National Information Assurance Partnership Common Criteria Evaluation and Validation Scheme Validation Report for the Trellix Security Enterprise Security Manager v11.6.12 Report Number: CCEVS-VR-VID11470-2025 Dated: 03/18/2025 Version: 0.4 National Institute of Standards and Technology Department of Defense Information Technology Laboratory ATTN: NIAP, SUITE 6982 100 Bureau Drive 9800 Savage Road Gaithersburg, MD 20899 Fort Meade, MD 20755-6982 ® TM 2 ACKNOWLEDGEMENTS Validation Team Jerome Myers Meredith Martinez The Aerospace Corporation Farid Ahmed Anne Gugel Russell Fink The Johns Hopkins Applied Physics Laboratory Common Criteria Testing Laboratory Siddhant Kasley Snehal Gaonkar Rahul Joshi Joan Marshall Intertek Acumen Security 3 Table of Contents 1 Executive Summary............................................................................................................... 5 2 Identification.......................................................................................................................... 6 3 Architectural Information .................................................................................................... 8 3.1 TOE Description.............................................................................................................................................8 3.1.1 Component Descriptions..........................................................................................................................12 3.1.2 Evaluated Configuration .........................................................................................................................13 3.1.3 Physical Boundary ...................................................................................................................................13 4 Security Policy...................................................................................................................... 16 4.1 Security Functions Provided by the TOE...................................................................................................16 4.1.1 Security Audit...........................................................................................................................................16 4.1.2 Cryptographic Support ...........................................................................................................................16 4.1.3 Identification and Authentication...........................................................................................................17 4.1.4 Security Management ..............................................................................................................................17 4.1.5 Protection of the TSF...............................................................................................................................17 4.1.6 TOE Access...............................................................................................................................................17 4.1.7 Trusted Path/Channels ............................................................................................................................17 5 Assumptions, Threats & Clarification of Scope ............................................................... 19 5.1 Assumptions..................................................................................................................................................19 5.2 Threats...........................................................................................................................................................21 5.3 Clarification of Scope...................................................................................................................................23 6 Documentation..................................................................................................................... 25 7 TOE Evaluated Configuration ........................................................................................... 26 7.1 Evaluated Configuration..............................................................................................................................26 7.2 Excluded Functionality ................................................................................................................................26 8 IT Product Testing............................................................................................................... 27 8.1 Developer Testing.........................................................................................................................................27 8.2 Evaluation Team Independent Testing.......................................................................................................27 9 Results of the Evaluation .................................................................................................... 28 9.1 Evaluation of Security Target .....................................................................................................................28 9.2 Evaluation of Development Documentation...............................................................................................28 9.3 Evaluation of Guidance Documents............................................................................................................28 9.4 Evaluation of Life Cycle Support Activities...............................................................................................29 9.5 Evaluation of Test Documentation and the Test Activity .........................................................................29 9.6 Vulnerability Assessment Activity ..............................................................................................................29 9.7 Summary of Evaluation Results..................................................................................................................30 4 10 Validator Comments & Recommendations ...................................................................... 31 11 Annexes................................................................................................................................. 