National Information Assurance Partnership Common Criteria Evaluation and Validation Scheme Validation Report for Imperva SecureSphere v11.5 Report Number: CCEVS-VR-VID10653-2015 Dated: December 23, 2015 Version: 1.0 National Institute of Standards and Technology National Security Agency Information Technology Laboratory Information Assurance Directorate 100 Bureau Drive 9800 Savage Road STE 6940 Gaithersburg, MD 20899 Fort George G. Meade, MD 20755-6940 ® TM VALIDATION REPORT Imperva SecureSphere v11.5 ii Table of Contents 1 Executive Summary.............................................................................................................2 2 Identification........................................................................................................................5 2.1 Threats.........................................................................................................................5 2.2 Organizational Security Policies.................................................................................6 3 Architectural Information ....................................................................................................7 4 Assumptions.........................................................................................................................2 4.1 Clarification of Scope .................................................................................................2 5 Security Policy.....................................................................................................................3 5.1 Security Audit.............................................................................................................3 5.2 Cryptographic Support................................................................................................3 5.3 User Data Protection...................................................................................................3 5.4 Identification and Authentication ...............................................................................3 5.5 Security Management .................................................................................................3 5.6 Protection of the TSF..................................................................................................3 5.7 TOE Access ................................................................................................................4 5.8 Trusted Path/Channels ................................................................................................4 6 Documentation.....................................................................................................................5 7 Independent Testing.............................................................................................................6 8 Tested Configuration ...........................................................................................................7 9 Results of the Evaluation .....................................................................................................9 10 Validator Comments/Recommendations ...........................................................................10 11 Annexes 11 12 Security Target...................................................................................................................12 13 Abbreviations and Acronyms ............................................................................................13 14 Bibliography ......................................................................................................................15 VALIDATION REPORT Imperva SecureSphere v11.5 1 List of Tables Table 1: Evaluation Details............................................................................................................. 3 Table 2: ST and TOE Identification................................................................................................ 5 Table 3 TOE Security Assurance Requirements ............................................................................ 9 List of Tables Figure 1 Evaluation Team Evaluated Test Configuration (Hardware)........................................... 7 Figure 2 Evaluation Team Evaluated Test Configuration (Virtual Machine) ................................ 