COMPANY CONFIDENTIAL Good Technology, Inc. 430 North Mary Avenue, Suite 200 Sunnyvale, CA 94085 1-866-7BE-GOOD www.good.com SECURITY TARGET FOR GOOD FOR ENTERPRISE SYSTEM, V1.19 EAL 4 AUGMENTED WITH ALC_FLR.1 COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 2 of 44 TABLE OF CONTENTS 1. INTRODUCTION (ASE_INT).............................................. 6 IDENTIFICATION..................................................................................6 TOE OVERVIEW..................................................................................6 SECURITY ARCHITECTURE .....................................................................6 HARDWARE/SOFTWARE/FIRMWARE REQUIREMENTS.......................................7 PRODUCT IDENTIFICATION....................................................................7 USER/ADMINISTRATOR DOCUMENTATION ..................................................8 TOE DESCRIPTION ..............................................................................8 WIRELESS SYNCHRONIZATION ...............................................................8 GOOD SYSTEM SECURITY ARCHITECTURE ..................................................9 NETWORK PERIMETER SECURITY...........................................................9 HANDHELD SECURITY .....................................................................10 HANDHELD AUTHENTICATION ............................................................10 ADMINISTRATIVE SECURITY ..............................................................10 GOOD SECURE OTA ARCHITECTURE ......................................................10 OTA DEPLOYMENT SECURITY CONSIDERATIONS.......................................10 OTA SOFTWARE INSTALLATION SECURITY CONSIDERATIONS .......................10 GOOD SECURITY POLICIES .................................................................11 MANAGING AN EXCHANGE ACCOUNT ......................................................11 MULTIPLE EXCHANGE AND GOOD MOBILE MESSAGING SERVERS......................11 MANAGING ROLES............................................................................12 DATA ENCRYPTION...........................................................................12 DIAGNOSTIC LOG FILE ......................................................................12 CORPORATE INFORMATION..................................................................13 EXCLUDED FUNCTIONS ......................................................................13 NOTATIONS AND FORMATTING ...............................................................13 2. CC CONFORMANCE CLAIM (ASE_CCL) .............................. 14 3. SECURITY PROBLEM DEFINITION (ASE_SPD)..................... 15 THREATS TO SECURITY ........................................................................15 ASSETS .......................................................................................15 THREAT AGENTS .............................................................................15 IDENTIFICATION OF THREATS ..............................................................15 THREATS TO THE TOE.....................................................................15 ORGANIZATIONAL SECURITY POLICIES ......................................................15 ASSUMPTIONS..................................................................................15 4. SECURITY OBJECTIVES (ASE_OBJ)................................... 17 TOE SECURITY OBJECTIVES .................................................................17 OPERATIONAL ENVIRONMENT SECURITY OBJECTIVES .....................................17 SECURITY OBJECTIVES RATIONALE ..........................................................17 THREATS ........................................................................................18 TT.EAVESDROPPING.........................................................................18 COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 3 of 44 TT.THEFT.....................................................................................18 TT.TAMPERING...............................................................................18 TT.ACCESS_INFO ...........................................................................19 TT.MOD_CONF ..............................................................................19 POLICIES........................................................................................19 P.SECURE_COMMUNICATIONS .............................................................19 P.MANAGE....................................................................................19 P.RESTRICT ..................................................................................19 ASSUMPTIONS..................................................................................19 A.INSTALL ....................................................................................19 A.MANAGE....................................................................................20 A.NO_EVIL...................................................................................20 A.LOCATE.....................................................................................20 5. EXTENDED COMPONENTS DEFINITION (ASE_ECD)............... 21 FDP_SWA_EXP.1 SECURE WEB ACCESS ................................................21 FPT_ITT_EXP.1 BASIC INTERNAL TSF DATA TRANSFER PROTECTION.................21 FTP_ITC_EXP.1 INTER-TSF TRUSTED CHANNEL ........................................21 FTP_TRP_EXP.1 INTER-TSF TRUSTED PATH ............................................21 FDP_CDD_EXP.1 CLIENT DATA DELETION ...............................................22 EXTENDED COMPONENTS RATIONALE .......................................................22 6. SECURITY REQUIREMENTS (ASE_REQ) ............................. 24 SECURITY FUNCTIONAL REQUIREMENTS (SFRS) ..........................................24 SECURITY AUDIT (FAU) ....................................................................25 FAU_GEN.1 AUDIT DATA GENERATION ................................................25 FAU_GEN.2 USER IDENTITY ASSOCIATION ...........................................27 USER DATA PROTECTION (FDP)...........................................................27 FDP_ACC.1A SUBSET ACCESS CONTROL - ADMINISTRATOR........................27 FDP_ACC.1B SUBSET ACCESS CONTROL - USER.....................................27 FDP_ACF.1A SECURITY ATTRIBUTE BASED ACCESS CONTROL – ADMINISTRATOR 27 FDP_ACF.1B SECURITY ATTRIBUTE BASED ACCESS CONTROL – USER ............27 FDP_ITC.2 IMPORT OF USER DATA WITH SECURITY ATTRIBUTES ...................28 FDP_SWA_EXP.1 SECURE WEB ACCESS ............................................28 IDENTIFICATION AND AUTHENTICATION (FIA)...........................................28 FIA_AFL.1 AUTHENTICATION FAILURE HANDLING ....................................28 FIA_ATD.1 USER ATTRIBUTE DEFINITION.............................................28 FIA_UAU.1A TIMING OF AUTHENTICATION - ADMINISTRATOR .....................29 FIA_UAU.1B TIMING OF AUTHENTICATION - USER ..................................29 FIA_UID.1 TIMING OF IDENTIFICATION ...............................................29 FIA_USB.1 USER-SUBJECT BINDING ..................................................29 SECURITY MANAGEMENT (FMT)...........................................................30 FMT_MOF.1A MANAGEMENT OF SECURITY FUNCTIONS BEHAVIOUR - ADMINISTRATOR ...........................................................................30 FMT_MOF.1B MANAGEMENT OF SECURITY FUNCTIONS BEHAVIOUR - USER.......30 FMT_MSA.1A MANAGEMENT OF SECURITY ATTRIBUTES - ADMINISTRATOR .......30 FMT_MSA.1B MANAGEMENT OF SECURITY ATTRIBUTES - USER ....................30 FMT_MSA.3A STATIC ATTRIBUTE INITIALISATION - ADMINISTRATOR .............31 COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 4 of 44 FMT_MSA.3B STATIC ATTRIBUTE INITIALISATION - USER ..........................31 FMT_SMF.1A SPECIFICATION OF MANAGEMENT FUNCTIONS - ADMINISTRATOR .31 FMT_SMF.1B SPECIFICATION OF MANAGEMENT FUNCTIONS - USER ..............31 FMT_SMR.1 SECURITY ROLES..........................................................31 PROTECTION OF THE TSF (FPT)...........................................................32 FPT_ITT_EXP.1 BASIC INTERNAL TSF DATA TRANSFER PROTECTION.............32 FPT_STM.1 RELIABLE TIME STAMPS ...................................................32 FPT_TDC.1 INTER-TSF BASIC TSF DATA CONSISTENCY............................32 TRUSTED PATH / CHANNELS (FTP) .......................................................32 FTP_ITC_EXP.1 INTER-TSF TRUSTED CHANNEL ....................................32 FTP_TRP_EXP.1 INTER-TSF TRUSTED PATH ........................................32 SECURITY ASSURANCE REQUIREMENTS (SARS)...........................................33 SECURITY REQUIREMENTS RATIONALE ......................................................33 O.SECURE_COMMUNICATIONS...........................................................35 O.PROTECT.................................................................................35 O.ADMIN ...................................................................................35 O.AUTHENTICATE_ADMIN ................................................................35 O.AUTHENTICATE_USER..................................................................35 O.AUDIT ....................................................................................36 O.ACCESS_INT ............................................................................36 SFR DEPENDENCIES ........................................................................36 SAR RATIONALE...............................................................................38 7. TOE SUMMARY SPECIFICATION (ASE_TSS) ....................... 38 TOE SECURITY FUNCTIONS SPECIFICATION................................................38 SF.SECURITY_AUDIT .......................................................................38 SF_USERDATA_PROTECTION ..............................................................38 SF.IDENTIFICATION_AUTHENTICATION...................................................39 SF.SECURITY_MANAGEMENT ..............................................................39 SF.TSF_PROTECTION ......................................................................41 TRUSTED_PATH-CHANNELS ................................................................41 SECURITY FUNCTIONS RATIONALE...........................................................41 COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 5 of 44 DOCUMENT CONTROL Document Owners Role Person Telephone Email Principal Product Manager Rick Pitz +1 408 212 7878 rpitz@good.com Office of the CTO Henry Hernandez +1 408 212 7837 hhernandez@good.com ABBREVIATIONS Abbreviation Description AES Advanced Encryption Standard CC Common Criteria CLI Command-line interface CM Configuration Management CMVP Cryptographic Module Validation Program DES Data Encryption Standard DNS Domain Name System EAL Evaluation Assurance Level FIPS Federal Information Processing Standards GAL Global Address List GMC The Good Mobile Control IP Internet Protocol IT Information Technology NOC Network Operations Centre OS Operating System OTA Over-The-Air RBA Role-Based-Administration SF Security Function SFP Security Function Policy SSL Secure Sockets Layer ST Security Target TOE Target of Evaluation TSF TOE Security Functionality COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 6 of 44 1. INTRODUCTION (ASE_INT) IDENTIFICATION ST Title: Security Target for Good for Enterprise System, v1.19 CC Version: 3.1 Assurance level: EAL4 augmented with ALC_FLR.1 PP Identification: None TOE name: Good for Enterprise System TOE version: • Good for Enterprise System • Product platform versions as described in Table 1 TOE OVERVIEW SECURITY ARCHITECTURE Good for Enterprise is a complete encrypted wireless system for accessing corporate messaging and data from behind the firewall on the mobile handheld. The Good for Enterprise System comprises three core components; Good Mobile Control (GMC), Good Mobile Messaging, and Good Mobile Access. The system uses an internet accessible, external Network Operations Centre (NOC) to transfer information – wirelessly Over-The-Air (OTA) to and from mobile devices. The information is transferred via a Virtual Private Network (VPN) and encrypted using related security protocols; HyperText Transfer Protocol Secure (HTTPS) and Secure Sockets Layer (SSL). Figure 1 read in conjunction with table 1 from section 1.2.3 of this document (cross-referencing the numbers and IDs respectively) outlines the core architecture. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 7 of 44 Figure 1; Core architecture Good Mobile Control: Good Mobile Control Console communicates with Good Mobile Control Server and is used to assign handhelds to users, to set up, monitor, and manage the handhelds (mobile devices), to create and manage policy sets, and to manage the Good Mobile Messaging Servers. Good Mobile Messaging and Good Mobile Access Secure Browser act as plug-ins to GMC Server. Good Mobile Messaging: Good Mobile Messaging Server monitors each user's Exchange or Domino account and forwards any software policy changes to the handheld. Good Mobile Access: Good Mobile Access (Secure Browser) is a Good Messaging plug-in that provides a browser on supported devices for use with the corporate Intranet. The browser is integrated to the Good Mobile Messaging Client on the device and provides seamless access to Intranet sites without the need for a VPN. HARDWARE/SOFTWARE/FIRMWARE REQUIREMENTS TOE hardware/software/firmware requirements are specified in Table 1: Platforms for TOE. TOE Environment (non-TOE) hardware/software/firmware requirements are specified in Table 1: Platforms for TOE Environment. In addition, Good Mobile Control requires access to an SQL server. It is possible to use an existing Enterprise or Standard SQL Server 2005, 2008, 2008 R2, or 2008 ENT, or SQL server instance available within the organization. Good Mobile Control Server can connect to a remote SQL server/instance. If the organization doesn’t have an SQL server that it wants to use, a server will be installed along with the Good Mobile Control. PRODUCT IDENTIFICATION Product or Service Name: Good for Enterprise System Version: 1.0 Platforms (for Products): Identified in Table 1. ID Operating System / Product Version Component / Browser Version Platforms for TOE Environment 1 Microsoft Windows Server (Generic x86 Computer Architecture Hardware) 2003 32 Bit 2008 64 bit a. Primary Domain Controller (PDC) 1 b. IBM Lotus Domino Server c. IBM Lotus Domino Administrator N/A 8.5 8.5 2 Microsoft Windows Server (Generic x86 Computer Architecture Hardware) 2003/08 Standard 32 Bit a. Microsoft Exchange Server (for 2007 and 2010, MAPI/CDO required) 2003 SP2 2007 2010 2012 Platforms for TOE 3 Microsoft Windows Server (Generic x86 Computer Architecture Hardware) 2003/08 Enterprise 64 Bit 2008 64 bit a. Good Mobile Control Server 64bit-Domino b. Good Mobile Control Server 64bit-Exchange 2.3.1 2.3.0 4 Microsoft Windows Server 2003/08 a. Good Messaging Server – 7.1.0 COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 8 of 44 (Generic x86 Computer Architecture Hardware) 32 Bit 2008 64 bit Exchange b. Good Messaging Server - Domino 7.0.2 5 Apple iPhone & iPad iOS Device 4.x 5.x 6.x a. Good Messaging Client 2.1.5 6 Google Android Device 2.2 2.3 4.0 4.1 a. Good Messaging Client 2.1.2 Table 1; Platforms USER/ADMINISTRATOR DOCUMENTATION The following is a list of the user and administrator guidance documents: GoodAdminGuide_domino GoodAdminGuide_exchange MS_OCSP_Install_Config QuickInstall_domino QuickInstall_exchange UserGuide_android UserGuide_iPad UserGuide_iphone Good Technology Security Best Practices TOE DESCRIPTION Good for Enterprise provides Android and iPhone mobile users with a wirelessly synchronized connection to their company servers, so they can instantly access up-to- date corporate email, attachments, contacts, calendar, public folders, global address lists, and critical corporate data when away from their desks. Good for Enterprise is a complete encrypted wireless system for accessing corporate messaging and data from behind the firewall on the mobile handheld. The Good for Enterprise system includes: • The Good for Enterprise Client, supporting iOS and Android mobile devices (phones and tablets). • The Good Mobile Messaging Server (GMM), an enterprise class application allowing for management/global policy control and remote wireless synchronization. • The Good Mobile Control Server (GMC), an enterprise class application, used to monitor and manage user handhelds. WIRELESS SYNCHRONIZATION Good for Enterprise provides automatic synchronization of email, calendar, and contacts, between the user’s Microsoft Exchange Server or Domino Notes Server account and iPhone and Android handhelds. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 9 of 44 Figure 2; Synchronizing Exchange account and handheld As shown in Figure 2, Good Mobile Messaging Server software monitors the user’s Exchange or Domino account and forwards all account activity to the user’s handheld via the Network Operations Center and your wireless network. Similarly, changes made at the handheld travel over the wireless network, and are returned from the Network Operations Center to Exchange or Domino via Good Mobile Messaging Server. The email arrives at both the user’s desktop and handheld, available to be read, forwarded, and replied to from either location. A user can have his/her Outlook or Notes account synchronized to multiple handhelds. GOOD SYSTEM SECURITY ARCHITECTURE The Good System provides an end-to-end system designed to protect corporate information at all times—while it is being transmitted over the wireless network and while it resides on the handheld. Installation of Good applications does not require any modifications to the customer’s firewall, and allows leveraging the existing network security infrastructure. NETWORK PERIMETER SECURITY Connections from the Good Mobile Messaging Server to the Good Network Operations Center use HTTP and are protected by the Secure Sockets Layer (SSL). Connections to the Good Network Operations Center are used only for sending data to and receiving data from handheld devices. Perimeter security includes: • End-to-end encryption • AES • FIPS 140-2 validation • Reliable message delivery COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 10 of 44 HANDHELD SECURITY The handheld device can be configured with a device password1 . The Good application has its own password that is independent of the device password. When the handheld device is locked, Good applications will not display any of the user’s data. Access to the Good Application can be restored only by entering the correct Good password. If an unauthorized user tries to guess the password too many times, the Good client software can be configured to lock the device or delete all Good application data stored on it. The IT administrator can specify policies for the password provided by the user. These policies are applied wirelessly. Good data is encrypted and cannot be downloaded from the device. If a user’s handheld device is lost or stolen, the IT administrator can use the Good Mobile Control Console to remotely disable access to Good on the device and remove all Good application data. If a handheld device is recovered, Good for Enterprise and all handheld applications selected by it can be restored over the air (OTA). HANDHELD AUTHENTICATION The Good System provides a number of safeguards against unauthorized access. The Good Mobile Messaging Server resides behind a corporate firewall, and any handheld device attempting to contact it requires a three-step authentication process among • the Good Network Operations Center and the Good Mobile Messaging Server the handheld and the Good Network Operations Center the handheld and the Good Mobile Messaging Server ADMINISTRATIVE SECURITY The Good System offers Role-Based-Administration (RBA) features that allow system- administration permissions to be customized according to the needs and qualifications of each user. By controlling users’ access according to their roles and the associated permissions, RBA provides a tool for managing IT assets and increasing security. GOOD SECURE OTA ARCHITECTURE OTA DEPLOYMENT SECURITY CONSIDERATIONS In order to protect all traffic between Good OTA Setup and the Good Mobile Messaging Servers, all communication during the provisioning process runs over HTTP/SSL. The package of provisioning information is further encrypted using an AES key derived from the user’s OTA PIN. After the client receives the package of provisioning information, it begins to use the normal end-to-end encryption capabilities that Good for Enterprise uses after provisioning a handheld at the Good Mobile Control Console. OTA SOFTWARE INSTALLATION SECURITY CONSIDERATIONS The Good OTA software distribution system supports distribution of three classes of software: Good applications, Good partner applications, and custom applications provided by a customer’s internal IT department. Security is maintained via the following: Digital Signatures - Good software and partner software are digitally signed using X.509v3 certificates. Encryption - Before the custom software package is uploaded, it is encrypted using a key generated by the Good Mobile Control Console using Microsoft’s CryptoAPI. Software Versions - The Console provides a policy for IT to specify the version of client software which will be installed. 