Fortinet FortiMail is a specialized email security system that provides multi-layered protection against blended threats consisting of spam, viruses, worms and spyware. FortiMail’s inbound filtering engine blocks spam and malware before it can clog networks and affect users. FortiMail’s dynamic and static user-blocking provides granular control over all email policies and users. Secure content delivery is enforced with FortiMail’s Identity-Based Encryption (IBE), S/MIME, or TLS email encryption options. FortiMail’s predefined or customized dictionaries prevent accidental and intentional loss of confidential data.
\r\nFor this evaluation, the Target of Evaluation (TOE) is FortiMail evaluated as a network device. The TOE claims exact conformance to the NDcPP. As such, the security-relevant functionality of the product is limited to the claimed requirements in this PP.
\r\nThe TOE consists of the following appliances running FortiMail firmware v7.4:
\r\n","evaluation_configuration":"
The Target of Evaluation (TOE) is Fortinet FortiMail version 7.4. The specific tested firmware version is “7.4.2”.
\r\nAll functional testing was performed on the following devices:
\r\nAdditionally, to ensure full coverage of all processor microarchitectures and substrates, cryptographic algorithm validation was performed on both models listed above as well as the FML-200F, FML-400F, and FML-2000F.
\r\nThe product is designed to function as a network security appliance that filters emails and associated executable content to prevent compromise of end user systems. No NIAP PP or PP-Module exists for this functionality, so the TOE conforms to the NDcPP for its implementation of general security mechanisms. As such, the security-relevant functionality of the product is limited to the claimed requirements in this standard. The security-relevant functionality is described in [ST] sections 2.3 and 2.4. The product overview in section 2.2 is intended to provide the reader with an overall summary of the entire product so that its intended usage is clear. The subset of the product functionality that is within the evaluation scope is subsequently described in the sections of the [ST] that follow it.
","security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme for the collaborative Protection Profile for Network Devices, Version 2.2e. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 release 5. The product, when delivered and configured as identified in the guidance documentation, satisfies all of the security functional requirements stated in the Fortinet FortiMail Version 7.4 Security Target. The evaluation was completed in July 2024. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"Security Audit
\r\nThe TOE generates audit records of security-relevant activity. Audit data is stored locally and the TOE also has the ability to export all audit records to an external audit server over a TLS protected channel. The TOE manages the audit storage by overwriting previous audit records when the local storage space for audit data is full in order to capture new events.
\r\nCryptographic Support
\r\nThe TOE implements cryptographic functions in support of trusted communications, key pair generation for X.509 certificate requests, and self-testing. For trusted communications, the TOE implements TLS as a server with HTTPS, and TLS as a client without HTTPS. The TOE’s TLS client supports mutual authentication. The TOE relies on platform hardware to generate entropy that is used to seed its DRBG to ensure that generated keys have the advertised security strength.
\r\nIdentification and Authentication
\r\nThe TOE uses a local password-based mechanism and additionally for SSH, an SSH public key-based mechanism for administrator authentication. The TOE enforces restrictions on the length and character composition of administrator passwords. Excessive failed authentication attempts on a remote administrative interface will cause a lockout that is resolved by a waiting period. The TOE also uses X.509 certificates for authentication of TLS connections. The TOE has a mechanism by which a certificate signing request can be generated so that it may obtain a certificate for its own use from a trusted CA.
\r\nSecurity Management
\r\nThe TOE has a web-based remote management interface as well as a local/remote console. Most functionality can be administered over both interfaces. The TOE uses a single Security Administrator role to authorize the use of management functions.
\r\nProtection of the TSF
\r\nThe TOE protects sensitive data from unauthorized access. It enforces integrity of its own contents through the use of self-tests to ensure that the TSF has not been modified. Firmware updates are obtained through the operational environment (e.g. downloaded from the vendor’s support site); updates have a digital signature that is verified prior to application.
\r\nTOE Access
\r\nThe TOE controls access through enforcement of idle session timeout on its management interfaces. These interfaces also display a configurable pre-authentication warning banner that advises against unauthorized use of the TOE.
\r\nTrusted Path/Channels
The TOE implements a TLS trusted channel between itself and trusted external audit servers. The TOE also implements SSH and TLS/HTTPS trusted paths for secure remote administration.