The TOE is Cisco Jabber 15.2, a software application that provides protected channels for interactive communication. Cisco Jabber allows users of an organization to securely make, receive, and control phone calls through Cisco Unified Communications Manager (CUCM). Users have a variety of call-control options including mute, call transfer, call forwarding, and impromptu conferencing.
\r\nCisco Jabber provides users within an organization a number of features for collaborative communication:
\r\nIntegrated Voice and Video Telephony - Securely make, receive, and control phone calls. Users have a variety of call control options including mute, call transfer, call forwarding, and impromptu conferencing.
\r\nInstant Messaging and Presence - View real-time availability of co-workers and securely chat in real time using instant messaging to save time and reduce phone tag.
\r\nOnline Web Conferencing – Securely access online web conferencing services to collaborate in real-time.
\r\nVoicemail Services – Securely access voicemail and tools for managing messages.
\r\nThe Common Criteria evaluation was limited to the Integrated Voice and Video over IP (VVoIP) telephony features of Cisco Jabber that it secures with SRTP and TLS 1.2. Video, Instant Messaging and Presence, Online Web Conferencing, and Voicemail Services is not covered by the evaluation. Additionally, call control options other than call placement and call receipt were not evaluated. Advanced features such as call transfer, call forwarding, and impromptu conferencing make use of SIP TLS 1.2, which is part of the evaluation.
","evaluation_configuration":"The evaluated configuration is a single instance of Cisco Jabber 15.2 operating in FIPS and CC mode.
","security_evaluation_summary":"The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017. The product, when delivered and configured as identified in the Cisco Jabber 15.2 Common Criteria Configuration Guide, Version 0.5, February 12, 2026 document, satisfies all of the security functional requirements stated in the Cisco Jabber 15.2 Security Target, Version 0.5, June 23, 2026. The project underwent CCEVS Validator review. The evaluation was completed in March 2026. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11635-2026) prepared by CCEVS
","environmental_strengths":"The logical boundaries of the Cisco Jabber 15.2 are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\n\r\n
Communication:
\r\nThe Cisco Jabber TOE transmits voice media using a constant bitrate (CBR) vocoder.
\r\nCryptographic support:
\r\nThe Cisco Jabber TOE provides cryptography in support of SIP connections via Security Real-Time Transport Protocol (SRTP) established using the Session Description Protocol (SDP) and the Security Descriptions for Media Streams (SDES) for SDP. The TOE also protects communications between itself and the CUCM SIP Server by using a Transport Layer Security (TLS)-protected signaling channel.
\r\nThe TOE incorporates a CiscoSSL cryptographic module library (v7.2), and the algorithm implementation has been validated for CAVP conformance.
\r\nUser data protection:
\r\nThe TOE ensures that user data is not transmitted when a call is placed on hold, a call is placed on mute, or when the TOE is not registered with the SIP server. Additionally, the TOE restricts access to hardware resources and network communications to only those required.
\r\nIdentification and authentication:
\r\nThe TOE performs X.509 certificate authentication of remote components the TOE interacts with for SDES/SRTP and TLS connections. The Cisco Jabber TOE relies upon the TOE Platform to validate certificates.
\r\nSecurity management:
\r\nThe TOE is capable of registering with an Enterprise Session Controller (ESC) and specifying the termination period for idle calls.
\r\nProtection of the TSF:
\r\nThe TOE leverages services and APIs provided by the platform in order to support anti-exploitation features and installation of authorized software updates.
\r\nTrusted path/channels:
\r\nThe TOE’s implementation of SDES-SRTP allows secure voice and video communication between itself and a remote VVoIP application and secure signaling communication between itself and a remote CUCM SIP Server using TLS.
\r\n","features":[{"id":5492,"feature_name":"Certificate Validation"},{"id":5500,"feature_name":"Cryptograhic Key Generation"},{"id":5493,"feature_name":"Cryptographic Hashing"},{"id":5499,"feature_name":"Cryptographic Signature Generation"},{"id":5498,"feature_name":"Cryptographic Signature Verification"},{"id":5497,"feature_name":"Keyed-hash message authentication"},{"id":5496,"feature_name":"TLS 1.2"},{"id":5495,"feature_name":"Trusted Update Function"},{"id":5494,"feature_name":"VVoIP"}]}