8 VALIDATION REPORT Imperva SecureSphere v11.5 2 1 Executive Summary This report is intended to assist the end-user of this product and any security certification agent for that end-user in determining the suitability of this Information Technology (IT) product in their environment. End-users should review the Security Target (ST), which is where specific security claims are made, in conjunction with this Validation Report (VR), which describes how those security claims were evaluated and tested and any restrictions on the evaluated configuration. Prospective users should read carefully the Assumptions and Clarification of Scope in Section 4 and the Validator Comments in Section 10, where any restrictions on the evaluated configuration are highlighted. This report documents the National Information Assurance Partnership (NIAP) assessment of the evaluation Imperva SecureSphere v11.5 Patch 5 Gateway Appliances: X1010, X10K, X2010, X2510, X4510, X6510, X8510 and MX Management Server Appliances: M110, M160, and Virtual Machine Appliances: V1000, V2500, V4500 (for Gateway), VM150 (for MX) and optionally a SecureSphere Operations Manager (SOM) Management Server appliance or Virtual Machine Appliance: Appliances: M160, and Virtual Machine Appliance: VM150 comprising a common software code base. It presents the evaluation results, their justifications, and the conformance results. This VR is not an endorsement of the Target of Evaluation (TOE) by any agency of the U.S. Government and no warranty of the TOE is either expressed or implied. This VR applies only to the specific version and configuration of the product as evaluated and as documented in the ST. The evaluation of Imperva SecureSphere v11.5 Patch 5 was performed by Leidos (formerly Science Applications International Corporation (SAIC)) Common Criteria Testing Laboratory (CCTL) in Columbia, Maryland, in the United States and was completed in December 2015. The evaluation was conducted in accordance with the requirements of the Common Criteria and Common Methodology for IT Security Evaluation (CEM), version 3.1, revision 4 and assurance activities specified in Protection Profile for Network Devices, Version 1.1, 8 June 2012 and Security Requirements as amended by Errata #3 dated 3 November 2014, and includes the additional optional SFRs: FCS_HTTPS_EXT.1, FCS_SSH_EXT.1, FCS_TLS_EXT.1, and FPT_ITT.1. The evaluation was consistent with NIAP Common Criteria Evaluation and Validation Scheme (CCEVS) policies and practices as described on their web site (www.niap-ccevs.org). The Leidos evaluation team determined that Imperva SecureSphere v11.5 Patch 5 Gateway Appliances: X1010, X10K, X2010, X2510, X4510, X6510, X8510 and MX Management Server Appliances: M110, M160, and Virtual Machine Appliances: V1000, V2500, V4500 (for Gateway), VM150 (for MX) and optionally a SecureSphere Operations Manager (SOM) Management Server appliance or Virtual Machine Appliance: Appliances: M160 and Virtual Machine Appliance: VM150 comprising a common software code base is conformant to the claimed Protection Profile (PP) and, when installed, configured and operated as specified in the evaluated guidance documentation, satisfies all of the security functional requirements stated in the ST. The information in this VR is largely derived from the Assurance Activities Report (AAR) and associated test report produced by the Leidos evaluation team. The TOE is a hardware and software solution that consists of the Imperva SecureSphere v11.5 Patch 5 software running on two or more of the Imperva appliances listed below, including one or more Management Servers and one or more Gateways: Hardware appliance:  Gateway Appliances: X1010, X10K, X2010, X2510, X4510, X6510, X8510  MX Management Server Appliances: M110, M160 Virtual Machine Appliances:  V1000, V2500, V4500 (for Gateway)  VM150 (for MX) VALIDATION REPORT Imperva SecureSphere v11.5 3 And optionally a SecureSphere Operations Manager (SOM) Management Server appliance or Virtual Machine Appliance:  Appliances: M160 Virtual Machine Appliance: VM150 The network on which it resides is considered part of the operational environment. The validation team monitored the activities of the evaluation team, examined evaluation evidence, provided guidance on technical issues and evaluation processes, and reviewed the evaluation results produced by the evaluation team. The validation team found that the evaluation results showed that all assurance activities specified in the claimed PPs had been completed successfully and that the product satisfies all of the security functional and assurance requirements stated in the ST. Therefore the validation team concludes that the testing laboratory’s findings are accurate, the conclusions justified, and the conformance results are correct. The conclusions of the testing laboratory in the evaluation technical report are consistent with the evidence produced. Table 1: Evaluation Details Item Identifier Evaluated Product Imperva SecureSphere v11.5 Patch 5 Gateway Appliances: X1010, X10K, X2010, X2510, X4510, X6510, X8510 and MX Management Server Appliances: M110, M160, and Virtual Machine Appliances: V1000, V2500, V4500 (for Gateway), VM150 (for MX) and optionally a SecureSphere Operations Manager (SOM) Management Server appliance or Virtual Machine Appliance: Appliances: M160 and Virtual Machine Appliance: VM150. Note: MX and SOM are two management