1 Password is not mandatory, but is always recommended by Good. The enterprise can choose to not have passwords based on enterprise policy. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 11 of 44 Mandatory Installation - IT can mark software packages as mandatory or optional. Off-Peak Downloads - When IT initiates a Good for Enterprise upgrade or distribution of other handheld software for multiple handhelds, the Good for Enterprise client will begin the download at a random time overnight. GOOD SECURITY POLICIES Good for Enterprise allows the administrator to set a wide variety of policies to be enforced on user handhelds. These include passwords; storage-card encryption; mandatory or permitted applications, databases, and folders; S/MIME; and other policies. MANAGING AN EXCHANGE ACCOUNT Figure 3; Monitoring the user’s account As shown in Figure 3, Good Mobile Messaging Server monitors activity in the handheld user’s email, calendar, contacts, tasks, notes, and other folders and relays all changes to the Network Operations Center, where they are queued up and delivered to the handheld. In the same way, handheld activity is passed along to the Exchange account. Synchronization is dynamic and real-time, not scheduled. The messages cannot be viewed by anyone along the way because they are encrypted. Data can be viewed only from Outlook and on the handheld. One user can have his/her Outlook or Domino account synchronized to multiple handhelds. MULTIPLE EXCHANGE AND GOOD MOBILE MESSAGING SERVERS Good Mobile Messaging Server can manage synchronization for accounts on multiple Exchange servers in an Exchange Organization. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 12 of 44 Figure 4; Handheld users on multiple Exchange servers and sites Figure 4 shows Good Mobile Messaging Server maintaining user accounts on multiple Exchange servers. Good Mobile Control Server uses the Exchange Global Address List (GAL) to list, monitor, and manage handheld users across sites. The console is used to assign handhelds to users and to monitor and manage Good Mobile Messaging Servers. MANAGING ROLES The role Superuser is granted all rights and can perform some tasks that no other user can perform, and there can be only one Superuser. The Superuser must run the Good Mobile Control Console the first time it is accessed, and can then grant access to other accounts (using the Role Based Administration feature). Roles for service administrator, administrator, SelfService and helpdesk are predefined roles in the Console, which then can be used to create, delete and reassign other roles when needed. The service administrator role is granted all rights in the TOE. The SelfService role allows TOE users to optionally add their own handheld to Good for Enterprise and the Console, as well as add additional handhelds, deleting these handhelds, and erase and lock them. The Good Mobile Control Console is used to manage the Good for Enterprise handhelds and servers, and to control and limit the tasks performed by an individual or group using Good Mobile Control Console. The console can be configured so that some individuals and groups can use it only to set up handhelds and not to add or remove users from Good Mobile Messaging Servers, by creating roles for different users and group of users for Good Mobile Control Console. DATA ENCRYPTION All Good application data and folders on the handheld are encrypted. This data is encrypted when Good for Enterprise locks the handheld. The databases are decrypted when Good for Enterprise unlocks the handheld. DIAGNOSTIC LOG FILE The IT or helpdesk administrator in an organization can request the handheld user to send in a log file from the phone for troubleshooting purposes. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 13 of 44 CORPORATE INFORMATION The TOE separates the mobile data into corporate and personal data, where only the corporate data are protected. Corporate authentication is not required to access personal data, since the personal data is not protected. The rest of this document is only targeting protected corporate information. EXCLUDED FUNCTIONS The following product features have been excluded from the CC evaluated configuration: • Self-Service Portal • Windows Phone 7 and legacy (e.g. Palm, Symbian, and Windows Mobile) clients • GMC Web Services • Application Management NOTATIONS AND FORMATTING The notations and formatting used in this ST are consistent with version 3.1 of the Common Criteria (CC). The refinement operation is used to add detail to a requirement, and thus further restricts a requirement. Refinement of security requirements is denoted by bold text. Deleted words are denoted by strike-through text. The selection operation is used to select one or more options provided by the CC in stating a requirement. Selections are denoted by italicized text in square brackets, [Selection value]. The assignment operation is used to assign a specific value to an unspecified parameter, such as the length of a password. Assignment is indicated by showing the value with bold face in square brackets, [Assignment_value]. The iteration operation is used when a component is repeated with varying operations. Iteration is denoted by showing the iteration letter following the component identifier. Assets: Assets to be protected by the TOE are given names beginning with “AS.†– e.g. AS.CLASSIFIED_INFO. Assumptions: TOE security environment assumptions are given names beginning with “A.â€- e.g., A.Security_Procedures. Threats: Threat agents are given names beginning with “TA.†– e.g., TA.User. Threats to the TOE are given names beginning with “TT.†– e.g., TT.Filter_Fails. TOE security environment threats are given names beginning with “TE.â€-- e.g., TE.Crypto_Fails. Policies: TOE security environment policies are given names beginning with “P.â€â€”e.g., P.Information_AC. Objectives: Security objectives for the TOE and the TOE environment are given names beginning with “O.†and “OE.â€, respectively, - e.g., O.Filter-msg and OE.Clearance. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 14 of 44 2. CC CONFORMANCE CLAIM (ASE_CCL) This TOE and ST are conformant with the following specifications: • CC Part 2: Security functional components, July 2009, Version 3.1, Revision 3, extended. • CC Part 3: Security assurance components, July 2009, Version 3.1, Revision 3, conformant, • Package: EAL4 • Protection Profiles: None • Augmented SARs: ALC_FLR.1 COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 15 of 44 3. SECURITY PROBLEM DEFINITION (ASE_SPD) THREATS TO SECURITY ASSETS AS.Corporate_Information: Corporate information on Good Mobile Messaging Servers and mobile devices. THREAT AGENTS TA.Malicious_Actor: Malicious actors trying to get intelligible information stored on mobile devices or from communications between mobile devices. TA.Unauthorized_user: Individuals who have not been granted the right to access the system. IDENTIFICATION OF THREATS THREATS TO THE TOE TT.Eavesdropping: Malicious actor(s) eavesdropping on intelligible information on mobile devices, and/or data communications in transit between mobile devices. TT.Theft: A malicious actor or an unauthorized user may get access