The Cisco Secure Network Analytics (SNA) TOE is a centrally managed system of distributed components for collection, storage, and analysis, of network telemetry data. Cisco Secure Network Analytics (SNA) is a set of distributed network appliances including a central management appliance that manages all the distributed appliances, which may be physical and/or virtual appliances. SNA provides visibility and security analytics (threat detection, and threat response) using network traffic telemetry data. SNA can generate telemetry data directly (by directly monitoring traffic flows) or can collect telemetry data generated by devices in an existing network infrastructure.
","evaluation_configuration":"The evaluated configurations of the TOE consist of one SNA Manager, one or more Flow Collectors (FC), and one or more Flow Sensors (FS). Each of the TOE components are available as a stand-alone physical appliance, or as a virtual appliance. The physical and virtual appliances provide equivalent functionality, and a mixture of physical and virtual appliances can be deployed together.
\r\nThe evaluated configuration consists of the following hardware models all running SNA software release 7.5:
\r\n| \r\n SNA Appliance Type \r\n | \r\n\r\n Part Number \r\n | \r\n\r\n Server platform \r\n | \r\n\r\n Entropy Source \r\n | \r\n
| \r\n SNA Manager \r\n | \r\n\r\n ST-SMC2300-K9 \r\nL-ST-SMC-VE-K9 \r\n | \r\n\r\n UCSC-C225-M6SX \r\n | \r\n\r\n JENT \r\n | \r\n
| \r\n SNA Flow Sensor \r\n | \r\n\r\n ST-FS1300-K9 \r\nST-FS3300-K9 \r\nST-FS4300-K9 \r\nL-ST-FS-VE-K9 \r\n | \r\n||
| \r\n SNA Flow Collector \r\n | \r\n\r\n ST-FC4300-K9 \r\nL-ST-FC-VE-K9 \r\n | \r\n
\r\n
\r\n
","security_evaluation_summary":"
The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017. The product, when delivered and configured as identified in the Cisco Secure Network Analytics (SNA) 7.5 Preparative Procedures & Operational User Guide for the Common Criteria Certified Configuration, Version 1.0, June 23, 2026 document, satisfies all of the security functional requirements stated in the Cisco Secure Network Analytics (SNA) 7.5 Security Target, Version 1.2, July 13, 2026. The project underwent CCEVS Validator review. The evaluation was completed in July 2026. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11672-2026) prepared by CCEVS.
","environmental_strengths":"The logical boundaries of the Secure Network Analytics (SNA) are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\n\r\n
Security audit:
\r\nThe Cisco Secure Network Analytics provides extensive auditing capabilities. The TOE can audit events related to cryptographic functionality, identification and authentication, and administrative actions. The Cisco Secure Network Analytics generates an audit record for each auditable event. Each security relevant audit event has the date, timestamp, event description, and subject identity. The administrator configures auditable events, configures secure transmission of audit records to a remote audit server, and manages audit data storage. The TOE provides the administrator with a local circular audit trail. Audit messages are stored locally and transmitted over an encrypted channel to an external audit server.
\r\n\r\n
Communication:
\r\nThe TOE allows authorized administrators to control which SNA appliance (FC, and FS) is managed by the Manager. This is performed through a registration process over TLS. The administrator can also de-register an appliance if he or she wishes to no longer manage it through the Manager. For this TOE the process of registration/joining a new managed appliance (FC, FS) to the Manager is manually initiated by the administrator installing each appliance. The initial TLS connection is authenticated to the Manager using the Manager administrator’s username/password, at which point the appliances exchange their X.509 certificates, and from that point forward all TLS communications among appliances are authenticated using X.509 certificates.
\r\n\r\n
Cryptographic support:
\r\nThe TOE provides cryptography in support of other Cisco SNA security functionality. This cryptography has been validated by the NIST CAVP.
\r\nThe TOE provides cryptography in support for TLS, which is used for remote administrative management, and secure communication among TOE components, and connects from the TOE to LDAP and syslog servers. The cryptographic services provided by the TOE are described below.