applications using the same code base. MX, Gateway and SOM are all installed using the same image, during installation user choses the application to install. Sponsor & Developer Imperva Inc. 3400 Bridge Parkway, Suite 200 Redwood Shores, CA 94065 United States CCTL Leidos (formerly SAIC) Common Criteria Testing Laboratory 6841 Benjamin Franklin Drive Columbia, MD 21046 Completion Date December 2015 CC Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 4, September 2012 Interpretations There were no applicable interpretations used for this evaluation. CEM Common Methodology for Information Technology Security Evaluation: Version 3.1, Revision 4, September 2012 VALIDATION REPORT Imperva SecureSphere v11.5 4 Item Identifier PP Protection Profile for Network Devices, Version 1.1, 8 June 2012 and Security Requirements as amended by Errata #3 dated 3 November 2014, and includes the additional optional SFRs: FCS_HTTPS_EXT.1, FCS_SSH_EXT.1, FCS_TLS_EXT.1, and FPT_ITT.1. Evaluation Class None Disclaimer The information contained in this Validation Report is not an endorsement of the Imperva SecureSphere v11.5 Patch 5 Gateway Appliances: X1010, X10K, X2010, X2510, X4510, X6510, X8510 and MX Management Server Appliances: M110, M160, and Virtual Machine Appliances: V1000, V2500, V4500 (for Gateway), VM150 (for MX) and optionally a SecureSphere Operations Manager (SOM) Management Server appliance or Virtual Machine Appliance: Appliances: M160 and Virtual Machine Appliance: VM150 by any agency of the U.S. Government and no warranty of Imperva SecureSphere v11.5 Patch 5 Gateway Appliances: X1010, X10K, X2010, X2510, X4510, X6510, X8510 and MX Management Server Appliances: M110, M160 and Virtual Machine Appliances: V1000, V2500, V4500 (for Gateway), VM150 (for MX) and optionally a SecureSphere Operations Manager (SOM) Management Server appliance or Virtual Machine Appliance: Appliances: M160 and Virtual Machine Appliance: VM150 is either expressed or implied. Evaluation Personnel Greg Beaver Cody Cummins Tony Apted Validation Personnel Paul Bicknell Jay Vora VALIDATION REPORT Imperva SecureSphere v11.5 5 2 Identification The CCEVS is a joint National Security Agency (NSA) and National Institute of Standards and Technology (NIST) effort to establish commercial facilities to perform trusted product evaluations. Under this program, security evaluations are conducted by commercial testing laboratories called Common Criteria Testing Laboratories (CCTLs) in accordance with National Voluntary Laboratory Assessment Program (NVLAP) accreditation. The NIAP Validation Body assigns Validators to monitor the CCTLs to ensure quality and consistency across evaluations. Developers of information technology products desiring a security evaluation contract with a CCTL and pay a fee for their product’s evaluation. Upon successful completion of the evaluation, the product is added to NIAP’s Product Compliant List (PCL). The following table identifies the evaluated Security Target and TOE. Table 2: ST and TOE Identification Name Description ST Title Imperva SecureSphere Security Target ST Version 0.4 Publication Date 12 November 2015 Vendor Imperva Inc. ST Author Leidos (formerly SAIC) TOE Reference Imperva SecureSphere v11.5 Patch 5 Gateway Appliances: X1010, X10K, X2010, X2510, X4510, X6510, X8510 and MX Management Server Appliances: M110, M160, and Virtual Machine Appliances: V1000, V2500, V4500 (for Gateway), VM150 (for MX) and optionally a SecureSphere Operations Manager (SOM) Management Server appliance or Virtual Machine Appliance: Appliances: M160 and Virtual Machine Appliance: VM150 TOE Hardware Models Gateway Appliances: X1010, X10K, X2010, X2510, X4510, X6510, X8510 MX Management Server Appliances: M110, M160 SecureSphere Operations Manager (SOM) Management Appliance: M160 TOE Virtual Machine Models V1000, V2500, V4500 (for Gateway) VM150 (for MX or SOM) TOE Software Version Imperva SecureSphere v11.5 Patch 5 Keywords Intrusion Detection System, Intrusion Prevention System 2.1 Threats The ST references the Protection Profile for Network Devices to identify the following threats that the TOE and its operational environment are intended to counter:  An administrator may unintentionally install or configure the TOE incorrectly, resulting in ineffective security mechanisms.  Security mechanisms of the TOE may fail, leading to a compromise of the TSF.  A user may gain unauthorized access to the TOE data and TOE executable code. A malicious user, process, or external IT entity may masquerade as an authorized entity in order to gain VALIDATION REPORT Imperva SecureSphere v11.5 6 unauthorized access to data or TOE resources. A malicious user, process, or external IT entity may misrepresent itself as the TOE to obtain identification and authentication data.  A malicious party attempts to supply the end user with an update to the product that may compromise the security features of the TOE.  