32 12 Security Target .................................................................................................................... 33 13 Glossary................................................................................................................................ 34 14 Bibliography......................................................................................................................... 35 5 1 Executive Summary This Validation Report (VR) is intended to assist the end user of this product and any security certification Agent for that end user in determining the suitability of this Information Technology (IT) product for their environment. End users should review the Security Target (ST), which is where specific security claims are made, in conjunction with this VR, which describes how those security claims were tested and evaluated and any restrictions on the evaluated configuration. Prospective users should carefully read the Assumptions and Clarification of Scope in Section 5 and the Validator Comments in Section 10, where any restrictions on the evaluated configuration are highlighted. This report documents the National Information Assurance Partnership (NIAP) assessment of the evaluation of the Trellix Security Enterprise Security Manager Target of Evaluation v11.6.12 (TOE). It presents the evaluation results, their justifications, and the conformance results. This VR is not an endorsement of the TOE by any agency of the U.S. Government and no warranty of the TOE is either expressed or implied. This VR applies only to the specific version and configuration of the product as evaluated and documented in the ST. The evaluation was completed by Intertek Acumen Security in March 2025. The information in this report is largely derived from the Evaluation Technical Report (ETR) and associated test report, all written by Acumen Security. The evaluation determined that the product is both Common Criteria Part 2 Extended and Part 3 Conformant and meets the assurance requirements defined in the U.S. Government Protection Profile for Security Requirements for collaborative Protection Profile for Network Devices, Version 2.2e [NDcPP v2.2e]. The Target of Evaluation (TOE) identified in this Validation Report has been evaluated at a NIAP approved Common Criteria Testing Laboratory using the Common Methodology for IT Security Evaluation (Version 3.1, Rev. 5) for conformance to the Common Criteria for IT Security Evaluation (Version 3.1, Rev. 5), as interpreted by the Assurance Activities contained in the collaborative Protection Profile for Network Devices, Version 2.2e [NDcPP v2.2e].This Validation Report applies only to the specific version of the TOE as evaluated. The evaluation has been conducted in accordance with the provisions of the NIAP Common Criteria Evaluation and Validation Scheme and the conclusions of the testing laboratory in the evaluation technical report are consistent with the evidence provided. The validation team provided guidance on technical issues and evaluation processes and reviewed the individual work units documented in the ETR and the Assurance Activities Report (AAR). The validation team found that the evaluation showed that the product satisfies all of the functional requirements and assurance requirements stated in the Security Target (ST). Based on these findings, the validation team concludes that the testing laboratory's findings are accurate, the conclusions justified, and the conformance results are correct. The conclusions of the testing laboratory in the evaluation technical report are consistent with the evidence produced. 6 2 Identification The CCEVS is a joint National Security Agency (NSA) and National Institute of Standards effort to establish commercial facilities to perform trusted product evaluations. Under this program, security evaluations are conducted by commercial testing laboratories called Common Criteria Testing Laboratories (CCTLs). CCTLs evaluate products against Protection Profile containing Assurance Activities, which are interpretation of CEM work units specific to the technology described by the PP. The NIAP Validation Body assigns Validators to monitor the CCTLs to ensure quality and consistency across evaluations. Developers of information technology products desiring a security evaluation contract with a CCTL and pay a fee for their product's evaluation. Upon successful completion of the evaluation, the product is added to NIAP's Product Compliance List. Table 1 provides information needed to completely identify the product, including: • The Target of Evaluation (TOE): the fully qualified identifier of the product as evaluated. • The Security Target (ST), describing the security features, claims, and assurances of the product. • The conformance result of the evaluation. • The Protection Profile(s) to which the product is conformant. • The organizations and individuals participating in the evaluation. Table 1: Evaluation Identifiers Item Identifier Evaluation Scheme United States NIAP Common Criteria Evaluation and Validation Scheme TOE Trellix Security Enterprise Security Manager v11.6.12 Protection Profile collaborative Protection Profile for Network Devices, Version 2.2e [NDcPP v2.2e] Security Target Trellix Security Enterprise Security Manager Security Target Evaluation Technical Report Evaluation Technical Report for Trellix Security Enterprise Security Manager v1.8 CC Version Version 3.1, Revision 5 Conformance Result CC Part 2 Extended and CC Part 3 Conformant Sponsor Trellix, Inc. Developer Trellix, Inc. Common Criteria Testing Lab (CCTL) Intertek Acumen Security Rockville, MD CCEVS Validators Jerome Myers Farid Ahmed Meredith Martinez Anne Gugel 7 Russell Fink 8 3 Architectural Information The Trellix Security Enterprise Security Manager v11.6.12 brings event, threat, and risk data together to provide strong security intelligence, rapid incident response, seamless log management, and extensible compliance reporting. The TOE is distributed amongst six devices as follows: Enterprise Security Manager (ESM), Event Receiver (ERC), Application Data Monitor (ADM), Advanced Correlation Engine (ACE), Enterprise Log Manager (ELM), and Enterprise Log Search (ELS). The