The Target of Evaluation (TOE) is Forcepoint Network Security Platform 7.3. The Forcepoint Network Security Platform (FNSP) is a stateful packet filtering firewall and VPN gateway. Being a stateful packet filtering firewall, the FNSP filters network traffic optimized through the use of stateful packet inspection. Being a VPN gateway, the FNSP provides IPsec VPN functionality to secure network data exchanged with peer gateways and VPN clients. The FNSP is intended to be used as a network perimeter security gateway that provides a controlled connection. The FNSP is centrally managed and generates audit records for security critical events.
\r\n\r\n
The Forcepoint Network Security Platform is a stateful packet filtering firewall and VPN gateway. The Forcepoint Network Security Platform system is composed of the Security Engine (a physical or virtual appliance) and the Virtual Security Management Center (SMC). The Security Engine controls connectivity and information flow between internal and external connected networks. The Virtual SMC Appliance provides administrative functionality supporting the configuration and operation of Security Engines. Throughout the remainder of this document, references to the Security Engine are meant to reference the TOE’s firewall engine, while references to the FNSP are meant to refer to the TOE as a whole.
\r\nThe Security Engine controls connectivity and information flow between internal and external connected networks. The Security Engine also provides a means to keep the internal host’s IP-address private from external users. The Security Engine is intended to be used as a network perimeter security gateway that provides a controlled connection.
\r\nThe Security Engine provides VPN gateway capabilities, allowing the Engine to use IKE/IPsec to protect traffic exchanged with remote peer gateways (for a site-to-site VPN configuration) and with VPN clients.
\r\nThe FNSP is assumed to be installed and operated within a physically protected environment, administered by trusted and trained administrators over a trusted and separate management network. Multiple installations of the Security Engine may be used in combination to provide a company with an overall network topology.
","evaluation_configuration":"The Target of Evaluation (TOE) is Forcepoint Network Security Platform 7.3. The TOE consists of the following models:
\r\n| \r\n Model \r\n | \r\n\r\n Form factor/CPU \r\n | \r\n
| \r\n 120 \r\n | \r\n\r\n Desktop: Intel® Atom C3338R (Goldmont) \r\n | \r\n
| \r\n 120W \r\n | \r\n\r\n Desktop: Intel® Atom C3338R (Goldmont) \r\n | \r\n
| \r\n 120WL \r\n | \r\n\r\n Desktop: Intel® Atom C3338R (Goldmont) \r\n | \r\n
| \r\n 120L \r\n | \r\n\r\n Desktop: Intel® Atom C3338R (Goldmont) \r\n | \r\n
| \r\n 125L \r\n | \r\n\r\n Desktop: Intel® Atom C3338R (Goldmont) \r\n | \r\n
| \r\n 60 \r\n | \r\n\r\n Desktop: Intel® Atom C3338R (Goldmont) \r\n | \r\n
| \r\n 60L \r\n | \r\n\r\n Desktop: Intel® Atom C3338R (Goldmont) \r\n | \r\n
| \r\n 61 \r\n | \r\n\r\n Desktop Intel® N50 (Alder Lake) \r\n | \r\n
| \r\n 352 \r\n | \r\n\r\n Desktop Intel® Atom C5315 (Tremont) \r\n | \r\n
| \r\n 355 \r\n | \r\n\r\n Desktop Intel® Atom C5325 (Tremont) \r\n | \r\n
| \r\n 1202 \r\n | \r\n\r\n Desktop Intel® Atom P5322 (Tremont) \r\n | \r\n
| \r\n 2201 \r\n | \r\n\r\n 1U: Intel® Xeon D-2123IT (Skylake) \r\n | \r\n
| \r\n 2205 \r\n | \r\n\r\n 1U: Intel® Xeon D-2145NT (Skylake) \r\n | \r\n
| \r\n 2210 \r\n | \r\n\r\n 1U: Intel® Xeon D-2177NT (Skylake) \r\n | \r\n
| \r\n 2305 \r\n | \r\n\r\n 1U Intel® Xeon D-2876NT (Ice Lake) \r\n | \r\n
| \r\n 2310 \r\n | \r\n\r\n 1U Intel® Xeon D-2896NT (Ice Lake) \r\n | \r\n
| \r\n 3401 \r\n | \r\n\r\n 2U: Intel® Xeon Silver 4210 (Cascade Lake) \r\n | \r\n
| \r\n 3405 \r\n | \r\n\r\n 2U: Intel® Xeon Silver 4216 (Cascade Lake) \r\n | \r\n
| \r\n 3505 \r\n | \r\n\r\n 2U: Intel® Xeon Silver 4416+ (Sapphire Rapids) \r\n | \r\n
| \r\n 3510 \r\n | \r\n\r\n 2U: Intel® Xeon Gold 6428N (Sapphire Rapids) \r\n | \r\n
| \r\n ESXi 8.0 \r\n | \r\n\r\n Intel® Xeon Silver 4208 (Cascade Lake) \r\n | \r\n
","security_evaluation_summary":"
The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017. The product, when delivered and configured as identified in the Forcepoint Network Security Platform 7.3.2 Common Criteria Evaluated Configuration Guide, Revision A document, satisfies all of the security functional requirements stated in the Forcepoint Network Security Platform 7.3 Security Target, Version 0.7, September 1, 2026. The project underwent CCEVS Validator review. The evaluation was completed in September 2026. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11677-2026) prepared by CCEVS.
