The TOE was evaluated against the collaborative Protection Profile for Network Devices, Version 3.0e (NDcPP3.0e), December 6, 2023, and Functional Package for Secure Shell, Version 1.0, (SSH FP), May 13, 2021. This PP claim also includes all relevant NIAP Technical Decisions. The TOE is the Forescout eyeSight product operating on software version 9.1 and is referred to as the Forescout eyeSight or TOE from this point forward. The Forescout eyeSight is used to dynamically identify and evaluate network infrastructure, devices and applications connected to the network, and provide enforcement of Network Access Policy (NAC) and Enterprise Conformance Policies. Forescout’s agentless technology discovers, classifies and assesses devices. The Forescout eyeSight interrogates the network infrastructure to discover devices as they connect to the network. After discovering a device, the Forescout eyeSight uses a combination of passive and active methods to classify the device according to its type and ownership. Based on its classification, the Forescout eyeSight then assesses the device security posture and allows organizations to set policies that establish the specific behavior the device is allowed to have while connected to a network.
","evaluation_configuration":"The TOE is Forescout eyeSight operating on software version 9.1. Forescout eyeSight is a product family, which includes the following models: 4130, 5120-01, 5120-02, 5140-01, 5140-02, 5160-01, 5160-02, 6120, 6140, and 6160.
\r\nIn its evaluated configuration, the TOE is configured to directly communicate with the following environment components:
\r\nThe TOE was evaluated against the collaborative Protection Profile for Network Devices, Version 3.0e (NDcPP3.0e), December 6, 2023, and Functional Package for Secure Shell, Version 1.0, (SSH FP), May 13, 2021. This PP claim also includes all relevant NIAP Technical Decisions. The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) processes and procedures. Forescout eyeSight was evaluated against the criteria contained in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 Revision 5. The product, when installed and configured per the instructions provided in the preparative guidance, satisfies all of the security functional requirements stated in the Forescout eyeSight v9.1 Security Target Version 2.0. The evaluation underwent CCEVS Validator review. The evaluation was completed in September 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report, CCEVS-VR-VID11591-2025 prepared by CCEVS.
","environmental_strengths":"Security Audit
\r\nThe TOE contains mechanisms to generate audit data to record predefined events on the TOE. The TOE generates application layer audit events and OS log files. Both are stored in the TOE’s local hard drive. An administrator has the ability to configure the TOE to forward events to an audit server. In the evaluated configuration, the audit data is also securely transmitted to the audit server using a TLS v1.2 communication channel.
\r\nCryptographic Support
\r\nThe TOE provides cryptography in support of SSH and TLS (v1.2) trusted communications. Two different cryptography software packages are included with the TOE: Bouncy Castle and OpenSSL. Bouncy Castle is used specifically for communications with the management workstation running the Console. OpenSSL is used for all other TLS and SSH communications. The TOE immediately destroys keys when no longer used. The following table identifies the cryptographic services per cryptographic library.
\r\nIdentification and Authentication
\r\nThe TSF provides a configurable number of maximum consecutive authentication failures that are permitted by a user. Once this number has been met, the account is locked for a configurable time interval or until a Security Administrator manually unlocks the account.
The TOE provides local password authentication for CLI and Console users as well as providing the ability to securely connect to an Active Directory server for the authentication of Console users. Communications over this interface is secured using TLS in which the TOE is acting as a client. The TOE enforces the use of X.509 certificates to support authentication for TLS connections. The only function available to an unauthenticated user is the ability to acknowledge a warning banner. Passwords that are maintained by the TSF can be composed of upper case, lower case, numbers and special characters. A Security Administrator can define the minimum password length between 6 and 100 characters.
Security Management
\r\nThe TOE can be administered either locally or remotely. Role-based access control is used to prevent unauthorized management and access to TSF data.
\r\nProtection of the TSF
\r\nThe TOE ensures the security and integrity of all data that is stored locally and accessed remotely. Passwords are not stored in plaintext. A administrator has the ability to query the TOE for the currently executing version the TOE software and is required to manually initiate the update process from the Console as automatic updates are not supported. The TOE automatically verifies the digital signature of the software update prior to installation. If the digital signature is found to be invalid, the administrator is provided with an error and the update is not installed. There is no means for an administrative override to continue the installation if the signature is completely missing. The TOE implements a self-testing mechanism that is automatically executed during the initial start-up and can be manually initiated by an administrator after authentication. The TOE’s self-tests verify the correct operation of product and cryptographic modules. The TOE provides its own time via its internal clock.
\r\nTOE Access
\r\nThe TOE displays a configurable warning banner prior to its use. Inactive sessions will be terminated after an administratively-configurable time period. Users are allowed to terminate their own interactive session. Once a remote session has been terminated, the TOE requires the user to re-authenticate to establish a new session. Local and remote sessions are terminated after the administratively-configured inactivity time limit is reached.
\r\nTrusted Path/Channels
\r\nUsers can access a CLI for administration functions remotely via SSH (remote CLI) or a local physical connection (local CLI) to the TOE. The TOE operates as an SSH server for the remote CLI. The Console is the main administrator interface, which is running on a separate Windows PC and requires the use of TLS to communicate with the TOE. The TOE operates as a TLS server for requests from the Console.
\r\nThe TOE acts as a TLS client to initiate the following secure paths for the following functions to their associated operational environment entities:
\r\n