six TOE components are divided into three categories as follows: • Management Component: ESM • Data Components: ERC, ADM • Auxiliary Components: ACE, ELM, ELS 3.1 TOE Description The TOE includes the hardware and software of the six Trellix Security Enterprise Security Manager v11.6.12 components. boundary encompasses all the devices of the Trellix Enterprise solution. The ESM is the central management entity responsible for managing all the other devices (colloquially called child devices) in the solution. All Data (ERC, ADM) and Auxiliary (ACE, ELM, ELS) are considered as child devices. Each of the child devices communicates with the ESM over TLS with mutual-authentication and SSH. The management-plane traffic between the ESM and child devices uses SSH; whereas the data-plane traffic uses X.509v3 mutually authenticated TLS. To manage the ESM (and the child devices via ESM), an administrator logs into the Web GUI of the ESM using HTTPS over TLS. Alternatively, an administrator may log into the local console of any of the TOE six components for local administration. Additionally, some of the child devices can communicate with each other over SSH and/or TLS trusted channels. The ESM communicates with a remote audit Syslog server over SSH to store the TOE-generated audit records. The Figure 1 below depicts a representative TOE deployment and interaction between the TOE components and external entities. Note: The different color coding is only used to easily distinguish communication between the endpoints and it has no other significance. Figure 1: Representative TOE Deployment 9 The TOE components communicate with each other over TLS or SSH as identified in the following table. The colored lines correspond to the Figure above. Table 1: TOE Components Communication TOE Component Client Server Protocol Purpose / Data Exchanged ESM ESM All other components SSH Control Plane. All configuration and control data. ESM acts as an SSH client, and other TOE components are SSH servers. ESM All other components TLS MA Data Plane. Correlation Data for analysis. ESM acts as a TLS client. All other components act as TLS servers. The TLS channel is Mutually Authenticated. ESM ACE TLS MA Data Plane. Parsed event log data. ESM acts as a TLS client. ACE acts as a TLS Server. The TLS channel is Mutually Authenticated. ACE ESM ACE SSH Control Plane. All configuration and control data. ESM acts as an SSH client, and other TOE components are SSH servers. ESM ACE TLS MA Data Plane. Correlation Data for analysis. ESM acts as a TLS client. All other components act as TLS 10 TOE Component Client Server Protocol Purpose / Data Exchanged servers. The TLS channel is Mutually Authenticated. ESM ACE TLS MA Data Plane. Parsed event log data. ESM acts as a TLS client. ACE acts as a TLS Server. The TLS channel is Mutually Authenticated. ACE ECR TLS MA Data Plane. Parsed event log data. ACE acts as a TLS Client. ERC acts as a TLS Server. The TLS channel is Mutually Authenticated. ERC ERC ELM SSH Data Plane. Raw event log data. ERC acts as an SSH client. ELM and ELS act as an SSH server ERC ELS SSH Data Plane. Raw event log data. ERC acts as an SSH client. ELM and ELS act as an SSH server ESM ERC SSH Control Plane. All configuration and control data. ESM acts as an SSH client, and other TOE components are SSH servers. ESM ERC TLS MA Data Plane. Parsed event log data. ESM acts as a TLS client. ERC acts as a TLS Server. The TLS channel is Mutually Authenticated. ACE ERC TLS MA Data Plane. Parsed event log data. ACE acts as a TLS Client. ERC acts as a TLS Server. The TLS channel is Mutually Authenticated. ELM ESM ELM SSH Control Plane. All configuration and control data. ESM acts as an SSH client, and other TOE components are SSH servers. ESM ELM TLS MA Data Plane. Correlation Data for analysis. ESM acts as a TLS client. All other components act as TLS servers. The TLS channel is Mutually Authenticated. 11 TOE Component Client Server Protocol Purpose / Data Exchanged ERC ELM SSH Data Plane. Raw event log data. ERC acts as an SSH client. ELM and ELS act as an SSH server ADM ESM ADM SSH Control Plane. All configuration and control data. ESM acts as an SSH client, and other TOE components are SSH servers. ESM ADM TLS MA Data Plane. Parsed event log data. ESM acts as a TLS client. ADM acts as a TLS Server. The TLS channel is Mutually Authenticated. ELS ESM ELS SSH Control Plane. All configuration and control data. ESM acts as an SSH client, and other TOE components are SSH servers. ESM ELS TLS MA Data Plane. Parsed event log data. ESM acts as a TLS client. ELS acts as a TLS Server. The TLS channel is Mutually Authenticated. ERC ELS SSH Data Plane. Raw event log data. ERC acts as an SSH client. ELM and ELS act as an SSH server The following table describes the Operational Environment. Table 2: TOE OE Components Communication IT Entity TOE Component Protocol Purpose / Data Exchanged Remote Administrator ESM HTTPS Control Plane. Administrator’s remote GUI session. ESM acts as a non-MA TLS server. NTP server ESM NTP v4 Time synchronization. ESM acts as an NTP client. The communication is unencrypted. External Audit Server ESM SSH Export audit logs. ESM acts as an SSH client. Local Administrator All TOE components Console Control Plane. Administrator’s local console session. The interface supports the CLI. 12 3.1.1 Component Descriptions 3.1.1.1 Management Component Enterprise Security Manager (ESM) The central point of administration for data, settings, and configuration. Using ESM allows you to keep all configuration settings, user and access group profiles, and event and flow data in a single location. It communicates with devices over an encrypted control channel. Central management for all devices. 