Malicious remote users or external IT entities may take actions that adversely affect the security of the TOE. These actions may remain undetected and thus their effects cannot be effectively mitigated.  User data may be inadvertently sent to a destination not intended by the original sender. 2.2 Organizational Security Policies The ST references the Protection Profile for Network Devices to identify following organizational security policy that the TOE and its operational environment are intended to fulfill:  The TOE shall display an initial banner describing restrictions of use, legal agreements, or any other appropriate information to which users consent by accessing the TOE. VALIDATION REPORT Imperva SecureSphere v11.5 7 3 Architectural Information The Target of Evaluation (TOE) is a combination of Imperva SecureSphere v11.5 Patch 5 appliances. More specifically, the TOE consists of  One1 MX Management Server appliance; and  One or more Gateway appliances; and optionally:  One SecureSphere Operations Manager (SOM) Management Server appliance. SecureSphere v11.5 Patch 5 provides protection from attacks against database, file, Web, and Web Services assets, both within the organization (insider attacks) and from without. Installed on the network as a reverse Hypertext Transfer Protocol (HTTP) proxy, a transparent inline bridge or as an offline network monitor (sniffer), a SecureSphere v11.5 Patch 5 Gateway monitors application-level protocols for attacks, and reacts by blocking the attacks and/or reporting them to a centralized management server. The TOE is deployed as one Gateway appliance controlled by a MX appliance that in turn is managed by a SecureSphere Operations Manager (SOM) Management Server. The Management Server (MX) and SOM are two different management applications using the same code base, SOM is a manager of MXs. Both MX and SOM are running over M-Appliances (M160), except for M110 which is an MX only appliance. Administrators connect to the Management/SOM Servers using a standard Web browser (outside of the Target of Evaluation). The TOE authenticates Administrators using a local password based mechanism. Additionally, the TOE can be configured to use the services of a trusted LDAP server in the operational environment. As noted above, all TOE appliance models run the same software and provide all claimed security functionality. The TOE generates logs for security relevant events including the events specified in NDPP. The TOE can be configured to store the logs locally so they can be accessed by an administrator and can also be configured to send the logs to a designated external log server. The communication channel with the external syslog server is protected using TLS. The TOE is operated in FIPS mode and includes cryptographic modules from both RSA BSAFE Crypto-J 6.1.3 FIPS 140-2 validated cryptographic module and OpenSSL 2.0.1 FIPS-certified with certificate number 1747. SecureSphere Deployment Scenarios include both non-inline (sniffing) and inline gateways. An inline gateway is more invasive but provides better blocking capabilities. A sniffing gateway is totally noninvasive but provides less effective blocking capabilities. A sniffing gateway is a passive sniffing device. It connects to corporate hubs and switches and taps the traffic sent to and from protected servers, using a SPAN (Switch Port Analyzer) mirror port on the switch, or a dedicated TAP device. Traffic is copied to it instead of passing directly through it. Transmission Control Protocol (TCP) resets are transmitted over a “blocking†Network Interface Card (NIC). For an example of this type of deployment, see the TOE guidance documentation. In the inline scenario, the gateway acts as a bridging device between the external network and the protected network segment. The gateway will block malicious traffic inline (i.e. drop packets). A single inline gateway protects one to four network segments. For examples of deployment types, see the TOE guidance documentation. 1 Onebox mode (where both the SecureSphere management server and SecureSphere gateway are integrated in a single machine) is not included in the evaluated configuration VALIDATION REPORT Imperva SecureSphere v11.5 8 X1010 and X2010 appliance models have six network interface ports. Two of the ports are used for management: one to connect to the management server and the other is optional. The other four ports are part of two bridges that are used for inline inspection of up to two different protected network segments. X2510, X4510, X6510, X8510 and X10K appliance models have 2 fixed network interface ports and 2 optional network cards, each card contains two to four network ports. The two fixed ports are used for management: one to connect to the management server and the other