The TOE is comprised of the Trellix Intrusion Prevention System (IPS) software running on one Trellix Intrusion Prevention System Manager Appliance and one or more Trellix Intrusion Prevention System Sensor (Sensor).
\r\nThe Trellix Intrusion Prevention System (IPS) Sensor performs stateful inspection on a per-packet basis to discover and prevent intrusions, misuse, denial of service (DoS) attacks, and distributed denial of service (DDoS) attacks. Trellix Intrusion Prevention System (IPS) is available in multiple Sensor appliances providing different bandwidth and deployment strategies.
\r\nTrellix IPS Manager (IPS Manager) is used to manage, push configuration data and policies to the Sensors. Communication between Manager and Sensors uses secure channels that protect the traffic from disclosure and modification. Authorized administrators may access the Manager via a GUI (over HTTPS) or a CLI (via SSH or a local connection). Sensors may be accessed via CLI (via SSH or a local connection) for initial setup. Once initial setup is complete, all management occurs via the Manager.
\r\nThe Sensor’s presence on the network is transparent. The Sensor is protected from the monitored networks as the system is configured to not accept any management requests or input from the monitored networks.
","evaluation_configuration":"The following environmental components are required to operate the TOE in the evaluated configuration:
\r\nTable 1 – Required Environmental Components
\r\n| \r\n Components \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n Local Management Console \r\n | \r\n\r\n Any computer using terminal emulation software to access the console interface of CLI of the Manager or Sensor. \r\n | \r\n
| \r\n Remote Management Workstation \r\n | \r\n\r\n Any computer that provides a supported browser may be used to access the Manager via the GUI or using SSH client software to access the CLI. \r\n | \r\n
| \r\n External IT systems \r\n | \r\n\r\n IT systems exchanging network traffic generate the packets that are analyzed by the TOE. \r\n | \r\n
| \r\n Update Server \r\n | \r\n\r\n An SCP server used for updating the Sensor software securely over a remote connection. \r\n | \r\n
| \r\n Syslog Server \r\n | \r\n\r\n A syslog server that constantly receives audit logs from the Manager component over a secure TLSv1.2 channel. \r\n | \r\n
This section provides an overview of the TOE architecture, including physical boundaries, security functions, and relevant TOE documentation and references.
\r\nPhysical Boundaries
\r\nThe TOE is a software and hardware Distributed TOE. It is a combination of:
\r\n· One or more IPS Sensor appliances with their software [Sensor]
\r\n· One IPS Manager appliance with its software [Manager]
\r\nEach component is delivered with the TOE software installed. The following table lists all the instances of the Sensors that are included in the evaluation. All listed Sensor appliances offer the same security functionality but vary in the type and number of processors, amount of memory, and storage.
\r\n\r\n
Table 2 - TOE Appliance Series and Models
\r\n| \r\n\r\n | \r\n\r\n CPUs \r\n | \r\n\r\n Memory (Size and Qty) \r\n | \r\n\r\n Storage \r\n | \r\n\r\n Micro-architecture \r\n | \r\n
| \r\n Trellix Intrusion Prevention System Sensor Appliances \r\n | \r\n||||
| \r\n IPS-NS9500 \r\n | \r\n\r\n 2 x XEON GOLD 6230 \r\n | \r\n\r\n 12 x 16GB \r\n | \r\n\r\n 2 x 240GB SSD \r\n | \r\n\r\n Cascade Lake \r\n | \r\n
| \r\n IPS-NS7600 \r\n | \r\n\r\n 1 x XEON SILVER 4416+ \r\n | \r\n\r\n 6 x 32GB \r\n | \r\n\r\n 1 x 400GB SSD \r\n | \r\n\r\n Sapphire Rapids \r\n\r\n | \r\n
| \r\n IPS-NS7500 \r\n | \r\n\r\n 1 x XEON GOLD 5218N \r\n | \r\n\r\n 6 x 16GB \r\n | \r\n\r\n 1 x 240GB SSD \r\n | \r\n\r\n Cascade Lake \r\n | \r\n
| \r\n IPS-NS3600 \r\n | \r\n\r\n 1 x XEON D-1734NT \r\n | \r\n\r\n 2 x 32GB \r\n | \r\n\r\n 1 x 400GB SSD \r\n | \r\n\r\n Ice Lake \r\n\r\n | \r\n
