The Citrix ADC (formerly NetScaler) is an Application Delivery Controller that accelerates application performance, enhances application availability with advanced Layer 4 – Layer 7 load balancing, secures applications from attacks, and lowers server expenses by offloading computationally intensive tasks. The TOE comprises Citrix ADC running on the following hardware appliances.
\r\n\r\n
· MPX 14030 FIPS
\r\n· MPX 14060 FIPS
\r\n· MPX 14080 FIPS
\r\nCitrix MPX 14XXX FIPS appliances are network devices that combine Layer 4 - Layer 7 load balancing and content switching with application acceleration, data compression, static and dynamic content caching, SSL acceleration, network optimization, application performance monitoring, application visibility, and robust application security via an application firewall. The ADC appliance supports NIST-approved FIPS 140-2 algorithms.
\r\n","evaluation_configuration":"","security_evaluation_summary":"
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Citrix ADC Platinum Edition Version 11.1 is evaluated as described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. Acumen Security determined that the evaluation is a collaborative Protection Profile for Network Devices v2.0 (NDcPP). The product, when delivered configured as identified in the Operational User Guidance and Preparative Procedures, satisfies all of the security functional requirements stated in the Security Target. The project underwent CCEVS Validator review. The evaluation was completed in September 2019. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"\r\nThe logical boundary of the TOE includes those security functions implemented exclusively by the TOE.
\r\nSecurity Audit
\r\nThe TOE keeps local and remote audit records of security relevant events.
\r\nCryptographic Support
\r\nThe TOE provides cryptographic support for the SSH and TLS protocols. The related FIPS 140-2 validation details are provided in Table 1.
\r\n| \r\n\r\n | \r\n\r\n\r\n | \r\n\r\n Standard \r\n | \r\n\r\n Operation \r\n | \r\n\r\n SFR \r\n | \r\n
| \r\n NITROXIII CNN3560-NFBE-G Algorithms (CMVP Cert. #2850) \r\n | \r\n||||
| \r\n RSA \r\n | \r\n\r\n 1634 \r\n | \r\n\r\n FIPS 186-4 \r\n | \r\n\r\n Signature Verification \r\n | \r\n\r\n FCS_COP.1/SigGen \r\n | \r\n
| \r\n DRBG \r\n | \r\n\r\n 680 \r\n | \r\n\r\n SP 800-90A \r\n | \r\n\r\n Random Bit Generation \r\n | \r\n\r\n FCS_RBG_EXT.1 \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n 2034 \r\n3205 \r\n | \r\n\r\n AES specified in ISO 18033-3 \r\nCBC specified in ISO 10116 \r\n | \r\n\r\n TLS Encryption/Decryption \r\nDRBG Primitive \r\n | \r\n\r\n FCS_COP.1/DataEncryption \r\n | \r\n
| \r\n SHA \r\n | \r\n\r\n 1780 \r\n | \r\n\r\n ISO/IEC 10118-3:2004 \r\n | \r\n\r\n Hashing \r\n | \r\n\r\n FCS_COP.1/Hash \r\n | \r\n
| \r\n\r\n | \r\n\r\n 1233 \r\n | \r\n\r\n ISO/IEC 9797-2:2011 \r\n | \r\n\r\n Keyed-Hashing \r\n | \r\n\r\n FCS_COP.1/KeyedHash \r\n | \r\n
| \r\n Citrix FIPS Cryptographic Module Algorithms (CMVP Cert. #2988) \r\n | \r\n||||
| \r\n RSA \r\n | \r\n\r\n 2379 \r\n | \r\n\r\n FIPS 186-4 \r\n | \r\n\r\n Key Generation \r\nSignature Generation/Verification \r\n | \r\n\r\n FCS_CKM.1 \r\nFCS_COP.1/SigGen \r\n | \r\n
| \r\n ECDSA \r\n | \r\n\r\n 1056 \r\n | \r\n\r\n FIPS 186-4 \r\n | \r\n\r\n Key Generation \r\n | \r\n\r\n FCS_CKM.1 \r\n | \r\n
| \r\n DRBG \r\n | \r\n\r\n 1417 \r\n | \r\n\r\n SP 800-90A \r\n | \r\n\r\n Random Bit Generation \r\n | \r\n\r\n FCS_RBG_EXT.1 \r\n | \r\n
| \r\n SHA \r\n | \r\n\r\n 3626 \r\n | \r\n\r\n ISO/IEC 10118-3:2004 \r\n | \r\n\r\n Hashing \r\n | \r\n\r\n FCS_COP.1/Hash \r\n | \r\n
| \r\n HMAC \r\n | \r\n\r\n 2923 \r\n | \r\n\r\n ISO/IEC 9797-2:2011 \r\n | \r\n\r\n Keyed-Hashing \r\n | \r\n\r\n FCS_COP.1/KeyedHash \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n 4397 \r\n | \r\n\r\n AES specified in ISO 18033-3 \r\nCBC specified in ISO 10116 \r\nCTR specified in ISO 10116 \r\n | \r\n\r\n SSH Encryption/ Decryption \r\nDRBG Primitive \r\n | \r\n\r\n FCS_COP.1/DataEncryption \r\n | \r\n
| \r\n CVL (SP800-56A) \r\n | \r\n\r\n 1106 \r\n | \r\n\r\n SP 800-56A \r\n | \r\n\r\n Key Establishment \r\n | \r\n\r\n FCS_CKM.2 \r\n | \r\n
Table 1 CAVP Algorithm Testing References
\r\n\r\n
Identification and Authentication
\r\nThe TOE provides two types of authentication to provide a trusted means for Security Administrators and remote endpoints to interact: X.509v3 certificate-based authentication for remote devices and password-based or public-key authentication for Security Administrators. Device-level authentication allows the TOE to establish a secure communication channel with a remote endpoint.
