Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 W McAfee Security Target McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 Document Version 0.4 February 15, 2012 Document Version 0.4 © McAfee Page 1 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 Prepared For: Prepared By: McAfee KpexA cATee pexAssurance —— G R O U P——— McAfee, Inc. Apex Assurance Group, LLC 2821 Mission College Blvd. 530 Lytton Avenue, Ste. 200 Santa Clara, CA 95054 Palo Alto, CA 94301 www.mcafee.com www.apexassurance.com Abstract This document provides the basis for an evaluation of a specific Target of Evaluation (TOE), the Policy Auditor 6.0 and ePolicy Orchestrator 4.6. This Security Target (ST) defines a set of assumptions about the aspects of the environment, a list of threats that the product intends to counter, a set of security objectives, a set of security requirements and the IT security functions provided by the TOE which meet the set of requirements. Document Version 0.4 McAfee Page 2 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 Table of Contents 1 Introduction .. 1.1 ST Reference. 1.2 TOE Reference. 1.3 Document Organization... 1.4 Document Conventions 1.5 Document Terminology 1.6 TOE Overview.. 1.7 TOE Description... 1.7.1 Physical Boundary .. 1.7.2 Hardware and Software Supplied by the IT Environment. 1.7.3 Logical Boundary... 1.7.4 TOE Data.. 1.8 Rationale for Non-bypassability and Separation of the TOE 2 Conformance Claims... 2.1 Common Criteria Conformance Claim . 2.2 Protection Profile Conformance Claim 3 Security Problem Definition 31 Threats 3.2 Organizational Security Policies 3.3 Assumptions .... 4 Security Objectives. 4.1 Security Objectives for the TOE .. 4.2 Security Objectives for the Operational Environment... 4.3 Security Objectives Rationale... 5 Extended Components Definition 5.1 IDS Class of SFRs.. 5.1.1 IDS_SDC.1 System Data Collection 5.1.2 IDS_ANL.1 Analyzer Analysis. 5.1.3 IDS_RDR.1 Restricted Data Review (EXT).. 5.14 IDS_STG.1 Guarantee of System Data Availabil 5.1.5 IDS_STG.2 Prevention of System Data Loss ..... 6 Security Requirements ..... wee 6.1 Security Functional Requirements 6.1.1 Security Audit (FAU) 6.1.2 Identification and Authentication (FIA) .... 6.1.3 Security Management (FMT) 6.1.4 Protection of the TSF (FPT) 6.15 IDS Component Requirements (IDS) .. 6.2 Security Assurance Requirements ..... 6.3 CC Component Hierarchies and Dependencies.. 6.4 Security Requirements Rationale... 6.4.1 Security Functional Requirements for the TOE... Document Version 0.4 © McAfee Page 3 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 6.4.2 Security Assurance Requirements 6.5 TOE Summary Specification Rationale .... 7 TOE Summary Specification 7.1 Policy Audits … 7.2 Identification... 7.3 Management... 7.3.1 ePO User Account Managemen 7.3.2 Permission Set Management... 7.3.3 Audit Log Management 7.3.4 Policy Audit Event Log Management. 7.3.5 Event Filtering Management. 7.3.6 System Tree Management... 7.3.7 Tag Management 7.3.8 Product Policy Management. 7.3.9 Query Management 7.3.10 Dashboard Management. 7.3.11 Benchmark Management 7.3.12 Policy Auditor Management 7.3.13 Policy Audit Management... 7.3.14 \Waiver Management .... 7.3.15 File Integrity Managemen 7.4 Audit 7.5 System Information Import. 7.5.1 SCAP Data Exchange List of Tables Table 1 — ST Organization and Section Descriptions ... Table 2 - Terms and Acronyms Used in Security Target Table 3 — Evaluated Configuration for the TOE ..... Table 4 - Management System Component Requirements..... Table 5 - Supported Agent Platforms Table 6 — Agent Platform Hardware Requirements Table 7 — Logical Boundary Descriptions... Table 8 — TOE Data (Legend: AD=Authentication data; UA=User attribute; GE=Generic Information) ... Table 9 - Threats Addressed by the TOE..... Table 10 — Threats Addressed by the IT Environment... Table 11 — Organizational Security Policies..... Table 12 - Assumptions. Table 13 — TOE Security Objectives ... Document Version 0.4 McAfee Page 4 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 Table 14 — Operational Environment Security Objectives... Table 15 - Mapping of Assumptions, Threats, and OSPs to Security Objective: Table 16 — Rationale for Mapping of Threats, Policies, and Assumptions to Objectives... Table 17 - System Data Collection Events and Details... Table 18 - TOE Functional Components. Table 19 - Audit Events and Details .. Table 20 - TSF Data Access Permissions. Table 21 - System Data Collection Events and Details... Table 22 - Security Assurance Requirements at EAL2 ... Table 23 - TOE SFR Dependency Rationale.... Table 24 - Mapping of TOE SFRs to Security Objectives Table 25 — Rationale for Mapping of TOE SFRs to Objectives Table 26 — Security Assurance Measures ... Table 27 — SFR to TOE Security Functions Mapping .... Table 28 — SFR to TSF Rational List of Figures Figure 1— TOE Boundary... Figure 2 — Benchmark Structure..... Document Version 0.4 McAfee Page 5 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 1 Introduction This section identifies the Security Target (ST), Target of Evaluation (TOE), Security Target organization, document conventions, and terminology. It also includes an overview of the evaluated product. 