Venafi Trust Protection Platform is a windows application that secures and protects keys and certificates. This protection improves security posture with increased visibility, threat intelligence, policy enforcement, and faster incident response for certificate-related outages and compromises leveraging misused keys and certificates.
\r\nThe platform supports all Venafi products and provides native integration with thousands of applications and common APIs for the extensive security ecosystem. Shared and extensible services enable enterprises to gain complete visibility into their key and certificate inventory, identify certificate reputation, and establish a baseline. The entire issuance and renewal process can be automated with policy enforcement and workflows, enabling new encryption dependent applications to be scaled quickly. Trust Protection Platform keeps organizations secure, helping them comply with standards and remediate key and certificate misuse.
\r\nThe description above provides a general description of the functionality provided by the Venafi Trust Protection Platform.
","evaluation_configuration":"The TOE boundary is the application software which runs on the host platform. The TOE is a Windows Application. For this evaluation the TOE runs on Windows Server 2016 Standard configured in FIPS mode running on a server with an Intel Xeon processor with AES-NI and PCLMULQDQ and SSSE 3. The Universal C Runtime must be installed. In addition to this the following Microsoft Internet Information (IIS) web server roles must be installed:
\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Venafi Trust Protection Platform was evaluated is described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered and configured as identified in the Common Criteria Administrator Guidance, satisfies all of the security functional requirements stated in the Venafi Trust Protection Platform v23.1 Security Target. The project underwent CCEVS Validator review. The evaluation was completed in July 2024. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The TOE provides the security functionality required by [SWAPP] and [SSHFP].
\r\n\r\nThe TOE relies on underlying cryptographic functionality provided by the platform for all of its cryptographic operations, as allowed by the [SWAPP] and [SSHFP].
\r\n\r\nThe TOE does not come with any default credentials. Upon installation it will randomly generate a self-signed certificate, and AES 256 symmetric key and a GUID for the base configuration of the system. No data is stored by the application on the platform file system.
\r\n\r\nThe TOE does not store or transmit anything that could be considered Personally Identifiable Information (PII).
\r\n\r\nThe TOE relies on the platform to securely store the following:
\r\nThe Windows Registry is used for storage of the TOE’s symmetric key. An AES 256 key is used for the encryption and decryption of secrets. It is protected by the Windows Data Protection API (DPAPI).
\r\nNo additional sensitive data is stored by the TOE.
\r\n\r\nThe TOE employs several mechanisms to ensure that it is secure on the host platform. The TOE never allocates memory with both write and execute permission. The TOE is designed to operate in an environment in which the following security techniques are in effect:
\r\nThis allows the TOE to operate in an environment in which the Enhanced Mitigation Experience Toolkit is also running. During compilation, the TOE is built with several flags enabled that check for engineering flaws. The TOE is built with the /GS flag enabled. This reduces the possibilities of stack-based buffer overflows in the product.
\r\n\r\nTLS and SSH are used to protect all data transmitted to and from the TOE.
","features":[{"id":3508,"feature_name":"Certificate Authentication"},{"id":3509,"feature_name":"Certificate Validation"},{"id":3511,"feature_name":"DRBG"},{"id":3513,"feature_name":"DTLS 1.0"},{"id":3515,"feature_name":"DTLS Server with Mutual Authentication"},{"id":3516,"feature_name":"PBKDF"},{"id":3506,"feature_name":"SSH"},{"id":3507,"feature_name":"SSH Client"}]}