3.1.1.2 Data Components Event Receiver (ERC) The ERC collects security events and network flow data from multi-vendor sources including firewalls, virtual private networks (VPNs), routers, and other network devices. The Receiver gathers and analyzes data from third-party network and security solutions, allowing for the collection and normalization of this data, which provides a single view across devices from multiple vendors. This allows event and flow data collection from devices that send data feeds to the Receiver. Application Data Monitor (ADM) The ADM passively monitors traffic, which it then decodes to detect anomalies in application protocols. The ADM accepts rule expressions and tests them against monitored traffic, inserting records into the event table of the database for each triggered rule. It stores the packet that triggered the rule in the event table's packet field. It also adds application-level metadata to the dB session and query tables of the database for every triggered rule. It stores a text representation of the protocol stack in the query table's packet field. 3.1.1.3 Auxiliary Components: Advanced Correlation Engine (ACE) Provides dedicated correlation logic to supplement existing ESM event correlation capabilities. It can be deployed in real-time or historical modes. When operating in real-time mode, events are analyzed as they are collected for immediate threat and risk detection. In historical mode, any available data collected by the ESM can be “replayed†through either or both correlation engines, for historical threat and risk detection. So, when new zero-day attacks are discovered, the ESM can look back to determine whether the organization was exposed to that attack in the past, for “sub-zero day†threat detection. It provides two dedicated correlation engines: • Risk correlation — A risk detection engine that generates a risk score using rule-less correlation. • Rule correlation — A threat detection engine that detects threats using a traditional rule- based event correlation. Enterprise Log Manager (ELM) 13 Supports the storage and management of, access to, and reporting of log data. You can define data sources as well as store and manage data from these data sources. You can also set up jobs that search, export, and check the data for integrity, allowing you to view the results and save the information. Log data from a given source may be associated with an ELS component or an ELM component, but not both. Enterprise Log Search (ELS) The ELS component provides high-speed access to the raw security events in an uncompressed form and is used to perform forensic analysis of events and quickly search through large amounts of log data. This component is optional in Trellix Enterprise installations. Log data from a given source may be associated with an ELS component or an ELM component, but not both. 3.1.2 Evaluated Configuration The minimum configuration required for a Trellix TOE deployment consists of at least one management component, one data component, and one auxiliary component. In addition to the minimum configuration, additional instances of the data components or auxiliary components can be added to expand upon the minimum configuration in order to address larger enterprise deployments. All six TOE components are part of the evaluation. However, a minimum configuration of the TOE that was tested is identified below. 1. Management Component: a. Enterprise Security Manager (ESM) 2. Data Components: a. Event Receiver (ERC) 3. Auxiliary Components: o Advanced Correlation Engine (ACE) 3.1.3 Physical Boundary The physical boundary of the TOE is illustrated by the solid Blue rectangular boxes in Figure 1 above. The TOE boundary includes the hardware, operating system, and Trellix application software of each of the six TOE components. The following table describes the hardware details and Table 4 describes the software details of the six TOE components. 14 Table 3: TOE Component Descriptions Component Required Network ports Processors Memory ESM Yes (1) One (1) IPMI port Two (2) Ethernet Management ports One (1) VGA to connect Monitor One (1) Ethernet port not used 2x Intel Xeon Gold 5218 (Cascade Lake) 16x 16GB DDR4 2933MHz 2x Intel Xeon Gold 6230 (Cascade Lake) 16x 32GB DDR4 2933MHz ERC Yes (At least 1) One (1) IPMI port Two (2) Ethernet Management ports One (1) Ethernet Additional Management port One (1) Ethernet port not used Two (2) Ethernet ports for HA 1 x Intel Xeon E- 2224 (Coffee Lake); or 2x Intel Xeon Gold 5218 (Cascade Lake) 2 x 16GB DDR4 2666MHz 16x 16GB DDR4 2933MHz ADM 2x Intel Xeon Gold 5218 (Cascade Lake) 16x 32GB DDR4 2933MHz ACE ELM ELS Yes (At least 1) One (1) IPMI port Two (2) Ethernet Management ports One (1) Ethernet Additional Management port One (1) Ethernet port not used Two (2) Ethernet ports for HA 2x Intel Xeon Gold 5218 (Cascade Lake) 16x 16GB DDR4 2933MHz 16x 32GB DDR4 2933MHz Table 4: TOE Software Component Descriptions Component Operating System Software Build Cryptographic Library ESM Trellix Nitro OS v11.6.12 ESS_update_11.6.12.signed.tgz BC-FJA (Bouncy Castle FIPS Java API) v 1.0.2.3 Trellix OpenSSL FIPS Object module v1.0.3 ERC RECIEVER_Update_11.6.12.signed.tgz ADM 15 Component Operating System Software Build Cryptographic Library ACE ELM ELS 16 4 Security Policy 4.1 Security Functions Provided by the TOE The TOE provides the security functions required by NDcPP v2.2e. 4.1.1 Security Audit The TOE keeps local and remote audit records of security relevant events. The TOE internally maintains the date and time which can either be set manually or synchronized with an NTP server. 4.1.2 Cryptographic Support The TOE provides cryptographic support for the services described in Table 5. The related FIPS140-2 validation details are provided in Table 21 of the ST. Table 5: TOE Provided Cryptography Cryptographic Method Use within the TOE Library Implementation TLS Establishment For inter-TOE-components communication (mutually authenticated TLS) For remote administrative sessions over HTTPS – non mutually authenticated TLS (ESM only) BC-FJA (Bouncy Castle FIPS Java API) v 1.0.2.3 Trellix OpenSSL FIPS Object module v1.0.3 SSH Establishment For inter-TOE-components communication Trellix OpenSSL FIPS Object module v1.0.3 ECDSA Signature Services Used in SSH session establishment. Trellix OpenSSL FIPS Object module v1.0.3 RSA Signature Services Used in TLS session establishment. Used in SSH session establishment. Used in secure software update BC-FJA (Bouncy Castle FIPS Java API) v 1.0.2.3 Trellix OpenSSL FIPS Object module v1.0.3 DRBG Used in TLS session establishment. Used in SSH session establishment BC-FJA (Bouncy Castle FIPS