1.1 ST Reference ST Title Security Target: McAfee Policy Auditor 6.0 and ePolicy Orchestrator 4.6 ST Revision 0.4 ST Publication Date Author February 15, 2012 Apex Assurance Group 1.2 TOE Reference TOE Reference TOE Type McAfee Policy Auditor 6.0 and ePolicy Orchestrator 4.6 Security Management 1.3 Document Organization This Security Target follows the following format: SECTION | TITLE DESCRIPTION 1 Introduction Provides an overview of the TOE and defines the hardware and software that make up the TOE as well as the physical and logical boundaries of the TOE 2 Conformance Claims Lists evaluation conformance to Common Criteria versions, Protection Profiles, or Packages where applicable 3 Security Problem Definition Specifies the threats, assumptions and organizational security policies that affect the TOE 4 Security Objectives Defines the security objectives for the TOE/operational environment and provides a rationale to demonstrate that the security objectives satisfy the threats 5 Extended Components Describes extended components of the evaluation (if any) Definition 6 Security Requirements Contains the functional and assurance requirements for this TOE 7 TOE Summary Specification Identifies the IT security functions provided by the TOE and also identifies the assurance measures targeted to meet the assurance requirements. Table 1 — ST Organization and Section Descriptions Document Version 0.4 McAfee Page 6 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 1.4 Document Conventions The notation, formatting, and conventions used in this Security Target are consistent with those used in Version 3.1 of the Common Criteria. Selected presentation choices are discussed here to aid the Security Target reader. The Common Criteria allows several operations to be performed on functional requirements: The allowable operations defined in Part 2 of the Common Criteria are refinement, selection, assignment and iteration. * The assignment operation is used to assign a specific value to an unspecified parameter, such as the length of a password. An assignment operation is indicated by italicized text. * The refinement operation is used to add detail to a requirement, and thus further restricts a requirement. Refinement of security requirements is denoted by bold text. Any text removed is indicated with a strikethrough format (Example: TSF). * The selection operation is picking one or more items from a list in order to narrow the scope of a component element. Selections are denoted by underlined text. ¢ Iterated functional and assurance requirements are given unique identifiers by appending to the base requirement identifier from the Common Criteria an iteration number inside parenthesis, for example, FIA_UAU.1.1 (1) and FIA_UAU.1.1 (2) refer to separate instances of the FIA_UAU.1 security functional requirement component. Outside the SFRs, italicized text is used for both official document titles and text meant to be emphasized more than plain text. 1.5 Document Terminology The following table’ describes the terms and acronyms used in this document: AD Active Directory cc Common Criteria version 3.1 (ISO/IEC 15408) CPU Central Processing Unit DBMS DataBase Management System DNS Domain Name System Dss Data Security Standard EAL Evaluation Assurance Level ePO ePolicy Orchestrator FDCC Federal Desktop Core Configuration FISMA Federal Information Security Management Act GUI Graphical User Interface HIPAA Health Insurance Portability and Accountability Act I&A Identification & Authentication * Derived from the IDSPP Document Version 0.4 McAfee Page 7 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 IDS Intrusion Detection System ls Internet Information Services IP Internet Protocol IT Information Technology JDBC Java DataBase Connectivity LDAP Lightweight Directory Access Protocol MAC Media Access Control MDAC Microsoft Data Access Components MSDE MS Data Engine NTFS New Technology File System NTP Network Time Protocol OEM Original Equipment Manufacturer Os Operating System OSP Organizational Security Policy OVAL Open Vulnerability Assessment Language PCI Payment Card Industry PDC Primary Domain Controller PP Protection Profile RAM Random Access Memory SCAP Security Content Automation Protocol SF Security Function SFP Security Function Policy SFR Security Functional Requirement SMTP Simple Mail Transfer Protocol SNMP Simple Network Mail Protocol SOF Strength Of Function SP Service Pack SQL Structured Query Language SSL Secure Socket Layer ST Security Target TOE Target of Evaluation TSC TOE Scope of Control TSF TOE Security Function