audit Server (with device level authentication)
\r\n§ Management Web Browser
\r\no SSH connectivity with the following entities:
\r\n§ Management SSH Client
\r\n\r\n
o Local console CLI administration
\r\no Remote CLI administration via SSHv2
\r\no Remote GUI administration via HTTPS/TLS
\r\no Administrator authentication using a local database, via LDAP over TLS, or via X.509 certificates to the remote GUI
\r\no Password complexity enforcement
\r\no Role Based Access Control - the TOE supports several types of administrative user roles. Collectively these sub-roles comprise the “Security Administrator”
\r\no Configurable banners to be displayed at login
\r\no Timeouts to terminate administrative sessions after a set period of inactivity
\r\no Protection of secret keys and passwords
\r\n| \r\n Cryptographic Method \r\n | \r\n\r\n Use within the TOE \r\n | \r\n
| \r\n TLS Establishment \r\n | \r\n\r\n Used to establish initial TLS session. \r\n | \r\n
| \r\n SSH Establishment \r\n | \r\n\r\n Used to establish initial SSH session. \r\n | \r\n
| \r\n ECDSA Signature Services \r\n | \r\n\r\n Used in TLS session establishment. \r\n | \r\n
| \r\n RSA Signature Services \r\n | \r\n\r\n Used in TLS session establishment. \r\nUsed in SSH session establishment \r\nUsed in secure software update \r\n | \r\n
| \r\n SP 800-90 DRBG \r\n | \r\n\r\n Used in TLS session establishment. \r\nUsed in SSH session establishment \r\n | \r\n
| \r\n SHS \r\n | \r\n\r\n Used in secure software update \r\n | \r\n
| \r\n HMAC-SHS \r\n | \r\n\r\n Used to provide TLS traffic integrity verification \r\nUsed to provide SSH traffic integrity verification \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n Used to encrypt TLS traffic \r\nUsed to encrypt SSH traffic \r\n | \r\n
The related algorithm validation details are provided in the following table.
\r\n| \r\n\r\n | \r\n\r\n CAVP Cert # \r\n | \r\n\r\n Standard \r\n | \r\n\r\n Operation \r\n | \r\n\r\n SFR \r\n | \r\n
| \r\n RSA \r\n | \r\n\r\n 2605 \r\n | \r\n\r\n FIPS 186-4 \r\n | \r\n\r\n Key Generation \r\nSignature Generation/Verification \r\n | \r\n\r\n FCS_CKM.1 \r\nFCS_COP.1(2) \r\n | \r\n
| \r\n DSA \r\n | \r\n\r\n 1286 \r\n | \r\n\r\n FIPS 186-4 \r\n | \r\n\r\n Key Generation \r\n | \r\n\r\n FCS_CKM.1 \r\n | \r\n
| \r\n ECDSA \r\n | \r\n\r\n 1193 \r\n | \r\n\r\n FIPS 186-4 \r\n | \r\n\r\n Key Generation \r\nSignature Generation/Verification \r\n | \r\n\r\n FCS_CKM.1 \r\nFCS_COP.1(2) \r\n | \r\n
| \r\n SP 800-90 DRBG \r\n | \r\n\r\n 1638 \r\n | \r\n\r\n SP 800-90A \r\n | \r\n\r\n Random Bit Generation \r\n | \r\n\r\n FCS_RBG_EXT.1 \r\n | \r\n
| \r\n SHS \r\n | \r\n\r\n 3904 \r\n | \r\n\r\n ISO/IEC 10118-3:2004 \r\n | \r\n\r\n Hashing \r\n | \r\n\r\n FCS_COP.1(3) \r\n | \r\n
| \r\n HMAC-SHS \r\n | \r\n\r\n 3172 \r\n | \r\n\r\n ISO/IEC 9797-2:2011 \r\n | \r\n\r\n Keyed-Hashing \r\n | \r\n\r\n FCS_COP.1(4) \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n 4761 \r\n | \r\n\r\n AES specified in ISO 18033-3 \r\nCBC specified in ISO 10116 \r\nGCM specified in ISO 19772 \r\n | \r\n\r\n Encryption/ Decryption \r\n | \r\n\r\n FCS_COP.1(1) \r\n | \r\n
| \r\n CVL \r\n | \r\n\r\n 1406 \r\n | \r\n\r\n SP 800-56A \r\n | \r\n\r\n Key Establishment \r\n | \r\n\r\n FCS_CKM.2 \r\n | \r\n
| \r\n RSA \r\n | \r\n\r\n N/A \r\n | \r\n\r\n SP 800-56B (Vendor Affirmed) \r\n | \r\n\r\n Key Establishment \r\n | \r\n\r\n FCS_CKM.2 \r\n | \r\n
Each of the algorithms included in the table above is implemented by the “FireEye Cryptographic Implementation” cryptographic module.
","features":[]}