is optional. The other optional two cards (each with two to four ports) are part of one to four bridges that are used for inline inspection of up to four different protected network segments. The MX Management Server Appliances: M110 and M160 each have an RJ45 Connector Serial Port, two USB ports, and two management ports. The appliance models differ only in size of memory and hard drive. While the physical form factor of each appliance differs, the underlying hardware shares a similar architecture. A given Imperva configuration includes one or more Gateway appliances controlled by a MX (Management Server) appliance. In multi-tier management configurations, one or more MX Management Servers may in turn be managed by a SecureSphere Operations Manager (SOM) Management Server. Each Imperva appliance is a self-contained hardware appliance or VM designed to interact with its environment via network connections. Figure 1 below depicts the TOE in its operational environment. SecureSphere v11.5 Patch 5 gateways are installed in front of the protected resources. They are connected to the Management Server using dedicated out of band (OOB) management network interfaces, and the communication between the gateways and the Management Server is protected using HTTPS. SOM Management Servers (not shown) are in the TOE and would be connected to the Management Server and communications protected using HTTPS. The operational environment also requires LDAP, TOE Update, syslog, and NTP servers. Descriptions of the interconnecting lines in the figure are as follows:  The Blue Line to the monitor represents the TLS protected communications between the administrator workstation and the MX Management Server.  The Red Lines represent the TLS protected communications between the TOE components and between instances of a TOE.  The Orange Lines represent the Internet data filtered and processed by the TOE. VALIDATION REPORT Imperva SecureSphere v11.5 9 Figure 1 Physical Scope and Boundaries of the TOE VALIDATION REPORT Imperva SecureSphere v11.5 1 The virtual (VM) appliances are delivered as an installation disk (or ISO image). They require that the minimum following hardware and software be installed on the host system:  VMware ESXi 5.x with virtual hardware version 9.0 and newer  Dual core or higher number of cores, Intel based server  IvyBridge supported Microprocessor (http://en.wikipedia.org/wiki/List_of_Intel_Xeon_microprocessors#Ivy_Bridge-based_Xeons) or newer generation of Intel based CPUs: 3rd Generation Intel Core processors, Intel Xeon processor E3-1200 v2 product family, Next Generation Intel Xeon processors, Intel Xeon processor E5 v2 and E7 v2 families or newer Intel Xeon processors.  250 GB Hard Drive  Hypervisor-supported network interface card  If ESXi is in cluster, the EVC level must be set to L5 (IvyBridge) or higher  The main reason for using IvyBridge CPUs for Common Criteria is because of the need to use RDRAND command, any IvyBridge CPU is compatible with this requirement and therefore all IvyBridge CPUs can be used as ESX servers. The VM appliances also require the following minimums: VM150 V1000 V2500 V4500 CPU 2 2 2 4 Memory 4GB 4 GB 4 GB 8 GB Disk Space 160GB 160 GB 160 GB 160 GB All of the VM Machines in the CCTL test configuration were tested on an Ivy Bridge supported Intel Core i5-3350P processor @ 3.10 GHz with VMware ESXi v5.1.0 with virtual hardware version All appliance hardware and software is included in the TOE, with the following exceptions.  Hardware Security Module (HSM) and SSL Accelerator Cards: SecureSphere v11.5 Patch 5 Gateway appliances may be purchased with an internal HSM or SSL accelerator PCI card that offloads key storage and cryptographic operations used for network traffic deciphering from the appliance CPU. The cards are not included in the evaluated configuration.  The TOE monitors network traffic between clients and servers in real-time, provides analyses of that traffic for suspected intrusions, and provides a reaction capability. Database auditing allows you to record selected user database queries for audit purposes. Web and file server queries and responses can also be selectively recorded. In addition, monitored databases can be actively scanned to identify potential vulnerabilities. The Imperva Agent software is installed on the client machines to support these features and may be used in the evaluated configuration but the agents are considered to be outside the scope of the TOE and the functionality was not evaluated or tested.  The VMware ESXi Hypervisor virtualization software and the hardware it is installed on. VALIDATION REPORT Imperva SecureSphere v11.5 2 4 Assumptions The ST references the Protection Profile for Network Devices to identify following assumptions about the use of the product:  It is assumed that there are no general-purpose computing capabilities (e.g., compilers or user applications) available on the TOE, other than those services necessary for the operation, administration and support of the TOE.  