TSP TOE Security Policy VGA Video Graphics Array XCCDF eXtensible Configuration Checklist Description Format XML eXtensible Markup Language Table 2 - Terms and Acronyms Used in Security Target 1.6 TOE Overview McAfee Policy Auditor 6.0 is an agent-based, purpose-built IT policy audit solution that leverages the XCCDF (version 1.1.4) and OVAL (version 5.9 and earlier) security standards to automate the processes required for internal and external IT audits. McAfee Policy Auditor evaluates the status of managed Document Version 0.4 © McAfee Page 8 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 systems relative to audits that contain benchmarks. Benchmarks contain rules that describe the desired state of a managed system. Benchmarks are distributed with the TOE or imported into McAfee Benchmark Editor and, once activated, can be used by Policy Auditor. Benchmarks are written in the open-source XML standard formats Extensible Configuration Checklist Description Format (XCCDF) and the Open Vulnerability Assessment Language (OVAL). XCCDF describes what to check while OVAL specifies how to perform the check. Seamless integration with McAfee ePolicy Orchestrator® (ePO™) eases agent deployment, management, and reporting. ePO provides the user interface for the TOE via a GUI accessed from remote systems using web browsers. The ePO web dashboard represents policy compliance by benchmark. Custom reports can be fully automated, scheduled, or exported. ePO requires user to identify and authenticate themselves before access is granted to any data or management functions. Audit records are generated to record configuration changes made by users. The audit records may be reviewed via the GUI. Based upon per-user permissions, users may configure the systems to be audited for policy compliance (the “managed systems”) along with the benchmarks to be checked. The Policy Auditor Agent Plug-In executing on the managed systems performs the policy audit and returns the results to Policy Auditor. Policy Auditor allows you to conduct policy audits on various releases of the following operating systems: * Microsoft Windows * Macintosh OS X ° HP-UX * Solaris * Red Hat Linux ° AIX Users can review the results of the policy audits via ePO. Access to this information is again limited by per-user permissions. Communication between the distributed components of the TOE is protected from disclosure and modification by cryptographic functionality provided by the operational environment. 1.7 TOE Description The TOE helps organizations monitor policy compliance on their assets by performing audits on those assets. This solution allows managers to continuously monitor the state of their assets. McAfee Policy Auditor utilizes the Security Content Automation Protocol (SCAP) standard, as specified by NIST Special Publication 800-126, to analyze computer security configuration information. Administrators configure the system, including user accounts. Users schedule policy audits and review the results. Document Version 0.4 © McAfee Page 9 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 1.7.1 Physical Boundary The TOE is a software TOE and includes: The ePO application executing on a dedicated server The Policy Auditor application on the same system as the ePO application The Benchmark Editor application on the same system as the ePO application The McAfee Agent application on each managed system to be audited yop Yeh Pp The Policy Auditor Agent Plug-In software on each managed system to be audited Note specifically that the hardware, operating systems and third party support software (e.g. DBMS) on each of the systems are excluded from the TOE boundary. In order to comply with the evaluated configuration, the following hardware and software components should be used: OE COMPONENT VERSION/MODEL TOE Software Policy Auditor 6.0 Benchmark Editor 6.0? Policy Auditor Agent Plug-In 6.0 ePolicy Orchestrator 4.6 McAfee Agent 4.6° IT Environment Specified in the following: * Table 4- Management System Component Requirements * Table 5 -Supported Agent Platforms + Table 6 - Agent Platform Hardware Requirements Table 3 - Evaluated Configuration for the TOE The evaluated configuration consists of a single instance of the management system (with ePO, Policy Auditor and Benchmark Editor) and one or more instances of managed systems (with McAfee Agent and the Policy Auditor Agent Plug-in). ePO supports both ePO authentication and Windows authentication of user account credentials. The evaluated configuration requires the use of Windows authentication only. User accounts (other than the password) are still required to be defined in ePO so that attributes can be associated with the account. The following figure presents an example of an operational configuration. The shaded elements in the boxes at the top of the figure represent the TOE components. ? Benchmark Editor 6.0 and Policy Auditor Agent 6.0 are shipped/packaged with Policy Auditor 6.0. From a clean installation, no additional steps are necessary to install Benchmark Editor 6.0 and Policy Auditor Agent 6.0. 