\r\n| \r\n Cryptographic Method \r\n | \r\n\r\n Use within the TOE \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n Used to encrypt TLS session traffic. \r\n | \r\n
| \r\n ECDH \r\n | \r\n\r\n Used to provide key exchange in TLS. \r\n | \r\n
| \r\n RSA Signature Services \r\n | \r\n\r\n X.509 certificate signing and verification. \r\nData signing and verification in TLS. \r\n | \r\n
| \r\n HMAC \r\n | \r\n\r\n Used for keyed hash, integrity services in TLS session establishment. \r\n | \r\n
| \r\n DRBG \r\n | \r\n\r\n
| \r\n
| \r\n SHA \r\n | \r\n\r\n Used to provide TLS traffic integrity verification \r\n | \r\n
| \r\n Transport Layer Security (TLS) \r\n | \r\n\r\n Used in TLS session establishment. \r\n | \r\n
\r\n
During initial installation each TOE component generates its own unique self-signed X.509v3 certificate, and during initial configuration all those certificates are replaced with new CA-signed identity certificates which are then used for all TLS connections including mutual authentication of TLS connections among TOE components. Configuration of trust stores for all components is performed via the Central Management WebUI of the Manager, but each TOE component generates its own unique keypair and its own certificate signing requests (CSR), and imports (via the Central Management WebUI of the Manager) TLS certificates that have been signed by an external CA server.
\r\n\r\n
Identification and authentication:
\r\nTOE components perform two types of authentication: password-based authentication of administrators for remote administration of the TOE; and certificate-based authentication of devices. Device-level authentication allows TOE components to establish secure channels with other TOE components, and with external servers (LDAP and syslog).
\r\nThe TOE provides administrator authentication against a local user database. Password-based authentication can be performed on the serial console, and the GUI (accessible via HTTPS/TLS). For authentication to the GUI, the TOE optionally supports use of a AAA server (using LDAP over TLS), which would be outside the TOE boundary.
\r\nThe TOE requires Authorized Administrators to authenticate prior to being granted access to any of the management functionality. The TOE can be configured to require a minimum password length of 8 to 256 characters.
\r\nAfter a configurable number of incorrect login attempts at administrative interfaces where authentication is processed locally (i.e. where LDAP is not used), the TOE will lock the offending account until an Administrator defined time period has elapsed.
\r\nSecurity management:
\r\nThe TOE provides secure administrative services for management of general TOE configuration and the security functionality provided by the TOE. All TOE administration occurs either through a secure HTTPS/TLS session or via a local console connection. The TOE provides the ability to securely manage all TOE administrative users; all identification and authentication; all audit functionality of the TOE; all TOE cryptographic functionality; the timestamps maintained by the TOE; and updates to the TOE.
\r\nWhen an administrative session is initially established, the TOE displays an administrator-configurable warning banner. This is used to provide any information deemed necessary by the administrator. After a set amount of time of inactivity, the administrator will be locked out of the administrator interface.
\r\nProtection of the TSF:
\r\nThe TOE protects against interference and tampering by untrusted subjects by implementing identification, authentication, and access controls to limit configuration to Authorized Administrators. The TOE prevents reading of plaintext cryptographic keys and passwords.
\r\nThe TOE internally maintains the date and time. This date and time is used as the timestamp that is applied to audit records generated by the TOE. Administrators can update the TOE’s clock manually.
\r\nThe TOE is able to verify any software updates prior to the software updates being installed on the TOE to avoid the installation of unauthorized software. The TOE performs self-testing to verify correct operation of its cryptographic module. The TOE components are not general-purpose operating systems; root access is not permitted, external software applications cannot be installed, and access to memory space is restricted to TOE functions.
\r\nThe TOE is distributed, including multiple appliances that communicate with each other over a network. These internal TOE communications between TOE components are protected within TLS and authenticated using X.509 certificates.
\r\nTOE access:
\r\nThe TOE can terminate inactive sessions after an Authorized Administrator configurable time-period. Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session.
\r\nThe TOE can also display an Authorized Administrator specified banner on the CLI management interface and the WebUI prior to allowing any administrative access to the TOE.
\r\nTrusted path/channels:
\r\nThe TOE establishes a trusted path with syslog servers using TLS, and with LDAP servers using TLS. Remote administration of the TOE uses TLS/HTTPS. All communications between TOE components are protected within TLS; the initial joining of TOE components is authenticated using a username and password that’s manually entered during the joining process, and subsequent communications between TOE components are automatically authenticated using X.509 certificates.
","features":[{"id":5612,"feature_name":"Auditing"},{"id":5613,"feature_name":"Certificate Validation"},{"id":5615,"feature_name":"Cryptograhic Key Generation"},{"id":5616,"feature_name":"Cryptographic Signature Generation"},{"id":5617,"feature_name":"Cryptographic Signature Verification"},{"id":5614,"feature_name":"Hashing"},{"id":5624,"feature_name":"Keyed-hash message authentication"},{"id":5623,"feature_name":"Network Device"},{"id":5618,"feature_name":"TLS 1.2"},{"id":5619,"feature_name":"TLS 1.3"},{"id":5620,"feature_name":"TLS Client with Mutual Authentication"},{"id":5621,"feature_name":"TLS Server with Mutual Authentication"},{"id":5622,"feature_name":"Trusted Update Function"}]}