Java API) v 1.0.2.3 Trellix OpenSSL FIPS Object module v1.0.3 SHS Used in secure software update, as well as in computing hash values for TLS and SSH cryptographic operations. BC-FJA (Bouncy Castle FIPS Java API) v 1.0.2.3 Trellix OpenSSL FIPS Object module v1.0.3 HMAC-SHS Used to provide TLS traffic integrity verification. Used to provide SSH traffic integrity verification BC-FJA (Bouncy Castle FIPS Java API) v 1.0.2.3 Trellix OpenSSL FIPS Object module v1.0.3 17 Cryptographic Method Use within the TOE Library Implementation AES Used to encrypt TLS traffic Used to encrypt SSH traffic BC-FJA (Bouncy Castle FIPS Java API) v 1.0.2.3 Trellix OpenSSL FIPS Object module v1.0.3 4.1.3 Identification and Authentication Administrators connecting to the TOE are required to enter an administrator username and password to authenticate the administrative connection prior to access being granted. The TOE components authenticate to one another through X.509 certificates configured during the initial installation and setup process of the TOE (for data planes over TLS) or via public key authentication (for data planes over SSH). Administrators using the SSH remote CLI authenticate to the TOE using usernames and passwords. 4.1.4 Security Management The TOE enables secure local and remote management of its security functions, including: • Local console CLI administration. • Remote GUI administration via HTTPS/TLS. • Intra-TOE communication via SSHv2. • Timed user lockout after multiple failed authentication attempts. • Password complexity enforcement. • Configurable banners to be displayed at login. • Timeouts to terminate administrative sessions after a set period of inactivity. • Protection of secret keys and passwords. 4.1.5 Protection of the TSF The TOE ensures the authenticity and integrity of software updates through digital signatures and requires administrative intervention prior to the software updates being installed. The TOE performs a suite of self-tests to ensure the correct operation and enforcement of its security functions. 4.1.6 TOE Access The TOE monitors local and remote administrative sessions for inactivity and terminates the session when a threshold time is reached. An advisory notice is displayed at the start of each session. 4.1.7 Trusted Path/Channels The TSF provides the following trusted communication channels: • SSH for an audit server 18 • TLS/HTTPS for remote administrators • SSH for communication between TOE components 19 5 Assumptions, Threats & Clarification of Scope 5.1 Assumptions The specific conditions listed in the following subsections are assumed to exist in the TOE’s environment. These assumptions include both practical realities in the development of the TOE security requirements and the essential environmental conditions on the use of the TOE. The assumptions included in Table 6 are drawn directly from the PP and any relevant EPs/Modules/Packages. Table 6 : Assumptions ID Assumption A.PHYSICAL_PROTECTION The Network Device is assumed to be physically protected in its operational environment and not subject to physical attacks that compromise the security or interfere with the device’s physical interconnections and correct operation. This protection is assumed to be sufficient to protect the device and the data it contains. As a result, the cPP does not include any requirements on physical tamper protection or other physical attack mitigations. The cPP does not expect the product to defend against physical access to the device that allows unauthorized entities to extract data, bypass other controls, or otherwise manipulate the device. For vNDs, this assumption applies to the physical platform on which the VM runs. A.LIMITED_FUNCTIONALITY The device is assumed to provide networking functionality as its core function and not provide functionality/services that could be deemed as general purpose computing. For example, the device should not provide a computing platform for general purpose applications (unrelated to networking functionality). 20 ID Assumption A.NO_THRU_TRAFFIC_PROTECTION A standard/generic Network Device does not provide any assurance regarding the protection of traffic that traverses it. The intent is for the Network Device to protect data that originates on or is destined to the device itself, to include administrative data and audit data. Traffic that is traversing the Network Device, destined for another network entity, is not covered by the ND cPP. It is assumed that this protection will be covered by cPPs and PP-Modules for particular types of Network Devices (e.g., firewall). A.TRUSTED_ADMINISTRATOR The Security Administrator(s) for the Network Device are assumed to be trusted and to act in the best interest of security for the organization. This includes appropriately trained, following policy, and adhering to guidance documentation. Administrators are trusted to ensure passwords/credentials have sufficient strength and entropy and to lack malicious intent when administering the device. The Network Device is not expected to be capable of defending against a malicious Administrator that actively works to bypass or compromise the security of the device. A.REGULAR_UPDATES The Network Device firmware and software is assumed to be updated by an Administrator on a regular basis in response to the release of product updates due to known vulnerabilities. A.ADMIN_CREDENTIALS_SECURE The Administrator’s credentials (private key) used to access the Network Device are protected by the platform on which they reside. A.COMPONENTS_RUNNING For distributed TOEs it is assumed that the availability of all TOE components is checked as appropriate to reduce the risk of an undetected attack on (or failure of) one or more TOE components. It is also assumed that in addition to the availability of all components it is also checked as appropriate that the audit functionality is running properly on all TOE components. 21 ID Assumption A.RESIDUAL_INFORMATION The Administrator must ensure that there is no unauthorized access possible for sensitive residual information (e.g. cryptographic keys, keying material, PINs, passwords etc.) on networking equipment when the equipment is discarded or removed from its operational environment. 