Physical security, commensurate with the value of the TOE and the data it contains, is assumed to be provided by the environment.  TOE Administrators are trusted to follow and apply all administrator guidance in a trusted manner. 4.1 Clarification of Scope All evaluations (and all products) have limitations, as well as potential misconceptions that need clarifying. This text covers some of the more important limitations and clarifications of this evaluation. Note that: 1. As with any evaluation, this evaluation only shows that the evaluated configuration meets the security claims made, with a certain level of assurance (the assurance activities specified in the claimed PPs and performed by the evaluation team). 2. This evaluation covers only the specific device models and software version identified in this document, and not any earlier or later versions released or in process. 3. The evaluation of security functionality of the product was limited to the functionality specified in the claimed PPs. Any additional security related functional capabilities of the product were not covered by this evaluation. 4. This evaluation did not specifically search for, nor attempt to exploit, vulnerabilities that were not “obvious†or vulnerabilities to objectives not claimed in the ST. The CEM defines an “obvious†vulnerability as one that is easily exploited with a minimum of understanding of the TOE, technical sophistication and resources. 5. The following specific product capabilities are excluded from use in the evaluated configuration: a. Non-FIPS 140-2 mode of operation—this mode of operation allows cryptographic operations that are not FIPS-approved 6. The TOE requires the following components in its operational environment: a. Browser: Microsoft Internet Explorer; Chrome, Firefox; or Apple Safari utilizing Adobe Flash in order for an MX Management Client to connect via web-based. b. NTP Server - to synchronize its clock with that of the external time server. c. Syslog server - to receive audit records when the TOE is configured to deliver them to an external log server. d. LDAP servers - the TOE can be configured to use external authentication servers. e. Management Workstation - the TOE supports remote access to the CLI over SSHv2. As such, an administrator requires an SSHv2 client to access the CLI remotely. VALIDATION REPORT Imperva SecureSphere v11.5 3 5 Security Policy The TOE enforces the following security policies as described in the ST. Note: Much of the description of the security policy has been derived from the ST and the Final ETR. 5.1 Security Audit The TOE is designed to be able to generate logs for security relevant events including the events specified in NDPP. The TOE can be configured to store the logs locally so they can be accessed by an administrator and can also be configured to send the logs to a designated external log server. 5.2 Cryptographic Support The TOE is operated in FIPS mode and includes both NIST-validated RSA B-Safe and NIST-validated OpenSSL cryptographic modules. The modules provide key management, random bit generation, encryption/decryption, digital signature and cryptographic hashing and keyed-hash message authentication features in support of higher level cryptographic protocols, including SSH, TLS and HTTP over TLS. 5.3 User Data Protection The TOE is designed to ensure that it does not inadvertently reuse data found in network traffic. 5.4 Identification and Authentication The TOE requires users (i.e., administrators) to be successfully identified and authenticated before they can access any security management functions available in the TOE. The TOE offers a network accessible GUI ( HTTP over TLS) and console available locally and remotely via SSH for interactive administrator sessions. The TOE supports the local (i.e., on device) definition of administrators with usernames and passwords. Additionally, the TOE can be configured to use the services of a trusted LDAP server in the operational environment. 5.5 Security Management The TOE provides remote access to a CLI using SSHv2 and a GUI to access the wide range of security management functions. Security management commands are limited to administrators and are available only after they have provided acceptable user identification and authentication data to the TOE. The TOE also provides the ability to manage the TOE locally via direct serial console connection. The direct serial console is used mainly for initial configuration and then the TOE is designed to be managed and monitored using the Web GUI from a remote HTTPS/TLS client; or using the CLI from an SSHv2 client. The TOE provides the Administrator role which corresponds to the NDPP Security Administrator. 