The Target of Evaluation (TOE) is the HCL BigFix Server version 11.0.3, an application software that is part of HCL BigFix Endpoint Management solution, provided by HCL Technologies Limited. The TOE is installed and runs as a service on a Microsoft® Windows® operating system.
\r\nHCL BigFix Endpoint Management is a centralized endpoint management system that allows authorized operators to monitor the system configurations of distributed endpoint systems (client computers) and enables operators to take any necessary corrective actions.
\r\nThe TOE implements the server functionality of HCL BigFix Endpoint Management solution, which manages and coordinates the flow of information to and from individual Client Computers and stores the results in the BigFix database. The database is used by the TOE to store and retrieve applicable Fixlets (e.g., identification of vulnerable/misconfigured endpoints) and Actions (e.g., remediation action) as well as TOE configuration data.
","evaluation_configuration":"The evaluation configuration consists of HCL BigFix Server version 11.0.3 running on Microsoft Windows Server 2019 Standard version 1809.
The Operational Environment of the TOE is restricted to the following BigFix components:
In addition, the TOE requires the Microsoft SQL Server 2019 installed in the Operational Environment.
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process. The criteria against which the HCL BigFix Server version 11.0.3 TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 R5. The evaluation methodology used by the evaluation team to conduct the evaluation was the Common Methodology for Information Technology Security Evaluation, Version 3.1, R5 supplemented by that found in the Protection Profiles cited below. The evaluation was completed in May 2025. The product, when delivered and configured as identified in the HCL BigFix Server Version 11.0.3 Common Criteria Configuration Guide meets the requirements of the following:
\r\nThe TOE provides the following security functionality required by the Protection Profile for Application Software, version 1.4 and Functional Package for TLS, version 1.1.
The TOE provides cryptographic support using the OpenSSL cryptographic module bundled in the TOE and the Windows Cryptography API: Next Generation (CNG) cryptographic module supplied by the underlying Windows platform.
The TOE uses OpenSSL for the following cryptographic services:
The TOE uses the Windows CNG for the following cryptographic services:
The TOE provides user data protection by encrypting sensitive data at rest, as well as restricting access to platform-based resources required by the TOE.
The TOE authenticates the identity of the endpoint server when connecting as a TLS client by validating the X.509 certificates received from the server during the TLS protocol handshake. The TOE uses the cURL library and OpenSSL, which are part of the TOE.
The TOE also authenticates Console Operators for the purpose of managing the TOE from the Console or the REST API.
The TOE does not request Personally Identifiable Information (PII).
The TOE provides the ability to set various configuration options for communication paths. The TOE also provides security management functions via the BigFix Console and REST API.
The TOE implements several mechanisms to protect itself and its security functionality. These mechanisms include utilizing only documented Windows platform APIs; does not write user-modifiable files to directories that contain its executable files; using stack buffer overrun protection and Address Space Layout Randomization (ASLR) techniques. Also, all TOE binaries and updates are signed using the Microsoft Authenticode process. The TOE is delivered as an InstallShield installation package, signed by HCL.
The TOE protects all incoming and outgoing transmitted data via HTTPS with TLS version 1.2 as the underlying protocol.
","features":[{"id":479,"feature_name":"Certificate Authentication"},{"id":481,"feature_name":"Certificate Validation"},{"id":482,"feature_name":"Credential Storage"},{"id":483,"feature_name":"DRBG"},{"id":484,"feature_name":"DTLS 1.0"},{"id":486,"feature_name":"DTLS Server with Mutual Authentication"},{"id":487,"feature_name":"PBKDF"},{"id":488,"feature_name":"TLS 1.1"}]}