5.2 Threats The following table lists the threats addressed by the TOE and the IT Environment. The assumed level of expertise of the attacker for all the threats identified below is Enhanced-Basic. The threats included in Table 7 are drawn directly from the PP and any EPs/Modules/Packages specified in Section Error! Reference source not found.. Table 7 :Threats ID Threat T.UNAUTHORIZED_ADMINISTRATOR_ ACCESS Threat agents may attempt to gain Administrator access to the Network Device by nefarious means such as masquerading as an Administrator to the device, masquerading as the device to an Administrator, replaying an administrative session (in its entirety, or selected portions), or performing man-in-the- middle attacks, which would provide access to the administrative session, or sessions between Network Devices. Successfully gaining Administrator access allows malicious actions that compromise the security functionality of the device and the network on which it resides. T.WEAK_CRYPTOGRAPHY Threat agents may exploit weak cryptographic algorithms or perform a cryptographic exhaust against the key space. Poorly chosen encryption algorithms, modes, and key sizes will allow attackers to compromise the algorithms, or brute force exhaust the key space and give them unauthorized access allowing them to read, manipulate and/or control the traffic with minimal effort. 22 ID Threat T.UNTRUSTED_COMMUNICATION_CH ANNELS Threat agents may attempt to target Network Devices that do not use standardized secure tunnelling protocols to protect the critical network traffic. Attackers may take advantage of poorly designed protocols or poor key management to successfully perform man-in- the-middle attacks, replay attacks, etc. Successful attacks will result in loss of confidentiality and integrity of the critical network traffic, and potentially could lead to a compromise of the Network Device itself. T.WEAK_AUTHENTICATION_ENDPOIN TS Threat agents may take advantage of secure protocols that use weak methods to authenticate the endpoints, e.g. a shared password that is guessable or transported as plaintext. The consequences are the same as a poorly designed protocol, the attacker could masquerade as the Administrator or another device, and the attacker could insert themselves into the network stream and perform a man-in-the-middle attack. The result is the critical network traffic is exposed and there could be a loss of confidentiality and integrity, and potentially the Network Device itself could be compromised. The use of appropriate secure protocols to provide authentication of endpoints (as in the SFRs addressing T.UNTRUSTED_COMMUNICATION_CHA NNELS) are ensured by the requirements in FTP_ITC.1 and FTP_TRP.1/Admin; for distributed TOEs the authentication requirements for endpoints in inter-component communications are addressed by the requirements in FPT_ITT.1. T.UPDATE_COMPROMISE Threat agents may attempt to provide a compromised update of the software or firmware which undermines the security functionality of the device. Non-validated updates or updates validated using non-secure or weak cryptography leave the update firmware vulnerable to surreptitious alteration. 23 ID Threat T.UNDETECTED_ACTIVITY Threat agents may attempt to access, change, and/or modify the security functionality of the Network Device without Administrator awareness. This could result in the attacker finding an avenue (e.g., misconfiguration, flaw in the product) to compromise the device and the Administrator would have no knowledge that the device has been compromised T.SECURITY_FUNCTIONALITY_COMPR OMISE Threat agents may compromise credentials and device data enabling continued access to the Network Device and its critical data. The compromise of credentials includes replacing existing credentials with an attacker’s credentials, modifying existing credentials, or obtaining the Administrator or device credentials for use by the attacker. T.PASSWORD_CRACKING Threat agents may be able to take advantage of weak administrative passwords to gain privileged access to the device. Having privileged access to the device provides the attacker unfettered access to the network traffic and may allow them to take advantage of any trust relationships with other Network Devices. T.SECURITY_FUNCTIONALITY_FAILUR E An external, unauthorized entity could make use of failed or compromised security functionality and might therefore subsequently use or abuse security functions without prior authentication to access, change or modify device data, critical network traffic or security functionality of the device. 5.3 Clarification of Scope All evaluations (and all products) have limitations, as well as potential misconceptions that need clarifying. This text covers some of the more important limitations and clarifications of this evaluation. Note that: • As with any evaluation, this evaluation only shows that the evaluated configuration meets the security claims made, with a certain level of assurance. The level of assurance for this 24 evaluation is defined within the collaborative Protection Profiles for Network Devices, Version 2.2e [NDcPP v2.2e]. • Consistent with the expectations of the PP, this evaluation did not specifically search for, nor seriously attempt to counter, vulnerabilities that were not “obvious†or vulnerabilities to objectives not claimed in the ST. The CEM defines an “obvious†vulnerability as one that is easily exploited with a minimum of understanding of the TOE, technical sophistication and resources. • The evaluation of security functionality of the product was limited to the functionality specified in the claimed PPs. Any additional security related functional capabilities included in the product were not covered by this evaluation. See section 7.2 of this report for additional information on product functionality that is not included in the scope of evaluation. 25 6 Documentation The following documents were provided by the vendor with the TOE for evaluation: • Trellix Security Enterprise Security Manager Common Criteria Configuration Guide version 0.8 [AGD] • Trellix Security Enterprise Security Manager v11.6.12 Security Target 2.0 • Trellix Enterprise Security Manager 11.6.x Installation Guide • Trellix Enterprise Security Manager 11.6.x Product Guide These are the only documents that should be trusted for the installation, administration, and use of the TOE in its evaluated configuration. 