5 McAfee Agent 4.6 is shipped/packaged with ePO 4.6. From a clean installation, no additional steps are necessary to install McAfee Agent 4.6. Document Version 0.4 McAfee Page 10 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 Management System Managed System(s) ise Network Enterprise Netwoi Te Plug-in Sys Admin Console DBMS / SUN JRE / RSA Crypto Lib Web Browser RSA Crypto Lib Microsoft Windows Operating System | | Microsoft Windows Operating System Operating System General Purpose Computing Platform General Purpose Computing Platform General Purpose Computing Platform | = TOE Component = IT Environment Component Figure 1- TOE Boundary The following specific configuration options apply to the evaluated configuration: 1. The McAfee Agent system tray icon is not displayed on managed systems. 2. McAfee Agent wake-up calls are enabled. 3. Incoming connections to McAfee Agents are only accepted from the configured address of the ePO server 4. The only repository supported is the ePO server. 5. SQLServer 2005 Express and 2008 Express must not be used. Only Microsoft SQL Server 2005 and Microsoft SQL Server 2008 are supported in the evaluated configuration. 6. Updates to the TOE software are not permitted in the evaluated configuration. Please note that the installation of the TOE will not have an adverse effect on other McAfee products that may be installed or supported by ePO. Similarly, other McAfee products installed within the ePO framework will not have an adverse effect on the TOE. The architecture of the ePO framework (i.e., the use of product extensions to support specific functionality) facilitates the use of multiple McAfee products on a single ePO server. 1.7.2 Hardware and Software Supplied by the IT Environment The TOE consists of a set of software applications. The hardware, operating systems and all third party support software (e.g., DBMS) on the systems on which the TOE executes are excluded from the TOE boundary. Document Version 0.4 © McAfee Page 11 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 The platform on which the ePO, Policy Auditor and Benchmark Editor software is installed must be dedicated to functioning as the management system. ePO operates as a distribution system and management system for a client-server architecture offering components for the server part of the architecture (not the clients). The TOE requires the following hardware and software configuration on this platform. COMPONENT MINIMUM REQUIREMENTS Processor Intel Pentium 4-class or higher 1.3 GHz or higher Memory 2 GB available RAM minimum 4 GB available RAM recommended minimum Free Disk Space 1.5 GB — First-time installation minimum 2 GB — Upgrade minimum 2.5 GB — Recommended minimum Monitor 1024x768, 256-color, VGA monitor or higher Operating System Windows Server 2003 Enterprise with Service Pack 2 or later Windows Server 2003 Standard with Service Pack 2 or later Windows Server 2003 Datacenter with Service Pack 2 or later Windows Server 2008 Enterprise with Service Pack 2 or later Windows Server 2008 Standard with Service Pack 2 or later Windows Server 2008 Datacenter with Service Pack 2 or later Windows Server 2008 R2 Enterprise Windows Server 2008 R2 Standard Windows Server 2008 R2 Datacenter Windows 2008 Small Business Server Premium Virtual Infrastructure (Optional) Citrix XenServer 5.5 Update 2 Microsoft Hyper-V Server 2008 R2 VMware ESX 3.5 Update 4 VMware ESX 4.0 Update 1 DBMS Microsoft SQL Server 2005 (with Service Pack 3 or higher) Microsoft SQL Server 2008 SP1/SP2/R2 Network Card Ethernet, 100Mb or higher Disk Partition Formats NTFS Domain Controllers The system must have a trust relationship with the Primary Domain Controller (PDC) on the network Miscellaneous Microsoft .NET Framework 2.0 or later (Required — You must acquire and install this software manually. This software is required if you select an installation option that automatically installs the SQL Server Express 2005 software bundled with this ePolicy Orchestrator software.) Microsoft updates Microsoft Visual C++ Required — Installed automatically. 2005 SP1 Redistributable Microsoft Visual C++ Required — Installed automatically. 