5.6 Protection of the TSF The TOE implements a number of features designed to protect itself to ensure the reliability and integrity of its security features. It protects particularly sensitive data such as stored passwords and cryptographic keys so that they are not accessible even by an administrator. The TOE includes its own time clock to ensure that reliable time information is available (e.g., for log accountability) but requires an NTP Server in the operational environment in order to synchronizes its clock with that of the external time server. VALIDATION REPORT Imperva SecureSphere v11.5 4 The TOE uses HTTPS to protect communications between distributed TOE components (FPT_ITT.1). The TOE includes functions to perform self-tests so that it might detect when it is failing. It also includes mechanisms so that the TOE itself can be updated while ensuring that the updates will not introduce malicious or other unexpected changes in the TOE. 5.7 TOE Access The TOE can be configured to display an informative banner that will appear prior to an administrator being permitted to establish an interactive session. The TOE subsequently will enforce an administrator- defined inactivity timeout value after which the inactive session will be terminated. Administrators can also terminate their own sessions by logging out. 5.8 Trusted Path/Channels The TOE protects interactive communication with remote administrators using SSH or HTTP over TLS. TLS ensures both integrity and disclosure protection. The TOE uses TLS to ensure that any authentication operations, and exported audit records, are sent only to the configured Syslog or authentication servers so they are not subject to inappropriate disclosure or modification. TLS is also used to ensure TOE updates are transmitted securely. VALIDATION REPORT Imperva SecureSphere v11.5 5 6 Documentation There are numerous documents that provide information and guidance for the deployment of the TOE. In particular, the following Common Criteria specific guides reference the security-related guidance material for all devices in the evaluated configuration:  Imperva SecureSphere v11.5 Admin Guide, Version 11.5, August 2015  Imperva SecureSphere Operations Manager (SOM) User Guide, Version 11.5, August 2015  Imperva SecureSphere Configuring Common Criteria Compliance User Guide, Version 11.5, December 2015  Imperva SecureSphere Upgrade Guide, Version 11.5, August 2015 Supporting TOE Guidance Documentation  Imperva SecureSphere Security Target, Version 0.4, 12 November, 2015 VALIDATION REPORT Imperva SecureSphere v11.5 6 7 Independent Testing This section describes the testing efforts of the evaluation team. It is derived from information contained in the following:  Evaluation Team Test Report Imperva SecureSphere Common Criteria Test Report and Procedures, Version 0.5, December 11, 2015 The purpose of this activity was to confirm the TOE behaves in accordance with the TOE security functional requirements as specified in the ST for a product claiming conformance to the Protection Profile for Network Devices, Version 1.1, 8 June 2012 and Security Requirements as amended by Errata #3 dated 3 November 2014, and includes the additional optional SFRs: FCS_HTTPS_EXT.1, FCS_SSH_EXT.1, FCS_TLS_EXT.1, and FPT_ITT.1. The evaluation team devised a Test Plan based on the Testing Assurance Activities specified in the Protection Profile for Network Devices, Version 1.1, 8 June 2012 and Security Requirements as amended by Errata #3 dated 3 November 2014, and includes the additional optional SFRs: FCS_HTTPS_EXT.1, FCS_SSH_EXT.1, FCS_TLS_EXT.1, and FPT_ITT.1. The Test Plan described how each test activity was to be instantiated within the TOE test environment. The evaluation team executed the tests specified in the Test Plan and documented the results in the team test report listed above. Independent testing took place at the Leidos facility in Columbia, Maryland from August 26 – September 4, 2015. The evaluators received the TOE in the form that normal customers would receive it, installed and configured the TOE in accordance with the provided guidance, and exercised the Team Test Plan on equipment configured in the testing laboratory. Given the complete set of test results from the test procedures exercised by the evaluators, the testing requirements for the Protection Profile for Network Devices, Version 1.1, 8 June 2012 and Security Requirements as amended by Errata #3 dated 3 November 2014, and includes the additional optional SFRs: FCS_HTTPS_EXT.1, FCS_SSH_EXT.1, FCS_TLS_EXT.1, and FPT_ITT.1 are fulfilled. VALIDATION REPORT Imperva SecureSphere v11.5 7 8 Tested Configuration Figure 1 Evaluation Team Evaluated Test Configuration (Hardware) As documented in the diagram above, the following hardware and software components were included in the evaluated