The TOE, Illumio Core v24.2.20, is an enterprise policy management product. The TOE’s primary purpose is to manage communications within, and across, tiers of applications by defining access control policy. The TOE is a distributed software application that consists of the Policy Compute Engine (PCE) and the Virtual Enforcement Node (VEN).
\r\nThe TOE, Illumio Core, consists of the Policy Compute Engine (PCE) and the Virtual Enforcement Node (VEN). Together, these components form a distributed software platform that is designed to continuously protect communications within and, across, tiers of applications and hosts. The TOE enables administrators to create access control policies to secure and to implement granular segmentation of hosts and applications within enterprise network, effectively reducing the attack surface and securing the workload. Segmentation is another name for creating and sending (for enforcement) the firewall rules that separate traffic. A Workload represents a distinct collection of bare‐metal servers, VMs, containers, workstations, and VDI within data centers, cloud, or distributed enterprise environments.
\r\nThe PCE allows administrators to visually display application traffic and to implement policies to every Workload. A Workload is considered managed when VEN is installed and paired (or unmanaged when VEN is not present). The PCE is capable of defining policies that targets managed (and unmanaged) Workloads, however policies can be enforced only by managed Workloads. The relationship between PCE and VEN is one to many.
","evaluation_configuration":"The TOE does not include the hardware or operating systems of the systems on which it is installed. It also does not include the third-party software that is required for the TOE to run.
\r\nThe TOE supports a number of features that are not part of the core functionality. Those features are excluded from scope of the evaluation:
\r\nThe TOE allows policies with multiple types of rules, destinations, and attributes. During the evaluation, a sample was taken to test most of them; the rest were not covered during the evaluation.
\r\nThe following parameters were covered during the evaluation:
\r\nThe TOE runs on multiple platforms however, not all of them were tested, therefore they are not part of the evaluated configuration.
\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) processes and procedures. Illumio Core Platform v24.2.20 was evaluated against the criteria contained in the Common Criteria for Information Technology Security Evaluation, Version 2022 Revision 1. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 2022 Revision 1. The product, when installed and configured per the instructions provided in the preparative guidance, satisfies all of the security functional requirements stated in the Illumio Core Platform v24.2.20 Security Target Version 0.5. The evaluation underwent CCEVS Validator review. The evaluation was completed in June 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report, CCEVS-VR-VID11614-2025 prepared by CCEVS.
","environmental_strengths":"The TOE protects sensitive data, such as stored passwords and secrets, so it is not directly accessible in plaintext.
\r\nThe TOE implements secure channels for communication for both the PCE and the VEN. PCE implements secure remote administration, exports audit records securely to an external audit server, integrates with an external authentication server, and securely transfers policy updates to VEN. The VEN securely connects to PCE to receive policy updates.
\r\nThe TOE supports policy definition and transmission through its two primary components - PCE and VEN. The PCE computes and manages the security policies that are consumed by the VENs. The TOE allows administrators to define security policies and distributes those rules securely to the VENs which enforce those rules on the host using its native firewall.
\r\nThe TOE allows audit of security related events and logging of such audit events securely to an audit server. The TOE is able to generate audit records of security-relevant events as they occur. Generally, any use of a management function via the Web UI, as well as relevant IT environment events, will be audited. The agents (VENs) also send audit events to TOE by invoking the TOE’s API
\r\nThe TOE stores audit data locally, in the operational environment, by utilizing the Linux file system. The TOE is also capable of uploading audit records securely to an external audit server (e.g., syslog) in the operational environment.
\r\nThe TOE supports secure user authentication and handles authentication failures. The TOE requires users to be identified and authenticated before they can access any of the management functions. The TOE also enforces strong password policy and offers the ability to lockout users on unsuccessful user authentications.
\r\nThe TOE uses role-based access control to restrict access to management functions based on user’s role. The TOE supports management capabilities listed in Table 6-3. The TOE restricts management functions associated with the VEN the same way that the TOE’s own management functions are controlled. Only authorized administrators belonging to appropriate roles are capable of managing VENs.
\r\nThe TOE can be configured by an administrator to force an interactive session’s termination based on a timeout value. The TOE can also be configured to display advisory banners as part of the authentication prompt.
\r\nThe TOE implements secure channels for communication for both the PCE and the VEN. PCE implements secure remote administration, exports audit records securely to an external audit server, integrates with an external authentication server, and securely transfers policy updates to VEN. The VEN securely connects to PCE to receive policy updates.
","features":[{"id":777,"feature_name":"Auditing"},{"id":787,"feature_name":"Enterprise Security Management"},{"id":741,"feature_name":"Flaw Remediation"}]}