| \r\n IPS-NS3200 \r\n | \r\n\r\n 1 x ATOM C2538 \r\n | \r\n\r\n 2 x 4GB \r\n | \r\n\r\n 1 x 30GB SSD \r\n | \r\n\r\n Rangeley \r\n | \r\n
| \r\n Trellix Intrusion Prevention System Manager Appliance \r\n | \r\n||||
| \r\n NSM-MAPL-NG \r\n | \r\n\r\n 1 x XEON SILVER 4210 \r\n | \r\n\r\n 4 x 16GB \r\n | \r\n\r\n 2 x 2TB HDD \r\n | \r\n\r\n Cascade Lake \r\n | \r\n
| \r\n NSM-MAPL -NG \r\n | \r\n\r\n 1 x XEON SILVER 4114 \r\n | \r\n\r\n 4 x 16GB \r\n | \r\n\r\n 2 x 2TB HDD \r\n | \r\n\r\n Skylake \r\n | \r\n
In the evaluated configuration, the devices are placed in Network Device collaborative Protection Profile (NDcPP) mode by configuration according to the Administrative Guidance.
\r\n\r\n
","security_evaluation_summary":"
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Trellix Intrusion Prevention System Sensor and Manager Appliances were evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Rev 5.The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 Rev 5. The product, when delivered configured as identified in the Trellix Intrusion Prevention System 11.1.x Installation Guide, Trellix Intrusion Prevention System 11.1.x Product Guide, Trellix Intrusion Prevention System Manager Appliance Product Guide, Trellix Intrusion Prevention System NS-series Sensor Product Guide, Trellix Intrusion Prevention System 11.1 FIPS and CC Certification Guide,satisfies all of the security functional requirements stated in the Trellix Intrusion Prevention System Sensor and Manager Appliances version 11.1 Security Target version 1.9. The project underwent CCEVS Validator review.The evaluation was completed in May 2024. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The TOE provides the security functions required by the Collaborative Protection Profile for Network Devices, hereafter referred to as NDcPP v2.2e or NDcPP.
\r\nSecurity Audit
\r\nThe TOE generates audit records related to TOE operation and administration. These audit records are stored on the IPS Manager (and stored in a local database) and are also forwarded to an external audit server. The database stores 50,000 audit records. When the database reaches capacity, the oldest audit records are overwritten.
\r\nThe Sensor generates audit records and forwards the audit records to the IPS Manager, the Sensor caches audit records in a local file. The audit file can be uploaded to Manager (or any other SCP server using the “auditlogupoload” CLI command). If the file reaches capacity, new events are dropped.
\r\nOnly authenticated users can view audit records.
\r\nCommunication
\r\nThe TOE is a Distributed TOE. It is a combination of:
\r\n· One or more IPS Sensor appliances with their software [Sensor]
\r\n· One IPS Manager appliance with its software [Manager]
\r\nEach component is delivered with the TOE software installed. A security Administrator can enable or disable communications between any pair of TOE components. The communication between the TOE components is secured via TLS with Mutual Authentication as per the secure channel requirements in FPT_ITT.1.
\r\nCryptographic Support
\r\nThe TOE uses symmetric key cryptography to secure communication between the Sensors and the Manager for the following functionality:
\r\n· Exchange of configuration information (including IPS policies)
\r\n· Time/date synchronization from the Manager to Sensors
\r\n· Transfer of IPS data to the Manager
\r\n· Transfer of audit records to the Manager
\r\n· Distribution of TOE updates to Sensors
\r\nConnections between the Manager and Sensors are secured using TLS.
\r\nConnections between the Manager and the Audit Server (for audit record upload) are secured using TLS.
\r\nConnection between a Sensor and the Update Server is secured using SSH.
\r\nSessions between the Management Workstation and the TOE are secured using SSH or HTTPS. Administrators can connect to the Manager via HTTPS or SSH. Administrators can connect to the Sensor via SSH.