2008 Redistributable Package (x86) MSXML 6.0 Table 4 - Management System Component Requirements Document Version 0.4 © McAfee Page 12 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 The McAfee Agent and Policy Auditor Agent Plug-In execute on one or more systems whose policy settings are to be audited. The supported platforms for these components are: Windows 2000 Server SUPPORTED AGENT OS PLATFORM X86 platforms Windows 2000 Advanced Server with SP 1, 2, 3, or 4 X86 platforms Windows 2000 Professional with SP 1, 2, 3, or 4 X86 platforms Windows XP Professional with SP1 X86 and X64 platforms Windows Server 2003 Standard Edition X86 and X64 platforms Windows Server 2003 Enterprise Edition X86 and X64 platforms Windows Vista, 7 X86 and X64 platforms Windows 2008 Server X86 and X64 platforms Mac OS X 10.4, 10.5, 10.6 X86 and X64 platforms, PowerPC HP-UX 11i v1, HP-UX 11i v2, HP-UX 11i v2 Itanium, HP- UX 11i v3, HP-UX 11i v3 Itanium RISC Solaris 8, 9, 10 SPARC SuSE Linux 9, Enterprise Server 10, Enterprise Server 11 X86 and X64 platforms Red Hat Linux AS, ES, WS 4.0 X86 and X64 platforms Red Hat Enterprise Linux 5.0, 5.1, 6.0 X86 and X64 platforms AIX 5.3 (TL8 SP5) and AIX 6.1 (TL2 SPO) Power5, Power 6 Table 5 — Supported Agent Platforms The minimum hardware requirements for the agent platforms are specified in the following table: COMPONENT MINIMUM HARDWARE REQUIREMENTS Memory 20 MB RAM Free Disk Space 300 MB Processor Intel Pentium---class, Celeron, or compatible processor; 166 MHz processor or higher. Table 6 - Agent Platform Hardware Requirements The management system is accessed from remote systems via a browser. The supported browsers are Firefox 3.5, Firefox 3.6, Internet Explorer 7.0, Internet Explorer 8.0. The TOE relies on Windows to authenticate user credentials during the logon process. ePolicy Orchestrator also fully supports certificate-based authentication. User accounts must also be defined within ePO in order to associate permissions with the users. 1.7.3 Logical Boundary This section outlines the boundaries of the security functionality of the TOE; the logical boundary ofthe TOE includes the security functionality described in the following sections. | TSF DESCRIPTION Document Version 0.4 © McAfee Page 13 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 TSF Policy Audits DESCRIPTION The TOE audits managed systems to determine policy compliance on those systems. Results of the policy audits are stored in the database (the DBMS is in the IT Environment), and reports based upon completed policy audits may be retrieved via the GUI interface or by generating SCAP-conformant XML files to be shared with external systems. Identification On the management system, the TOE requires users to identify and authenticate themselves before accessing the TOE software. User accounts must be defined within ePO, but authentication of the user credentials is performed by Windows. No action can be initiated before proper identification and authentication. Each TOE user has security attributes associated with their user account that define the functionality the user is allowed to perform. On the management system and all managed systems, I&A for local login to the operating system (i.e., via a local console) is performed by the local OS (IT Environment). Management The TOE’s Management Security Function provides support functionality that enables users to configure and manage TOE components. Management of the TOE may be performed via the GUI. Management privileges are defined per-user. Audit The TOE’s Audit Security Function provides auditing of management actions performed by administrators. Authorized users may review the audit records via ePO. System The TOE may be configured to import information about systems to be managed Information from Active Directory (LDAP servers) or NT domain controllers. This functionality Import ensures that all the defined systems in the enterprise network are known to the TOE and may be configured to be managed. SCAP Data The TOE must be able to import and export SCAP benchmark assessment data. This Exchange functionality ensures that the assessments remain current as new benchmarks are developed and allows custom-designed benchmarks in the TOE to be made available to other systems Table 7 — Logical Boundary Descriptions 1.7.4 TOE Data TOE data consists of both TSF data and user data (information). TSF data consists of authentication data, security attributes, and other generic configuration information. Security attributes enable the TOE to enforce the security policy. Authentication data enables the TOE to identify and authenticate users. TSF Data Description GE Benchmarks Contain an organized set of rules that describe the desired v state of a set of managed systems. Contacts A list of email addresses that ePolicy Orchestrator uses to v send email messages to specified users in response to events. Dashboards Collections of chart-based queries that are refreshed at a v user-configured interval. Document Version 0.4 McAfee Page 14 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 TSF Data GE Data Retention | Parameters controlling the length of time policy audit event v records are saved in the database. ePO User ePO user name, authentication configuration, enabled status, Accounts Global Administrator status and permission sets for each user authorized to access TOE functionality on the management system. Event Filtering Specifies