26 7 TOE Evaluated Configuration 7.1 Evaluated Configuration The minimum configuration required for a Trellix TOE deployment consists of at least one management component, one data component, and one auxiliary component when the components are configured in accordance with the documentation listed in Section 6 of this report. In addition to the minimum configuration, additional instances of the data components or auxiliary components can be added to expand upon the minimum configuration in order to address larger enterprise deployments. All six TOE components are part of the evaluation. However, a minimum configuration of the TOE that was tested is identified below. 4. Management Component: a. Enterprise Security Manager (ESM) 5. Data Components: a. Event Receiver (ERC) 6. Auxiliary Components: o Advanced Correlation Engine (ACE) 7.2 Excluded Functionality The TOE provides enterprise security and threat monitoring information to network administrators. All TOE features related to information monitoring, analytics, and threat evaluation are out of scope for this evaluation. 27 8 IT Product Testing This section describes the testing efforts of the developer and the evaluation team. It is derived from information contained in Evaluation Test Report for Trellix Security Enterprise Security Manager v1.8, which is not publicly available. The Assurance Activities Report provides an overview of testing and the prescribed assurance activities. 8.1 Developer Testing No evidence of developer testing is required in the Assurance Activities for this product. 8.2 Evaluation Team Independent Testing The evaluation team verified the product according to the vendor-provided guidance documentation and ran the tests specified in the collaborative Protection Profile for Network Devices, Version 2.2e [NDcPP v2.2e]. The Independent Testing activity is documented in the Assurance Activities Report, which is publicly available, and is not duplicated here. In particular, a description of the test configurations may be found is Section 4.1-4.2 of the AAR and a list of the test tools may be found in the table in section 4.2 of the AAR. 28 9 Results of the Evaluation The results of the assurance requirements are generally described in this section and are presented in detail in the proprietary documents: the Detailed Test Report (DTR) and the Evaluation Technical Report (ETR). The reader of this document can assume that activities and work units received a passing verdict. A verdict for an assurance component is determined by the resulting verdicts assigned to the corresponding evaluator action elements. The evaluation was conducted based upon CC version 3.1 rev 5 and CEM version 3.1 rev 5. The evaluation determined the Trellix Security Enterprise Security Manager v11.6.12 to be Part 2 extended and Part 3 conformant, and meets the SARs contained in the PP. Additionally the evaluator performed the Assurance Activities specified in the NDPP. 9.1 Evaluation of Security Target The evaluation team applied each ASE CEM work unit. The ST evaluation ensured the ST contains a description of the environment in terms of policies and assumptions, a statement of security requirements claimed to be met by the Trellix Security Enterprise Security Manager v11.6.12 that are consistent with the Common Criteria, and product security function descriptions that support the requirements. Additionally, the evaluator performed an assessment of the Assurance Activities specified in the collaborative Protection Profile for Network Devices, Version 2.2e [NDcPP v2.2e]. The validator reviewed the work of the evaluation team, and found that sufficient evidence and justification was provided by the evaluation team to confirm that the evaluation was conducted in accordance with the requirements of the CEM, and that the conclusion reached by the evaluation team was justified. 9.2 Evaluation of Development Documentation The evaluation team applied each EAL 1 ADV CEM work unit. The evaluation team assessed the design documentation and found it adequate to aid in understanding how the TSF provides the security functions. The design documentation consists of a functional specification contained in the Security Target's TOE Summary Specification. Additionally, the evaluator performed the Assurance Activities specified in the collaborative Protection Profile for Network Devices, Version 2.2e [NDcPP v2.2e] related to the examination of the information contained in the TOE Summary Specification. The validator reviewed the work of the evaluation team, and found that sufficient evidence and justification was provided by the evaluation team to confirm that the evaluation was conducted in accordance with the Assurance Activities, and that the conclusion reached by the evaluation team was justified. 9.3 Evaluation of Guidance Documents The evaluation team applied each EAL 1 AGD CEM work unit. The evaluation team ensured the 29 adequacy of the user guidance in describing how to use the operational TOE. Additionally, the evaluation team ensured the adequacy of the administrator's guidance in describing how to securely administer the TOE. The guides were assessed during the design and testing phases of the evaluation to ensure they were complete. Additionally, the evaluator performed the Assurance Activities specified in the collaborative Protection Profile for Network Devices, Version 2.2e [NDcPP v2.2e] related to the examination of the information contained in the operational guidance documents. The validator reviewed the work of the evaluation team and found that sufficient evidence and justification were provided by the evaluation team to confirm that the evaluation was conducted in accordance with the Assurance Activities, and that the conclusion reached by the evaluation team was justified. 