configuration during testing:  Hardware/Software o One management Server Appliance: M160 o Three Gateway Appliances: x2010, x4510, x6510 Note: All three Gateway Appliances were tested and part of the evaluated test configuration. Figure 1 only identifies a single gateway appliance to simply the drawing. VALIDATION REPORT Imperva SecureSphere v11.5 8 Figure 2 Evaluation Team Evaluated Test Configuration (Virtual Machine) As documented in the diagram above, the following virtual machine components were included in the evaluated configuration during testing:  Virtual Machine o One SecureSphere Operations Manager (SOM): VM150 o One management virtual machine: VM150 o One gateway virtual machine: VM2500 All of the VM Machines in the CCTL test configuration were installed on an Ivy Bridge supported Intel Core i5-3350P processor @ 3.10 GHz VMware ESXi v5.1.0 w/ hardware v9 platform. The evaluated version of the TOE was installed and configured according to the Imperva SecureSphere Configuring Common Criteria Compliance User Guide, Version 11.5, November 2015 as well as the supporting guidance documentation identified in Section 6. VALIDATION REPORT Imperva SecureSphere v11.5 9 9 Results of the Evaluation The evaluation was conducted based upon the assurance activities specified in Protection Profile for Network Devices, Version 1.1, 8 June 2012 and Security Requirements as amended by Errata #3 dated 3 November 2014, and includes the additional optional SFRs: FCS_HTTPS_EXT.1, FCS_SSH_EXT.1, FCS_TLS_EXT.1, and FPT_ITT.1, in conjunction with version 3.1, revision 4 of the CC and the CEM. A verdict for an assurance component is determined by the resulting verdicts assigned to the corresponding evaluator action elements. The validation team’s assessment of the evidence provided by the evaluation team is that it demonstrates that the evaluation team performed the assurance activities in the claimed PPs, and correctly verified that the product meets the claims in the ST. The details of the evaluation are recorded in the Evaluation Technical Report (ETR), which is controlled by the Leidos CCTL. The security assurance requirements are listed in the following table. Table 3 TOE Security Assurance Requirements Assurance Component ID Assurance Component Name ADV_FSP.1 Basic functional specification AGD_OPE.1 Operational user guidance AGD_PRE.1 Preparative procedures ALC_CMC.1 Labeling of the TOE ALC_CMS.1 TOE CM coverage ATE_IND.1 Independent testing - conformance AVA_VAN.1 Vulnerability survey VALIDATION REPORT Imperva SecureSphere v11.5 10 10 Validator Comments/Recommendations The validators have no further comments about the evaluation results. VALIDATION REPORT Imperva SecureSphere v11.5 11 11 Annexes Not applicable. VALIDATION REPORT Imperva SecureSphere v11.5 12 12 Security Target Imperva SecureSphere Security Target, Version 0.4, 12 November 2015 VALIDATION REPORT Imperva SecureSphere v11.5 13 13 Abbreviations and Acronyms Abbreviation Description ADC Application Defense Center AES Advanced Encryption Standard AWS Amazon Web Services CAV Correlated Attack Validation CC Common Criteria CLI Command Line Interface GUI Graphical User Interface HSM Hardware Security Module HTTP Hypertext Transfer Protocol ID Intrusion Detection IDS Intrusion Detection System IP Internet Protocol IPS Intrusion Prevention System MX Management Server NIC Network Interface Card NTP Network Time Protocol OOB Out Of Band PP Protection Profile RFC Request for Comment SFR Security Functional Requirement SFP Security Function Policy SIEM Security Information and Event Management SOM SecureSphere Operations Manager SPAN Switch Port Analyzer SSH Secure Shell SSL Secure Sockets Layer ST Security Target TCP Transmission Control Protocol TLS Transport Layer Security TOE Target of Evaluation VALIDATION REPORT Imperva SecureSphere v11.5 14 TSF TOE Security Function(s) VALIDATION REPORT Imperva SecureSphere v11.5 15 14 Bibliography The Validation Team used the following documents to produce this Validation Report: [1] Common Criteria for Information Technology Security Evaluation Part 1: Introduction, Version 3.1, Revision 4, September 2012. [2] Common Criteria for Information Technology Security Evaluation Part 2: Security Functional Requirements, Version 3.1 Revision 4, September 2012. [3] Common Criteria for Information Technology Security Evaluation Part 3: Security assurance components, Version 3.1 Revision 4, September 2012. [4] Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 4, September 2012. [5] Imperva SecureSphere Security Target, Version 0.4, 12 November 2015 [6] Common Criteria Evaluation and Validation Scheme - Guidance to CCEVS Approved Common Criteria Testing Laboratories, Version 2.0, 8 Sep 2008. [7] Evaluation Technical Report For Imperva SecureSphere v11.5 Part 2 (Leidos Proprietary), Version 1.0, November 13, 2015