\r\nSecurity Administrators can set a minimum length for passwords (between 4 and 127 characters). Additionally, the TOE detects and tracks consecutive unsuccessful remote authentication attempts and will prevent the offending attempts from authenticating when a Security Administrator defined threshold is reached.
\r\nSecurity management
\r\nThe TOE enables secure local and remote management of its security functions, including:
\r\no Local console CLI administration
\r\no Remote CLI administration via SSHv2
\r\no Administrator authentication using a local database
\r\no Timed user lockout after multiple failed authentication attempts
\r\no Password complexity enforcement
\r\no Role Based Access Control - the TOE supports several types of administrative user roles. Collectively these sub-roles comprise the “Security Administrator”
\r\no Configurable banners to be displayed at login
\r\no Timeouts to terminate administrative sessions after a set period of inactivity
\r\no Protection of secret keys and passwords
\r\n\r\n
Protection of the TSF
\r\nThe TOE ensures the authenticity and integrity of software updates through hash comparison and requires administrative intervention prior to the software updates being installed.
\r\n\r\n
TOE Access
\r\nPrior to login, the TOE displays a banner with a message configurable by the Security Administrator. The TOE terminates user connections after an Authorized Administrator configurable amount of time.
\r\nTrusted Path Channels
\r\nThe TOE uses TLS to provide a trusted channel between itself and remote syslog and LDAP servers.
\r\nThe TOE uses SSH to provide a trusted path between itself and remote administrators.
\r\n\r\nHardware and software located in the TOE environment are not included in the scope of the evaluation.
\r\nOnly security functionality specified in the SFRs and TSS is covered by the scope of evaluation against this Security Target. The following other product features or functionality are considered unevaluated, because they are not included in the scope of the Security Target:
\r\n· Web Logging
\r\n· Application Firewall
\r\n· Global Server Load Balancing (GSLB)
\r\n· AAA-TM Authentication
\r\n· External authentication methods: Kerberos, TACACS+, SAML, RADIUS
\r\n· Responder
\r\n· Rewrite (URL Transformation)
\r\n· Layer 3 Routing
\r\n· Vpath
\r\n· RISE
\r\n· High Availability
\r\n· CloudBridge
\r\n· CallHome
\r\n· Integrated Disk Caching
\r\n· General TLS VPN functionality
\r\n· Clientless VPN functionality
\r\n· SSL acceleration – SSL termination for application servers
\r\n· AppFlow
\r\n· AppQoE
\r\n· BGP
\r\n· Cache Redirection
\r\n· Compression Control
\r\n· Content Accelerator
\r\n· Content Filtering
\r\n· Content Switching
\r\n· FEO
\r\n· OSPF
\r\n· LSN
\r\n· RDP Proxy
\r\n· RIP
\r\n· HTM Injection
\r\n· Http DoS Protection
\r\n· Integrated Caching
\r\n· Surge Protection
\r\n· ISIS
\r\n· Priority Queuing
\r\n· Reputation
\r\n· Sure Connect
\r\n· NetScaler Push
\r\n\r\n\r\n
\r\n
Additionally, the following features may not be used when the TOE is operated in a manner compliant with this Security Target:
\r\n\r\n
· IPv6
\r\n· NTP based updates to the time
\r\n· Use of superuser privileges except as described in [CCECG]
\r\n· ADC GUI (HTTP/HTTPS), ADC Nitro API and ADM
\r\n","features":[]}