The TOE supports (sometimes optionally) secure connectivity with several other IT environment devices as described below.
\r\n| \r\n Component \r\n | \r\n\r\n Required \r\n | \r\n\r\n Usage/Purpose Description \r\n | \r\n
| \r\n Management Workstation \r\n | \r\n\r\n Yes \r\n | \r\n\r\n Workstation providing local console access to the TOE. \r\nWorkstation providing a browser to connected to the Web User Interface (WUI) over TLSv1.2 or TLSv1.1. \r\n | \r\n
| \r\n Audit Server \r\n | \r\n\r\n Yes \r\n | \r\n\r\n Syslog server that receives audit logs from the TOE over TLSv1.2 or TLSv1.1. \r\n | \r\n
| \r\n ESXi Server \r\n | \r\n\r\n Yes (for Virtual LoadMaster) \r\n | \r\n\r\n ESXi v6.7 acting as the hypervisor for Virtual LoadMaster. \r\n | \r\n
| \r\n LDAP Server \r\n | \r\n\r\n No \r\n | \r\n\r\n Optional authentication server supporting LDAP over TLSv1.2 or TLSv1.1. \r\n | \r\n
| \r\n NTP Server \r\n | \r\n\r\n No \r\n | \r\n\r\n Optional NTP server supporting SHA-1 integrity verification. \r\n | \r\n
Table 1 IT Environment Components
","evaluation_configuration":"","security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Kemp LoadMaster was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. Acumen Security determined that the evaluation assurance level (EAL) for the product is EAL 1. The product, when delivered configured as identified in the AGD “Configuring LoadMaster for Common Criteria Conformance v0.2”, satisfies all the security functional requirements stated in the Kemp LoadMaster Security v0.8. The project underwent CCEVS Validator review. The evaluation was completed in January 2023. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The TOE provides the security functionality required by [NDcPP].
\r\n· Security Audit
\r\n· Cryptographic Support
\r\n· Identification and Authentication
\r\n· Security Management
\r\n· Protection of the TSF
\r\n· TOE Access
\r\n· Trusted Path/Channels
\r\nThese features are described in more detail in the subsections below.
\r\nThe TOE generates audit records for security relevant events. The audit events are associated with the administrator or processes. The audit records are transmitted over TLS to an external audit server.
\r\nThe TOE provides following cryptographic services described below.
\r\n| \r\n Service \r\n | \r\n\r\n Use \r\n | \r\n
| \r\n TLS Client \r\n | \r\n\r\n Secure connection to remote syslog servers. \r\n | \r\n
| \r\n TLS Client \r\n | \r\n\r\n Secure connection to remote LDAP server. \r\n | \r\n
| \r\n TLS/HTTPS Server \r\n | \r\n\r\n Secures connections with remote administrators. \r\n | \r\n
| \r\n Verification of Updates \r\n | \r\n\r\n Digital signature verification prior to installing an update. \r\n | \r\n
Table 2 Cryptographic Services
\r\n\r\n
Each of these cryptographic algorithms have been validated for conformance to the requirements specified in their respective standards, as identified below.
\r\n| \r\n Algorithm \r\n | \r\n\r\n CAVP Cert. \r\n | \r\n\r\n Standard \r\n | \r\n\r\n Operation/Use \r\n | \r\n\r\n SFR \r\n | \r\n
| \r\n RSA \r\n | \r\n\r\n C2076 \r\n | \r\n\r\n FIPS 186-4 \r\n | \r\n\r\n RSA 2048 SigVer \r\n | \r\n\r\n FCS_CKM.1 \r\n | \r\n
| \r\n ECDSA \r\n | \r\n\r\n C2076 \r\n | \r\n\r\n FIPS 186-4 \r\n | \r\n\r\n ECDSA P-256 SigGen, SigVer \r\nECDSA P-256, P-384, P-521 KeyGen, KeyVer \r\n | \r\n\r\n FCS_CKM.1 \r\nFCS_COP.1/SigGen \r\n | \r\n
| \r\n ECDHE \r\n | \r\n\r\n C2076 \r\n | \r\n\r\n SP 800-56Ar2 \r\n | \r\n\r\n ECDHE P-256, P-384, P-521 \r\n | \r\n\r\n FCS_CKM.2 \r\n | \r\n
| \r\n DRBG \r\n | \r\n\r\n C2076 \r\n | \r\n\r\n SP 800-90Ar1 \r\n | \r\n\r\n CTR_DRBG(AES-256) \r\n | \r\n\r\n FCS_RBG_EXT.1 \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n C2076 \r\n | \r\n\r\n FIPS 197 \r\nSP 800-38A \r\nSP 800-38D \r\n | \r\n\r\n AES in CBC and GCM modes with 128-bit and 256-bit keys \r\n | \r\n\r\n FCS_COP.1/DataEncryption \r\n | \r\n
| \r\n SHA \r\n | \r\n\r\n C2076 \r\n | \r\n\r\n FIPS 180-4 \r\n | \r\n\r\n SHA-1, SHA-256, SHA-384, SHA-512 \r\n | \r\n\r\n FCS_COP.1/Hash \r\n | \r\n
| \r\n HMAC \r\n | \r\n\r\n C2076 \r\n | \r\n\r\n FIPS 198-1 \r\n | \r\n\r\n HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384 \r\n | \r\n\r\n FCS_COP.1/KeyedHash \r\n | \r\n
Table 3 CAVP Algorithm Testing References
\r\nThe TOE provides password-based and X.509 certificate-based logon mechanisms. This password-based mechanism encores minimum length requirements. The TOE also validates and authenticates X.509 certificates when they are used to identify a remote TLS server or an administrator logging into the TOE.
\r\nThe TOE provides management capabilities via a Web-based GUI, accessed over HTTPS. Management functions allow the administrators to configure the system, install updates, and manage users.
\r\nThe TOE prevents the reading of plaintext passwords and keys. The TOE provides a reliable timestamp for its own use. The reliable timestamp can be set by a security administrator or authenticated NTP. To protect the integrity of its security functions, the TOE implements a suite of self-tests at startup and halts or disables affected functionality if a self-test fails. The TOE ensures that updates to the TOE are authenticated by verifying a digital signature prior to installing any update.
\r\nThe TOE monitors local and remote administrative sessions for inactivity and either locks or terminates the session when a threshold time period is reached. An advisory notice is displayed at the start of each session.
\r\nThe TOE initiates a TLS trusted channel with a syslog server and LDAP authentication server (as configured).
\r\nThe TOE is a TLS/HTTPS server that allows remote administrators to establish a trusted path with the TOE.
","features":[]}