","environmental_strengths":"The logical boundaries of the Forcepoint Network Security Platform 7.3 are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\n\r\n
Security audit:
\r\nThe TOE generates audit events for numerous activities including policy enforcement, system management and authentication. A syslog server in the environment is relied on to store audit records generated by the TOE. The TOE generates a complete audit record including the IP address of the TOE, the event details, and the time the event occurred. The time stamp is provided by the TOE’s Linux-based operating system in conjunction with the appliance hardware. When the syslog server writes the audit record to the audit trail, it applies its own time stamp, placing the entire TOE-generated syslog protocol message MSG contents into an encapsulating syslog record.
\r\nCommunication:
\r\nThe TOE is a distributed solution consisting of the Security Management Center and Security Engines. The Security Management Center can manage one or more Security Engines. The TOE uses a registration process to join Engines to an SMC.
\r\nCryptographic support:
\r\nBecause the TOE consists of distributed components, each physical component of the TOE must be considered when discussing the TOE cryptographic support. Both types of components (the SMC and its Engines) of the TOE utilize cryptography to verify trusted updates, for TLS protected management communications between the SMC and its Engines, for engine support of IPsec connections, and the SMC uses cryptography to support its use of the TLS protocol to protect administrative HTTPS connections and to protect network communications with external IT entities. Additionally, the TOE provides the ability to synchronize its time with a NTP server using NTPv4. The time data is protected by a SHA1 message digest.
\r\nUser data protection:
\r\nThe TOE ensures that all information flows from the TOE do not contain residual information from previous traffic. New packet data is used to overwrite any previous data in a buffer and any additional buffer space is padded with zeros before the packet is forwarded. Residual data is never transmitted from the TOE.
\r\nFirewall:
\r\nThe TOE provides an information flow control mechanism using a rule base that comprises a set of security policy rules, i.e., the firewall security policy. The Security Engine enforces the firewall security policy on all traffic that passes through the engine, via its internal or external network Ethernet interfaces.
\r\nIdentification and authentication:
\r\nThe TOE requires users to be identified and authenticated before they can use functions mediated by the TOE, with the exception of reading the login banner, and performing firewall packet filtering operations. The TOE authenticates administrative users. In order for an administrative user to access the TOE, a user account including a user name and password must be created for the user.
\r\nThe TOE supports X509v3 certificate validation during negotiation of TLS protected syslog and for secure communications between distributed TOE components (SMC and Security Engine). Certificates are validated as part of the authentication process when they are presented to the TOE and when they are loaded into the TOE.
\r\nSecurity management:
\r\nSecurity management commands are limited to authorized users (i.e., administrators) and available only after they have provided acceptable user identification and authentication data to the TOE. Administrators access the TOE remotely using a TLS protected communication channel between the Management Server and the Client GUI (which runs on a workstation in the IT environment or in a web browser). Administrators can also access the TOE via a local console which provides limited functionality.
\r\nPacket filtering:
\r\nPlease see Firewall Section for a description of the TOE’s packet filtering mechanism.
\r\nProtection of the TSF:
\r\nThe TOE provides a variety of means of protecting itself. The TOE protects communications between the SMC and engines using TLS as a trusted channel. Mutual authentication using client-side x.509v3 certificates is supported by the TLS communication between the distributed TOE components. The TOE performs self-tests that cover the correct operation of the TOE. It provides functions necessary to securely update the TOE. Its Linux-based operating system utilizes a hardware clock to ensure reliable timestamps. It protects sensitive data such as stored passwords and cryptographic keys so that they are not accessible through the TOE, even to a Security Administrator.
\r\nTOE access:
\r\nThe TOE can be configured to display a logon banner before a user session is established. The TOE also enforces inactivity timeouts for local and remote sessions.
\r\nFor VPN the TOE can terminate VPN client sessions that have been inactive for the administrator defined time interval. The TOE can deny VPN client sessions based upon location (as determined by IP address), time and day. The TOE can assign private IP addresses to VPN clients.
\r\nTrusted path/channels:
\r\nThe TOE protects interactive communication with administrators using HTTPS/TLS for Client GUI access, ensuring both integrity and disclosure protection. If the negotiation of an encrypted session fails, the attempted connection will not be established.
\r\nThe TOE protects communication with network peers, such as an external syslog server, using TLS connections to prevent unintended disclosure or modification of logs. Mutual authentication using client-side x.509v3 certificates is supported by the SMC TLS client for syslog over TLS.
\r\nThe TOE protects data traffic sent between engines or to remote/external gateways and VPN clients using IPsec. The TOE can be configured to provide VPN Clients with access to the SMC’s Management Server, allowing a remote administrator to securely access the SMC through a browser tunneled within IPsec.
\r\nThe TOE protects communications between distributed components using a TLS-based trusted channel. The TOE uses a distinct TLS channel while registering new Engines with the SMC and once registered, the Engine and SMC communication is replaced with a different mutually-authenticated TLS channel to protect management communications.
\r\n","features":[{"id":5784,"feature_name":"Auditing"},{"id":5785,"feature_name":"Certificate Validation"},{"id":5786,"feature_name":"Cryptographic Hashing"},{"id":5787,"feature_name":"Cryptographic Key Generation"},{"id":5788,"feature_name":"Cryptographic Signature Generation"},{"id":5789,"feature_name":"Cryptographic Signature Validation"},{"id":5790,"feature_name":"Firewall"},{"id":5791,"feature_name":"IKEv2"},{"id":5792,"feature_name":"IPsec"},{"id":5793,"feature_name":"Keyed hash Message Authentication"},{"id":5794,"feature_name":"Network Device"},{"id":5795,"feature_name":"TLS 1.2"},{"id":5796,"feature_name":"TLS 1.3"},{"id":5797,"feature_name":"TLS Client with Mutual Authentication"},{"id":5798,"feature_name":"TLS Server with Mutual Authentication"},{"id":5799,"feature_name":"Trusted Update Function"},{"id":5800,"feature_name":"VPN Gateway"}]}