The Target of Evaluation (TOE) is Pure Storage, Inc's (Pure Storage) FlashArray//X running Purity//FA 5.3. The TOE is an enterprise Network Attached Storage solution that includes a Linux-based operating system, SAN (Storage Area Network) protocols and interfaces (iSCSI, Fiber Channel, SAS), and custom software to provide network storage with high performance, reliability, usability, and efficiency.
","evaluation_configuration":"The TOE consists of the following FlashArray//X (R2 and R3 families) hardware models:
\r\n\r\n
| \r\n FlashArray//X R2 Family: \r\n· X10 R2 \r\n· X20 R2 \r\n· X50 R2 \r\n· X70 R2 \r\n· X90 R2 \r\n | \r\n\r\n FlashArray//X R3 Family: \r\n· X10 R3 \r\n· X20 R3 \r\n· X50 R3 \r\n· X70 R3 \r\n· X90 R3 \r\n | \r\n
","security_evaluation_summary":"
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. Pure Storage FlashArray//X running Purity//FA 5.3 was evaluated against the criteria contained in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 Revision 5, April 2017. The TOE, when installed and configured per the instructions provided in the preparative and administrative guidance, satisfies all the security functional requirements stated in the FlashArray//X running Purity//FA 5.3 Security Target. The evaluation underwent CCEVS Validator review. The evaluation was completed in January 2021. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11076-2021) prepared by CCEVS.
","environmental_strengths":"The logical boundary of the TOE includes those security functions implemented exclusively by the TOE. Each security function is summarized below.
\r\nAudit
\r\nCryptographic Operations
\r\nThe TSF performs the following cryptographic operations:
\r\necdh-sha2-nistp521
\r\n§ TLS_RSA_WITH_AES_128_CBC_SHA
\r\n§ TLS_RSA_WITH_AES_256_CBC_SHA
\r\n§ TLS_DHE_RSA_WITH_AES_128_CBC_SHA
\r\n§ TLS_DHE_RSA_WITH_AES_256_CBC_SHA
\r\n§ TLS_RSA_WITH_AES_128_CBC_SHA256
\r\n§ TLS_RSA_WITH_AES_256_CBC_SHA256
\r\n§ TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
\r\n§ TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
\r\n§ TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
\r\n§ TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
\r\n§ TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
\r\n§ TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
\r\n§ TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
\r\n§ TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
\r\n§ TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
\r\n§ TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
\r\nThe TSF zeroizes all plaintext secret and private cryptographic keys and CSPs once they are no longer required.
\r\nIdentification and Authentication
\r\no Display the warning banner in accordance with FTA_TAB.1,
\r\no Respond to ICMP Echo Request,
\r\no Respond to ARP requests with ARP replies,
\r\no Make DNS Requests,
\r\no Respond to HTTP Get Requests on TCP port 80 with a HTTP 301 ‘Moved Permanently’ Status, Code redirecting to TCP port 443,and
\r\no Respond to TLS Client_Hello messages with TLS Server_Hello messages on TCP port 443.
\r\n\r\nProtection of the TSF
\r\nTOE Access
\r\nTrusted Path/Channels
\r\nNote: NTP functionality is unevaluated; Security Administrative users are instructed to disable NTP functionality in the evaluated configuration.
","features":[]}