which events are forwarded to the server from the v agents on the managed systems. Global Individual ePO user accounts may be configured as Global v ‚Administrator Administrators, which means they have read and write Status permissions and rights to all operations. Groups Node on the hierarchical System Tree that may contain v subordinate groups or systems. Maximum Low | The scoring threshold at which systems are considered to fail v Score the policy audit. Permission A privilege to perform a specific function. v Permission Set A group of permissions that can be granted to any users by v assigning it to those users’ accounts. Policy Audit Causes managed systems to be analyzed relative to a v specified benchmark at a configured frequency. Product Policy A collection of settings that you create, configure, then v enforce to ensure that the managed security software products (e.g., Policy Auditor) are configured and perform accordingly on the managed systems. Queries Configurable objects that retrieve and display data from the v database. Scoring Model Specifies which of the XCCDF 1.1.4 scoring models is used to v calculate the compliance score for the results of a policy audit. Server Settings | Control how the ePolicy Orchestrator server behaves. v System Data Results of audits performed on managed systems. v System Information specific to a single managed system (e.g. v Information internet address) in the System Tree. System Tree A hierarchical collection of all of the systems managed by v ePolicy Orchestrator. Tags Labels that you can apply to one or more systems, v automatically (based on criteria) or manually. Waivers Specify temporary affects to the scoring of policy audits. v File Integrity Designate a set of files to monitor for changes. v Monitoring Table 8 - TOE Data (Legend: AD=Authentication data; UA=User attribute; GE=Generic Information) Document Version 0.4 © McAfee Page 15 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 1.8 Rationale for Non-bypassability and Separation of the TOE The responsibility for non-bypassability and non-interference is split between the TOE and the IT Environment. TOE components are software only products and therefore the non-bypassability and non-interference claims are dependent upon hardware and OS mechanisms. The TOE runs on top of the IT Environment supplied operating systems. The TOE ensures that the security policy is applied and succeeds before further processing is permitted whenever a security relevant interface is invoked: the interfaces are well defined and insure that the access restrictions are enforced. Non-security relevant interfaces do not interact with the security functionality of the TOE. The TOE depends upon OS mechanisms to protect TSF data such that it can only be accessed via the TOE. The system on which ePO, Policy Auditor and Benchmark Editor execute is dedicated to that purpose. The McAfee Agent and Policy Auditor Agent Plug-In execute on non- dedicated systems; these components only perform policy audits and do not enforce access control policies for users. The TOE is implemented with well-defined interfaces that can be categorized as security relevant or non-security relevant. The TOE is implemented such that non-security relevant interfaces have no means of impacting the security functionality of the TOE. Unauthenticated users may not perform any actions within the TOE. The TOE tracks multiple users by sessions and ensures the access privileges of each are enforced. The server hardware provides virtual memory and process separation, which the server OS utilizes to ensure that other (non-TOE) processes may not interfere with the TOE; all interactions are limited to the defined TOE interfaces. The OS and DBMS restrict access to TOE data in the database to prevent interference with the TOE via that mechanism. The TOE consists of distributed components. Communication between the components relies upon cryptographic functionality provided by the OS or third party software (operational environment) to protect the information exchanged from disclosure or modification. . Document Version 0.4 © McAfee Page 16 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 2 Conformance Claims 2.1 Common Criteria Conformance Claim The TOE is Common Criteria Version 3.1 Revision 3 (July 2009) Part 2 extended and Part 3 conformant at Evaluation Assurance Level 2 and augmented by ALC_FLR.2 — Flaw Reporting Procedures. 2.2 Protection Profile Conformance Claim The TOE does not claim conformance to a Protection Profile. Document Version 0.4 © McAfee Page 17 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 3 Security Problem Definition In order to clarify the nature of the security problem that the TOE is intended to solve, this section describes the following: ® Any known or assumed threats to the assets against which specific protection within the TOE or its environment is required. * — Any organizational security policy statements or rules with which the TOE must comply. * Any assumptions about the security aspects of the environment and/or of the manner in which the TOE is intended to be used. This chapter identifies assumptions as A.assumption, threats as T.threat and policies as P.policy. 