9.4 Evaluation of Life Cycle Support Activities The evaluation team applied each EAL 1 ALC CEM work unit. The evaluation team found that the TOE was identified. The validator reviewed the work of the evaluation team, and found that sufficient evidence and justification was provided by the evaluation team to confirm that the evaluation was conducted in accordance with the requirements of the CEM, and that the conclusion reached by the evaluation team was justified. 9.5 Evaluation of Test Documentation and the Test Activity The evaluation team applied each EAL 1 ATE CEM work unit. The evaluation team ran the set of tests specified by the Assurance Activities in the collaborative Protection Profile for Network Devices, Version 2.2e [NDcPP v2.2e] and recorded the results in a Test Report, summarized in the Evaluation Technical Report and Assurance Activities Report. The validator reviewed the work of the evaluation team and found that sufficient evidence was provided by the evaluation team to show that the evaluation activities addressed the test activities in the collaborative Protection Profile for Network Devices, Version 2.2e [NDcPP v2.2e] and that the conclusion reached by the evaluation team was justified. 9.6 Vulnerability Assessment Activity The evaluation team applied each EAL 1 AVA CEM work unit. The evaluation team performed a public search for vulnerabilities, performed vulnerability testing, and did not discover any issues with the TOE. The most recent vulnerability search was conducted on March 4, 2025. A list of search terms, databases searched, and evaluation findings may be found in section 6.3 of the AAR. The validator reviewed the work of the evaluation team and found that sufficient evidence and justification were provided by the evaluation team to confirm that the evaluation addressed the vulnerability analysis Assurance Activities in the collaborative Protection Profile for Network 30 Devices, Version 2.2e [NDcPP v2.2e] and that the conclusion reached by the evaluation team was justified. 9.7 Summary of Evaluation Results The evaluation team's assessment of the evaluation evidence demonstrates that the claims in the ST are met. Additionally, the evaluation team's test activities also demonstrated the accuracy of the claims in the ST. The validation team's assessment of the evidence provided by the evaluation team is that it demonstrates that the evaluation team performed the Assurance Activities in the collaborative Protection Profile for Network Devices, Version 2.2e [NDcPP v2.2e] and correctly verified that the product meets the claims in the ST. 31 10 Validator Comments & Recommendations The validation team notes that the evaluated configuration is dependent upon the TOE being configured per the configuration guide document listed in Section 6. No other versions of the TOE, either earlier or later, were evaluated. The functionality evaluated is scoped exclusively to the security functional requirements specified in the Security Target. Other functionality included in the product was not assessed as part of this evaluation. See Section 7.2 of this report for product functionality that is not included in the scope of evaluation. Additional functionality provided by devices in the operational environment needs to be assessed separately and no further conclusions can be drawn about their effectiveness. All other items and scope issues have been sufficiently addressed elsewhere in this document. 32 11 Annexes Not applicable. 33 12 Security Target Trellix Security Enterprise Security Manager Security Target version 2.0 34 13 Glossary The following definitions are used throughout this document: • Common Criteria Testing Laboratory (CCTL). An IT security evaluation facility accredited by the National Voluntary Laboratory Accreditation Program (NVLAP) and approved by the CCEVS Validation Body to conduct Common Criteria-based evaluations. • Conformance. The ability to demonstrate in an unambiguous way that a given implementation is correct with respect to the formal model. • Evaluation. The assessment of an IT product against the Common Criteria using the Common Criteria Evaluation Methodology to determine whether or not the claims made are justified; or the assessment of a protection profile against the Common Criteria using the Common Evaluation Methodology to determine if the Profile is complete, consistent, technically sound and hence suitable for use as a statement of requirements for one or more TOEs that may be evaluated. • Evaluation Evidence. Any tangible resource (information) required from the sponsor or developer by the evaluator to perform one or more evaluation activities. • Feature. Part of a product that is either included with the product or can be ordered separately. • Target of Evaluation (TOE). A group of IT products configured as an IT system, or an IT product, and associated documentation that is the subject of a security evaluation under the CC. • Validation. The process carried out by the CCEVS Validation Body leading to the issue of a Common Criteria certificate. • Validation Body. A governmental organization responsible for carrying out validation and for overseeing the day-to-day operation of the NIAP Common Criteria Evaluation and Validation Scheme. 35 14 Bibliography The Validation Team used the following documents to produce this Validation Report: 1. Common Criteria for Information Technology Security Evaluation - Part 1: Introduction and general model, Version 3.1 Revision 5 2. Common Criteria for Information Technology Security Evaluation - Part 2: Security functional requirements, Version 3.1 Revision 5. 3. Common Criteria for Information Technology Security Evaluation - Part 3: Security assurance requirements, Version 3.1 Revision 5. 4. Common Evaluation Methodology for Information Technology Security Evaluation, Version 3.1 Revision 5. 5. Collaborative Protection Profile for Network Devices, Version 2.2e, 27 March 2020 [NDcPP v2.2e] 6. Assurance Activity Report for Trellix Security Enterprise Security Manager version 1.6 [AAR] 7. Evaluation Technical Report for Trellix Security Enterprise Security Manager version 1.8 [ETR] 8. Trellix Security Enterprise Security Manager v11.6.12 Security Target version 2.0 [ST] 9. Trellix Security Enterprise Security Manager v11.6.12 Common Criteria Configuration Guide version 0.8 [AGD]