The FireEye HX Series Appliances are network devices providing organizations with the ability to continuously monitor endpoints for advanced malware and indicators of compromise. The HX 4502v is a virtual appliance version of the TOE, and the hardware and virtualization layer are included in the TOE boundary. There may only be one instance of the HX 4502v virtual appliance installed on the physical hardware platform. FireEye HX series appliances are network devices that provide a managed solution for managing the security posture of connected end points. No other guest VMs providing network device functionality may be installed on the physical hardware platform. Thus, the TOE is considered to be a network device as defined in NDcPPv2.0e and a few TDs.
","evaluation_configuration":"","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the FireEye HX Series Appliances is evaluated as described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. Acumen Security determined that the evaluation is a Collaborative Protection Profile for Network Devices, Version 2.0 + Errata 20180314 (NDcPPv2.0e). The product, when delivered configured as identified in the Operational User Guidance and Preparative Procedures, satisfies all of the security functional requirements stated in the Security Target. The project underwent CCEVS Validator review. The evaluation was completed in July 2018. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"\r\n\r\nThe logical boundary of the TOE includes those security functions implemented exclusively by the TOE.
\r\nSecurity Audit
\r\nThe TOE keeps local and remote audit records of security relevant events. The TOE internally maintains the date and time which can either be set manually or synchronized with an NTP server.
\r\nCryptographic Operations
\r\nThe TOE provides cryptographic support for the services are provided in the table below.
\r\n\r\n
| \r\n Cryptographic Method \r\n | \r\n\r\n Use within the TOE \r\n | \r\n
| \r\n TLS Establishment \r\n | \r\n\r\n Used to establish initial TLS session. \r\n | \r\n
| \r\n SSH Establishment \r\n | \r\n\r\n Used to establish initial SSH session. \r\n | \r\n
| \r\n ECDSA Signature Services \r\n | \r\n\r\n Used in TLS session establishment. \r\n | \r\n
| \r\n RSA Signature Services \r\n | \r\n\r\n Used in TLS session establishment. \r\nUsed in SSH session establishment \r\nUsed in secure software update \r\n | \r\n
| \r\n SP 800-90 DRBG \r\n | \r\n\r\n Used in TLS session establishment. \r\nUsed in SSH session establishment \r\n | \r\n
| \r\n SHS \r\n | \r\n\r\n Used in secure software update \r\n | \r\n
| \r\n HMAC-SHS \r\n | \r\n\r\n Used to provide TLS traffic integrity verification \r\nUsed to provide SSH traffic integrity verification \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n Used to encrypt TLS traffic \r\nUsed to encrypt SSH traffic \r\n | \r\n
Protected Communications
\r\nThe TOE protects the integrity and confidentiality of communications such as SSH connectivity with the Management SSH Client. Additionally, the TOE provides TLS connectivity with the following entities Audit Server (with device level authentication), Management Web Browser.
\r\nSecure Administration
\r\nThe TOE enables secure local and remote management of its security functions, including:
\r\no Local console CLI administration
\r\no Remote CLI administration via SSHv2
\r\no Remote GUI administration via HTTPS/TLS
\r\no Administrator authentication using a local database
\r\no Timed user lockout after multiple failed authentication attempts
\r\no Password complexity enforcement
\r\no Role Based Access Control - the TOE supports several types of administrative user roles. Collectively these sub-roles comprise the “Security Administrator”
\r\no Configurable banners to be displayed at login
\r\no Timeouts to terminate administrative sessions after a set period of inactivity
\r\no Protection of secret keys and passwords
\r\nSelf-Test
\r\nThe TOE performs a suite of self-tests to ensure the correct operation and enforcement of its security functions.
\r\nTrusted Update
\r\nThe TOE ensures the authenticity and integrity of software updates through digital signatures and requires administrative intervention prior to the software updates being installed.
","features":[]}