3.1 Threats The following are threats identified for the TOE and the IT System the TOE monitors. The TOE itself has threats and the TOE is also responsible for addressing threats to the environment in which it resides. The assumed level of expertise of the attacker for all the threats is unsophisticated. The TOE addresses the following threats: THREAT DESCRIPTION T.COMDIS An unauthorized user may attempt to disclose the data collected and produced by the TOE by bypassing a security mechanism. T.COMINT An unauthorized user may attempt to compromise the integrity of the data collected and produced by the TOE by bypassing a security mechanism. T.IMPCON An unauthorized user may inappropriately change the configuration of the TOE causing potential intrusions to go undetected. T.LOSSOF An unauthorized user may attempt to remove or destroy data collected and produced by the TOE. T.NOHALT An unauthorized user may attempt to compromise the continuity of the System’s collection and analysis functions by halting execution of the TOE. T.PRIVIL An unauthorized user may gain access to the TOE and exploit system privileges to gain access to TOE security functions and data Table 9- Threats Addressed by the TOE The following table identifies threats to the managed systems that may be indicative of vulnerabilities in or misuse of IT resources: T.FALREC The TOE may fail to recognize vulnerabilities or inappropriate activity based on data acquired from managed systems. T.SCNCFG Improper security configuration settings may exist in the managed systems. Document Version 0.4 McAfee Page 18 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 THREAT DESCRIPTION T.SCNMLC Users could execute malicious code on an IT System that the TOE monitors which causes modification of the IT System protected data or undermines the IT System security functions. T.SCNVUL Vulnerabilities may exist in the IT System the TOE monitors. Table 10 - Threats Addressed by the IT Environment 3.2 Organizational Security Policies An organizational security policy is a set of rules, practices, and procedures imposed by an organization to address its security needs. The following Organizational Security Policies apply to the TOE: POLICY DESCRIPTION P.ACCACT Users of the TOE shall be accountable for their actions within the TOE. P.ACCESS All data collected and produced by the TOE shall only be used for authorized purposes. P.ANALYZ Analytical processes and information to derive conclusions about intrusions (past, present, or future) must be applied to data received from data sources and appropriate response actions taken. P.DETECT Static configuration information that might be indicative of the potential for a future intrusion or the occurrence of a past intrusion of an IT System or events that are indicative of inappropriate activity that may have resulted from misuse, access, or malicious activity of IT System assets must be collected. P.IMPORT The TOE shall be able to import data about managed systems from LDAP servers and NT Domains. P.INTGTY Data collected and produced by the TOE shall be protected from modification. P.MANAGE The TOE shall only be managed by authorized users. P.PROTCT The TOE shall be protected from unauthorized accesses and disruptions of TOE data and functions. P.SCAP The TOE shall be able to exchange SCAP Benchmark Assessment data with external systems. Table 11 - Organizational Security Policies 3.3 Assumptions This section describes the security aspects of the environment in which the TOE is intended to be used. The TOE is assured to provide effective security measures in a co-operative non-hostile environment only if it is installed, managed, and used correctly. The following specific conditions are assumed to exist in an environment where the TOE is employed. ASSUMPTION DESCRIPTION A.ACCESS The TOE has access to all the IT System data it needs to perform its functions. A.ASCOPE The TOE is appropriately scalable to the IT Systems the TOE monitors. A.DATABASE Access to the database used by the TOE via mechanisms outside the TOE boundary is restricted to use by authorized users. Document Version 0.4 McAfee Page 19 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 ASSUMPTION DESCRIPTION A.DYNMIC The TOE will be managed in a manner that allows it to appropriately address changes in the IT System the TOE monitors. A.LOCATE The processing resources of the TOE will be located within controlled access facilities, which will prevent unauthorized physical access. A.MANAGE There will be one or more competent individuals assigned to manage the TOE and