\r\nLocal console connections between the Console Workstation and the TOE are physically secured.
\r\nIdentification and Authentication
\r\nAdministrators connecting to the TOE are required to enter an IPS administrator username and password to authenticate the administrative connection prior to access being granted.
\r\nThe Manager and Sensors authenticate to one another through a shared secret that is configured during the initial installation and setup process of the TOE. Although in the evaluated configuration, the Manager supports use of a default self-signed certificate for trust establishment with the sensor, such a channel is out of scope for this evaluation. The sensor-Manager channel must be established using CA-signed certificates.
\r\nSecurity Management
\r\nAn administrative CLI can be accessed via the Console port or SSH connection, and an administrative GUI can be accessed via HTTPS. These interfaces are used for administration of the TOE, including audit log configuration, upgrade of firmware and signatures, administration of users, configuration of SSH and TLS connections.
\r\nOnly administrators authenticated to the “Admin” role are considered to be authorized administrators.
\r\nProtection of the TSF
\r\nThe presence of the Sensors' components on the network is transparent (other than network packets sent as reactions to be configured IPS conditions). The Sensors are protected from the monitored networks as the system is configured to not accept any management requests or input via the monitored interfaces.
\r\nThe TOE users must authenticate to the TOE before any administrative operations can be performed on the system.
\r\nThe TOE ensures consistent timestamps are used by synchronizing time information on the Sensors with the Manager, so that all parts of the IPS system share the same relative time information.
\r\nSynchronization occurs over a secure communications channel. Time on the Manager may be configured by an administrator.
\r\nThe administrator can query the currently installed versions of software on the Sensor using the “show” command, which returns details about the software and hardware version. A trusted update of the TOE software can be performed from the Manager UI, which is then pushed out to the Sensors.
\r\nA suite of self-tests is performed by the TOE at power on, and conditional self-tests are performed continuously.
\r\nTOE Access
\r\nThe TOE monitors local and remote administrative sessions for inactivity and terminates the session when a threshold time is reached. An advisory notice is displayed at the start of each session.
\r\nTrusted Path/Channels
\r\nThe TSF provides the following trusted communication channels:
\r\n· TLS for an audit server
\r\n· TLS for communication between Manager and Sensors
\r\n· SSH for communication with an SCP Server for updates
\r\nThe TOE implements TLS/HTTPS and SSH for protection of communications between itself and the administrators.
\r\nIntrusion Prevention
\r\nThe IPS Sensors provides the following IPS-based Functionality:
\r\n· Anomaly-based traffic patterns definition, including the specification of frequency and specific network protocol fields
\r\n· IP blocking based on known-good and known-bad list of rules, IP addresses (source, destination), ACLs, and alert filters
\r\n· IP-based network traffic analysis
\r\n· Signature-based traffic analysis
","features":[{"id":3651,"feature_name":"Asymmetric Key Generation"},{"id":3650,"feature_name":"Auditing"},{"id":3664,"feature_name":"Certificate Authentication"},{"id":3665,"feature_name":"Certificate Validation"},{"id":3656,"feature_name":"Cryptographic Hashing"},{"id":3652,"feature_name":"Cryptographic Key Establishment"},{"id":3654,"feature_name":"Cryptographic Signature Generation"},{"id":3655,"feature_name":"Cryptographic Signature Verification"},{"id":3649,"feature_name":"DRBG"},{"id":3660,"feature_name":"HTTPS Client"},{"id":3663,"feature_name":"HTTPS Server with Mutual Authentication"},{"id":3648,"feature_name":"Intrusion Prevention"},{"id":34,"feature_name":"Intrusion Prevention System (IPS)"},{"id":3653,"feature_name":"Key Destruction"},{"id":3657,"feature_name":"Keyed-hash message authentication"},{"id":3647,"feature_name":"Network Device"},{"id":3658,"feature_name":"SSH Client"},{"id":3659,"feature_name":"SSH Server"},{"id":3666,"feature_name":"TLS 1.2"},{"id":3661,"feature_name":"TLS Client"},{"id":3662,"feature_name":"TLS Server with Mutual Authentication"}]}