to corporate information on the mobile device, by theft and/or loss of mobile devices. TT.Tampering: An unauthorized user or process may be able to bypass the TOE’s security mechanisms by tampering with the TOE or TOE environment. TT.Access_Info: A malicious actor passes of as a handheld user, and erases the corporate information on the mobile device. TT.Mod_Conf: A malicious actor or an unauthorized user may modify the TOE configuration to gain unauthorized access to mobile devices. ORGANIZATIONAL SECURITY POLICIES P.Secure_Communications: The TOE shall use secure communications functions for its own use, including encryption/decryption operations. P.Manage: The TOE shall only be managed by authorized administrators. P.Restrict: Changes made by administrators to default values in policies shall be more restrictive. ASSUMPTIONS A.Install: The TOE has been installed and configured according to the appropriate installation guides, and all traffic between clients and servers flows through it. A.Manage: There is one or more competent individual (administrator) assigned to manage the TOE and the security of the information it contains. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 16 of 44 A.No_Evil: The administrators of the TOE are non-hostile, appropriately trained, and follow all guidance. A.Locate: The processing resources of the TOE servers will be located within controlled access facilities, which will prevent unauthorized physical access. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 17 of 44 4. SECURITY OBJECTIVES (ASE_OBJ) TOE SECURITY OBJECTIVES O.Secure_Communications: The TOE shall use secure communications functions to maintain the confidentiality and allow for detection of modification of user data that is transmitted to the TOE. O.Protect: The TOE must ensure the integrity of audit, system data and corporate information by protecting itself from unauthorized modifications and access to its functions and data, and preserve correct operations during specified failure events. O.Admin: The TOE must include a set of functions that allow management of its functions and data, ensuring that TOE administrators with the appropriate training and privileges and only those TOE administrators, may exercise such control. O.Authenticate_Admin: The TOE must be able to identify and authenticate administrators prior to allowing access to TOE administrative functions and data. O.Authenticate_User: The TOE must be able to identify and authenticate users prior to allowing access to mobile device functions and data. O.Audit: The TOE must record the actions taken by administrators, prevent unauthorized deletion of the audit records stored on the TOE, and provide the authorized administrators with the ability to review the audit trail. O.Access_Int: The TOE must allow access to server resources on protected/internal network only as defined by the Access Control SFP. OPERATIONAL ENVIRONMENT SECURITY OBJECTIVES OE.Secure_Communications: The Operational Environment will provide secure communications functions to the TOE including encryption and decryption functions. OE.Manage: Sites deploying the TOE will provide competent, non-hostile TOE administrators who are appropriately trained and follow all administrator guidance. TOE administrators will ensure the system is used securely. The reliability of the TOE’s timestamps will be ensured via periodic manual checks by the TOE administrator. OE.Physical: The physical environment must be suitable for supporting TOE servers in a secure setting. OE.Install: Those responsible for the TOE must ensure that the TOE is delivered, installed, managed, and operated in a manner which is consistent with IT security. OE.Person: Personnel working as authorized administrators shall be carefully selected and trained for proper operation of the TOE. SECURITY OBJECTIVES RATIONALE This section gives the relation between security objectives and threats, policies, and assumption. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 18 of 44 Objectives Threats, Assumptions, Policies TT.Eavesdropping TT.Theft TT.Tampering TT.Access_Info TT.Mod_Conf P.Secure_Communications P.Manage P.Restrict A.Install A.Manage A.No_Evil A.Locate O.Secure_Communications X X X O.Protect X X X X X O.Admin X X O.Authenticate_Admin X X O.Authenticate_User X X X O.Audit X X X X O.Access_Int X X OE.Secure_Communications X X X OE.Manage X X X X OE.Physical X OE.Install X X X OE.Person X X X Table 2; Tracing of objectives to threats, assumptions, and policies THREATS TT.EAVESDROPPING The threat TT.Eavesdropping is met by the objectives O.Secure_Communications, O.Protect and O.Access_Int. O.Secure_Communications ensures that secure communication functions can maintain the confidentiality and allow for detection of modification of user data that is transmitted to the TOE. O.Protect ensures that the protection mechanisms of the TOE designed to prevent tampering with TOE IT assets are in place and functioning properly, and that these mechanisms cannot be bypassed. O.Access_Int ensures that access to server resources on protected/internal network is allowed only as defined by the Information Flow Control SFP. OE. Secure_Communications ensures that the secure communications functions include encryption and decryption. TT.THEFT The threat TT.Theft is met by the objectives O.Secure_Communications, , O.Authenticate_User and O.Audit. O.Secure_Communications ensures that secure communication functions can maintain the confidentiality and allow for detection of modification of user data that is transmitted to the TOE. O.Authenticate_User ensures that users identify and authenticate themselves before they are given access. O.Audit ensures that events of security relevance are audited. OE. Secure_Communications ensures that the functions include encryption and decryption. TT.TAMPERING The threat TT.Tampering is met by the objectives O.Protect and O.Audit. O.Protect ensures that the protection mechanisms of the TOE designed to prevent tampering with COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 19 of 44 TOE IT assets are in place and functioning properly, and that these mechanisms cannot be bypassed. O.Audit ensures that changes to the TOE will be recorded. TT.ACCESS_INFO The threat TT.Access_Info is met by the objectives O.Protect, O.Authenticate_User and O.Audit. O.Protect ensures that the TOE protects corporate information from unauthorized modifications. O.Authenticate_User ensures that users identify and authenticate themselves before they are given access. O.Audit ensures that events of security relevance are audited. TT.MOD_CONF The threat TT.Mod_Conf is met by the objectives O.Protect, O.Authenticate_Admin, O.Audit and OE.Manage. O.Protect ensures that the TOE protects configuration data from unauthorized modifications. O.Authenticate_Admin ensures that Administrators identify and authenticate themselves before they are given access to configuration data. O.Audit ensures that events of security relevance are audited. OE.Manage ensures that the TOE will be managed by competent, non-hostile administrators who will configure the system securely to limit access to the user’s configuration data. POLICIES