the security of the information it contains. A.NOEVIL The authorized administrators are not careless, willfully negligent, or hostile, and will follow and abide by the instructions provided by the TOE documentation. A.PROTCT The TOE hardware and software critical to security policy enforcement will be protected from unauthorized physical modification. Table 12 — Assumptions Document Version 0.4 McAfee Page 20 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 4 Security Objectives 4.1 Security Objectives for the TOE The IT security objectives for the TOE are addressed below: OBJECTIVE DESCRIPTION O.ACCESS The TOE must allow authorized users to access only authorized TOE functions and data. O.AUDITS The TOE must record audit records for data accesses and use of the TOE functions on the management system. O.AUDIT_PROTECT The TOE will provide the capability to protect audit information generated by the TOE. O.EADMIN The TOE must include a set of functions that allow effective management of its functions and data. O.IDANLZ The TOE must apply analytical processes and information to derive conclusions about intrusions (past, present, or future). O.IDENTIFY The TOE must be able to identify users prior to allowing access to TOE functions and data on the management system. O.IDSCAN The TOE must collect and store static configuration information that might be indicative of the potential for a future intrusion or the occurrence of a past intrusion of an IT System. O.IMPORT The TOE shall provide mechanisms to import system data from Active Directory (LDAP servers) and NT Domain Controllers. O.INTEGR The TOE must ensure the integrity of all System data. O.OFLOWS The TOE must appropriately handle potential System data storage overflows. O.SCAP The TOE shall provide mechanisms to exchange SCAP Benchmark Assessment data. O.SD_PROTECTION The TOE will provide the capability to protect system data. Table 13 — TOE Security Objectives 4.2 Security Objectives for the Operational Environment The security objectives for the operational environment are addressed below: OBJECTIVE DESCRIPTION O. PHYCAL Those responsible for the TOE must ensure that those parts of the TOE critical to security policy are protected from any physical attack. O.CREDEN Those responsible for the TOE must ensure that all access credentials are protected by the users in a manner which is consistent with IT security. O.INSTAL Those responsible for the TOE must ensure that the TOE is delivered, installed, managed, and operated in a manner which is consistent with IT security. O.INTROP The TOE is interoperable with the managed systems it monitors Document Version 0.4 © McAfee Page 21 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 OBJECTIVE DESCRIPTION O.PERSON Personnel working as authorized administrators shall be carefully selected and trained for proper operation of the System. OE.AUDIT_PROTECT The IT Environment will provide the capability to protect audit information generated by the TOE via mechanisms outside the TSC. OE.AUDIT_REVIEW The IT Environment will provide the capability for authorized administrators to review audit information generated by the TOE. OE.CRYPTO The IT Environment will provide the cryptographic functionality and protocols required for the TOE to securely transfer information between distributed portions of the TOE. OE.DATABASE Those responsible for the TOE must ensure that access to the database via mechanisms outside the TOE boundary (e.g., DBMS) is restricted to authorized users only. OE.IDAUTH The IT Environment must be able to identify and authenticate users prior to them gaining access to TOE functionality on the managed system. It must also be able to authenticate user credentials on the management system when requested by the TOE. OE.PROTECT The IT environment will protect itself and the TOE from external interference or tampering. OE.SD_PROTECTION The IT Environment will provide the capability to protect system data via mechanisms outside the TSC. OE.STORAGE The IT Environment will store TOE data in the database and retrieve it when directed by the TOE. OE.TIME The IT Environment will provide reliable timestamps to the TOE Table 14 — Operational Environment Security Objectives 4.3 Security Objectives Rationale This section provides the summary that all security objectives are traced back to aspects of the addressed assumptions, threats, and Organizational Security Policies (if applicable). The following table provides a high level mapping of coverage for each threat, assumption, and policy: OBJECTIVE OE.AUDIT_REVIEW THREAT / ASSUMPTION A.ACCESS A.ASCOPE A.DATABASE v A.DYNMIC v A.LOCATE v A.MANAGE v A.NOEVIL vv O.AUDIT_PROTECT O.SD_PROTECTION OE.SD_PROTECTION OE.AUDIT_PROTECT ENRN O.INTROP «| Document Version 0.4 © McAfee Page 22 of 64 Security Target: McAfee Policy Auditor 6.0 and McAfee ePolicy Orchestrator 4.6 OBJECTIVE ENEESOE.AUDIT_REVIEW