P.SECURE_COMMUNICATIONS The policy P.Secure_Communications is met by the objective O.Secure_Communications and the Operational Environment Objective OE. Secure_Communications which will require the TOE to use secure communications services provided by the Operations Environment. These services will provide confidentiality and integrity protection of TSF data while in transit to the TOE. P.MANAGE The policy P.Manage is met by the objectives O.Protect, O.Admin, O.Authenticate_User O.Authenticate_Admin, O.Access_Int, OE.Install and OE.Person. The O.Protect objective provides for TOE self-protection. The O.Admin objective ensures there is a set of functions for administrators to use. The O.Authenticate_User objective provides for authentication of users prior to any TOE function accesses. The O.Authenticate_Admin objective provides for authentication of administrators prior to any management functions in the TOE. The OE.Install objective supports the OE.Person objective by ensuring administrator follow all provided documentation and maintain the security policy. The O.Access_Int ensures that the TOE limits access to internal network resources to the authorized users. P.RESTRICT The policy P.Restric is met by the objective O.Admin by ensuring that the TOE provides a set of functions that allow management of its functions and data. ASSUMPTIONS A.INSTALL The assumption A.Install is met by the objectives OE.Manage and OE.Install. OE.Manage ensures that the TOE will be managed by competent, non-hostile administrators who will configure the system securely to limit access to the user’s configuration data. OE.Install ensures that the TOE will be installed correctly and COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 20 of 44 configured securely. All traffic between the internal and external networks will flow through the TOE. A.MANAGE The assumption A.Manage is met by the objectives OE.Manage, OE.Person and OE.Install. OE.Manage ensures that the TOE will be managed by competent, non- hostile administrators who will configure the system securely to limit access to the user’s configuration data and who will periodically check the accuracy of the TOE’s timestamps. OE.Person objective will ensure that administrators follow all provided documentation and maintain the security policy. OE.Install ensures that the TOE will be installed correctly and configured securely. A.NO_EVIL The assumption A.No_Evil is met by the objectives OE.Manage and OE.Person. OE.Manage ensures that the TOE will be managed by competent, non-hostile administrators who will configure the system securely to limit access to the user’s configuration data and who will periodically check the accuracy of the TOE’s timestamps. OE.Person objective will ensure that administrators follow all provided documentation and maintain the security policy. A.LOCATE The assumption A.Locate is met by the objectives OE.Physical. OE.Physical ensures that the TOE’s environment is suitable for securely supporting the TOE. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 21 of 44 5. EXTENDED COMPONENTS DEFINITION (ASE_ECD) FDP_SWA_EXP.1 SECURE WEB ACCESS Management: The following actions could be considered for the management functions in FMT: Enabling the secure web access function on handhelds. Audit: There are no auditable events foreseen. Hierarchical to: No other components. Dependencies: None. FDP_SWA_EXP.1.1 The TSF shall provide secure intranet web browsing access capabilities. FPT_ITT_EXP.1 BASIC INTERNAL TSF DATA TRANSFER PROTECTION Management: There are no management functions foreseen. Audit: There are no auditable events foreseen. Hierarchical to: No other components. Dependencies: None. FPT_ITT_EXP.1.1 The TSF shall use mechanisms from the Operational Environment to protect TSF data from [selection: disclosure, modification] when it is transmitted between separate parts of the TOE. FTP_ITC_EXP.1 INTER-TSF TRUSTED CHANNEL Management: There are no management functions foreseen. Audit: There are no auditable events foreseen. Hierarchical to: No other components. Dependencies: None FTP_ITC_EXP.1.1 The TSF shall use a communication channel provided by the Operational Environment to communicate between itself and another trusted IT product that is logically distinct from other communication channels and provides assured identification of its end points and protection of the channel data from modification or disclosure. FTP_ITC_EXP.1.2 The TSF shall permit [selection: the TSF, another trusted IT product] to communicate via the trusted channel. FTP_ITC_EXP.1.3 The TSF shall communicate via the trusted channel for [ assignment: list of functions for which a trusted channel is required]. FTP_TRP_EXP.1 INTER-TSF TRUSTED PATH Management: There are no management functions foreseen. Audit: There are no auditable events foreseen. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 22 of 44 Hierarchical to: No other components. Dependencies: None FTP_TRP_EXP.1.1 The TSF shall use a communication path provided by the Operational Environment to communicate between itself and [selection: remote, local]] users that is logically distinct from other communication paths and provides assured identification of its end points and protection of the communicated data from [selection: modification, disclosure, [assignment: other types of integrity or confidentiality violation]]. FTP_TRP_EXP.1.2 The TSF shall permit [selection: the TSF, local users, remote users] to communicate via the trusted path. FTP_TRP_EXP.1.3 The TSF shall require the use of the trusted path for [selection: initial user authentication, [assignment: other services for which trusted path is required]]. FDP_CDD_EXP.1 CLIENT DATA DELETION Management: There are no management functions foreseen. Audit: Successful handheld wipe action. Hierarchical to: No other components. Dependencies: None. FDP_CDD_EXP.1.1 The TSF shall erase all user data stored within the handheld when the following events occur: [assignment: action taken]. EXTENDED COMPONENTS RATIONALE The extended components were created because the Common Criteria standard classes do not have any Security Functional Requirements (SFR) that accurately describe the unique capabilities of tis TOE solution. The table below provides the rationale for each extended component used in this ST. Explicit Component Identifier Rationale FDP_SWA_EXP.1 SECURE WEB ACCESS This explicit component is necessary since it describes product-unique functionality, consisting of secure web access from the Client. FPT_ITT_EXP.1 BASIC INTERNAL TSF DATA TRANSFER PROTECTION This explicit component is necessary since it provides the ability for the TOE to use secure communications capabilities provided by the Operational Environment. FTP_ITC_EXP.1 INTER-TSF TRUSTED CHANNEL This explicit component is necessary since it provides the ability for the TOE to use a trusted communication channel provided by the Operational Environment to communicate between itself and another trusted IT product. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 23 of 44 FTP_TRP_EXP.1 INTER-TSF TRUSTED PATH This explicit component is necessary since it provides the ability for the TOE to use a trusted communication channel provided by the Operational Environment to communicate between itself and users.. FDP_CDD_EXP.1 CLIENT DATA DELETION This explicit component is necessary since it describes product-unique functionality to wipe handheld data. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 24 of 44 6. SECURITY REQUIREMENTS (ASE_REQ) SECURITY FUNCTIONAL REQUIREMENTS (SFRS) Functional Components Security Audit FAU_GEN.1 Audit data generation FAU_GEN.1B Client audit data generation FAU_GEN.2 User identity association User Data Protection FDP_ACC.1A Subset access control - Administrator FDP_ACC.1B Subset access control - User FDP_ACF.1A Security attribute based access control - Administrator FDP_ACF.1B Security attribute based access control - User FDP_ITC.2 Import of user data with security attributes FDP_SWA_EXP.1 Secure web access FDP_CDD_EXP.1 Client Data Deletion Identification and Authentication FIA_AFL.1 Authentication failure handling FIA_ATD.1 User attribute definition FIA_UAU.1A Timing of authentication - Administrator FIA_UAU.1B Timing of authentication - User FIA_UID.1 Timing of identification FIA_USB.1 User-subject binding Security Management FMT_MOF.1A Management of security functions behaviour - Administrator FMT_MOF.1B Management of security functions behaviour - User FMT_MSA.1A Management of Security Attributes - Administrator FMT_MSA.1B Management of Security Attributes - User FMT_MSA.3A Static Attribute Initialisation - Administrator COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 25 of 44 FMT_MSA.3B Static Attribute Initialisation - User FMT_SMF.1A Specification of management functions - Administrator FMT_SMF.1B Specification of management functions - User FMT_SMR.1 Security roles Protection of the TSF FPT_ITT_EXP.1 Basic internal TSF data transfer protection FPT_STM.1 Reliable time stamps FPT_TDC.1 Inter-TSF basic TSF data consistency Trusted Channel/Path FTP_ITC_EXP.1 Inter-TSF trusted channel FTP_TRP_EXP.1 Inter-TSF trusted path SECURITY AUDIT (FAU) FAU_GEN.1 AUDIT DATA GENERATION Dependences: FPT_STM.1 Reliable time stamps FAU_GEN.1.1 The TSF shall be able to generate an audit record of the following auditable events: a) Start-up and shutdown of the audit functions; b) All auditable events for the [not specified] level of audit; and c) [See Table 3 - Auditable Events]. SFR Auditable Event Log Location FAU_GEN.1 None N/A FAU_GEN.1B None N/A FAU_GEN.2 None N/A FDP_ACC.1A None N/A FDP_ACC.1B None N/A FDP_ACF.1A Successful requests to perform management functions GMM FDP_ACF.1B Successful requests to access corporate data (e.g., email) GMM Client FDP_ITC.2 Successful import of user data from Exchange/Domino GMM FDP_SWA_EXP.1 None N/A FDP_CDD_EXP.1 Successful handheld wipe action. GMC FIA_AFL.1 None N/A FIA_ATD.1 None N/A FIA_UAU.1A Unsuccessful use of the authentication mechanism; GMC FIA_UAU.1B None N/A FIA_UID.1 None N/A COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 26 of 44 FIA_USB.1 None N/A FMT_MOF.1A All modifications in the behaviour of the console functions in the TSF. GMC FMT_MOF.1B All modifications in the behaviour of the console functions in the TSF. GMC FMT_MSA.1A All modifications of the values of security attributes. GMC FMT_MSA.1B All modifications of the values of security attributes. GMC FMT_MSA.3A None N/A FMT_MSA.3B Modifications of the default setting of restrictive rules. GMC FMT_SMF.1A Use of managing administrator identifiers; creating, modifying, deleting role definitions functions. GMC FMT_SMF.1B Use of the console management functions. GMC FMT_SMR.1 Modifications to the group of users that are part of a role; GMC FPT_ITT_EXP.1 None N/A FPT_STM.1 None N/A FPT_TDC.1 Successful use of TSF data consistency mechanisms. GMM FTP_ITC_EXP.1 None N/A FTP_TRP_EXP.1 None. N/A Table 3 - Auditable Events FAU_GEN.1.2 The TSF shall record within each audit record at least the following information: a) Date and time of the event, type of event, subject identity (if applicable), and the outcome (success or failure) of the event; and b) For each audit event type, based on the auditable event definitions of the functional components included in the PP2 /ST, [None]. FAU_GEN.1B AUDIT DATA GENERATION - CLIENT Dependences: FPT_STM.1 Reliable time stamps FAU_GEN.1.1 The TSF shall be able to generate an audit record of the following auditable events: a) Start-up and shutdown of the audit functions; b) All auditable events for the [not specified] level of audit; and c) [Diagnostic information]. FAU_GEN.1.2 The TSF shall record within each audit record at least the following information: a) Date and time of the event, type of event, subject identity (if applicable), and the outcome (success or failure) of the event; and b) For each audit event type, based on the auditable event definitions of the functional components included in the PP3 /ST, [None]. 2 Good for Enterprise System is not compliant to any protection profile. 3 Good for Enterprise System is not compliant to any protection profile. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 27 of 44 FAU_GEN.2 USER IDENTITY ASSOCIATION Dependences: FAU_GEN.1 Audit data generation FIA_UID.1 Timing of identification FAU_GEN.2.1 For audit events resulting from actions of identified users, the TSF shall be able to associate each auditable event with the identity of the user that caused the event. USER DATA PROTECTION (FDP) FDP_ACC.1A SUBSET ACCESS CONTROL - ADMINISTRATOR Dependences: FDP_ACF.1 Security attribute based access control FDP_ACC.1.1a The TSF shall enforce the [Administrator Access Control SFP] on [subjects: administrators, objects: management tasks, operations: access]. FDP_ACC.1B SUBSET ACCESS CONTROL - USER Dependences: FDP_ACF.1 Security attribute based access control FDP_ACC.1.1b The TSF shall enforce the [User Access Control SFP] on [subjects: users, objects: corporate data, operations: access]. FDP_ACF.1A SECURITY ATTRIBUTE BASED ACCESS CONTROL – ADMINISTRATOR Dependencies: FDP_ACC.1 Subset access control FMT_MSA.3 Static attribute initialization FDP_ACF.1.1a The TSF shall enforce the [Administrator Access Control SFP] to objects based on the following: [subjects: administrators, subject attributes: administrator roles, object: management tasks, object attributes: none]. FDP_ACF.1.2a The TSF shall enforce the following rules to determine if an operation among controlled subjects and controlled objects is allowed: [role-based administration setup]. FDP_ACF.1.3a The TSF shall explicitly authorise access of subjects to objects based on the following additional rules: [no additional rules]. FDP_ACF.1.4a The TSF shall explicitly deny access of subjects to objects based on the following additional rules: [no additional rules]. FDP_ACF.1B SECURITY ATTRIBUTE BASED ACCESS CONTROL – USER Dependencies: FDP_ACC.1 Subset access control FMT_MSA.3 Static attribute initialization FDP_ACF.1.1b The TSF shall enforce the [User Access Control SFP] to objects based on the following: [subjects: users, subject attributes: handheld policy, object: corporate data, object attributes: none]. FDP_ACF.1.2b The TSF shall enforce the following rules to determine if an operation among controlled subjects and controlled objects is allowed: [handheld policy]. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 28 of 44 FDP_ACF.1.3b The TSF shall explicitly authorise access of subjects to objects based on the following additional rules: [no additional rules]. FDP_ACF.1.4b The TSF shall explicitly deny access of subjects to objects based on the following additional rules: [no additional rules]. FDP_ITC.2 IMPORT OF USER DATA WITH SECURITY ATTRIBUTES Dependencies: FDP_ACC.1 Subset access control FTP_ITC.1 Inter-TSF trusted channel FPT_TDC.1 Inter-TSF basic TSF data consistency FDP_ITC.2.1 The TSF shall enforce the [network perimeter security SFP] when importing user data, controlled under the SFP, from outside of the TOE. FDP_ITC.2.2 The TSF shall use the security attributes associated with the imported user data. FDP_ITC.2.3 The TSF shall ensure that the protocol used provides for the unambiguous association between the security attributes and the user data received. FDP_ITC.2.4 The TSF shall ensure that interpretation of the security attributes of the imported user data is as intended by the source of the user data. FDP_ITC.2.5 The TSF shall enforce the following rules when importing user data controlled under the SFP from outside the TOE: [no additional rules]. FDP_SWA_EXP.1 SECURE WEB ACCESS Dependencies: None. FDP_SWA_EXP.1.1 The TSF shall provide secure intranet web browsing access capabilities. FDP_CDD_EXP.1 CLIENT DATA DELETION Dependencies: None. FDP_CDD_EXP.1.1 The TSF shall erase all user data stored within the handheld when the following events occur: [The wipe handheld command is received]. IDENTIFICATION AND AUTHENTICATION (FIA) FIA_AFL.1 AUTHENTICATION FAILURE HANDLING Dependencies: FIA_UAU.1 Timing of authentication FIA_AFL.1.1 The TSF shall detect when [an administrator configurable positive integer within [3 to 12]] unsuccessful authentication attempts occur related to [the number of unsuccessful authentication attempts since the last successful authentication]. FIA_AFL.1.2 When the defined number of unsuccessful authentication attempts has been [surpassed], the TSF shall [lock out handheld users or erase handheld data]. FIA_ATD.1 USER ATTRIBUTE DEFINITION Dependences: None. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 29 of 44 FIA_ATD.1.1 The TSF shall maintain the following list of security attributes belonging to individual users: [administrator identifier, roles]. FIA_UAU.1A TIMING OF AUTHENTICATION - ADMINISTRATOR Dependences: FIA_UID.1 Timing of identification FIA_UAU.1.1a The TSF shall allow [secure HTTPS and SSL connection establishment for the purpose of transferring and accessing corporate data, administrator identification] on behalf of the user to be performed before the user is authenticated. FIA_UAU.1.2a The TSF shall require each user to be successfully authenticated before allowing any other TSF-mediated actions on behalf of that user. FIA_UAU.1B TIMING OF AUTHENTICATION - USER Dependences: FIA_UID.1 Timing of identification FIA_UAU.1.1b The TSF shall allow [secure connection establishment for the purpose of transferring and accessing corporate data, user identification] on behalf of the user to be performed before the user is authenticated. FIA_UAU.1.2b The TSF shall require each user to be successfully authenticated before allowing any other TSF-mediated actions on behalf of that user. FIA_UID.1 TIMING OF IDENTIFICATION Dependences: None. FIA_UID.1.1 The TSF shall allow [secure connection for the purpose of transferring and accessing corporate data] on behalf of the user to be performed before the user is identified. FIA_UID.1.2 The TSF shall require each user to identify itself before allowing any other TSF-mediated actions on behalf of that user. FIA_USB.1 USER-SUBJECT BINDING Dependences: FIA_ATD.1 User attribute definition FIA_USB.1.1 The TSF shall associate the following user security attributes with subjects acting on the behalf of that user: [administrator identifier, roles]. FIA_USB.1.2 The TSF shall enforce the following rules on the initial association of user security attributes with subjects acting on the behalf of users: [user security attributes are bound upon successful login]. FIA_USB.1.3 The TSF shall enforce the following rules governing changes to the user security attributes associated with subjects acting on the behalf of users: [user security attributes do not change until user logs in after changes are made]. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 30 of 44 SECURITY MANAGEMENT (FMT) FMT_MOF.1A MANAGEMENT OF SECURITY FUNCTIONS BEHAVIOUR - ADMINISTRATOR Dependences: FMT_SMF.1 Specification of Management Functions FMT_SMR.1 Security roles FMT_MOF.1.1a The TSF shall restrict the ability to [determine the behaviour of] the functions [ • managing administrator identifiers, • managing roles] • to [administrators]. FMT_MOF.1B MANAGEMENT OF SECURITY FUNCTIONS BEHAVIOUR - USER Dependences: FMT_SMF.1 Specification of Management Functions FMT_SMR.1 Security roles FMT_MOF.1.1b The TSF shall restrict the ability to [determine the behaviour of] the functions [ • managing user identifiers • managing user password characteristics, • managing handheld policies] to [administrators]. FMT_MSA.1A MANAGEMENT OF SECURITY ATTRIBUTES - ADMINISTRATOR Dependencies: FDP_ACC.1 Subset access control FMT_SMR.1 Security roles FMT_SMF.1 Specification of Management Functions FMT_MSA.1.1a The TSF shall enforce the [Administrator Access Control SFP] to restrict the ability to [query, modify, delete, [create]] the security attributes [ administrator identifier, administrator roles] to [administrators]. FMT_MSA.1B MANAGEMENT OF SECURITY ATTRIBUTES - USER Dependencies: FDP_ACC.1 Subset access control FMT_SMR.1 Security roles FMT_SMF.1 Specification of Management Functions FMT_MSA.1.1b The TSF shall enforce the [User Access Control SFP] to restrict the ability to [query, modify, delete, [create]] the security attributes [ user identifier, user password characteristics handheld policies] to [administrators]. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 31 of 44 FMT_MSA.3A STATIC ATTRIBUTE INITIALISATION - ADMINISTRATOR Dependencies: FMT_MSA.1 Management of security attributes FMT_SMR.1 Security roles FMT_MSA.3.1a The TSF shall enforce the [Administrator Access Control SFP] to provide [permissive] default values for security attributes that are used to enforce the SFP. FMT_MSA.3.2a The TSF shall allow the [administrators] to specify alternative initial values to override the default values when an object or information is created. FMT_MSA.3B STATIC ATTRIBUTE INITIALISATION - USER Dependencies: FMT_MSA.1 Management of security attributes FMT_SMR.1 Security roles FMT_MSA.3.1b The TSF shall enforce the [User Access Control SFP] to provide [restrictive] default values for security attributes that are used to enforce the SFP. FMT_MSA.3.2b The TSF shall allow the [administrators] to specify alternative initial values to override the default values when an object or information is created. FMT_SMF.1A SPECIFICATION OF MANAGEMENT FUNCTIONS - ADMINISTRATOR Dependencies: None. FMT_SMF.1.1 The TSF shall be capable of performing the following management functions: [ • managing administrator identifiers, • creating, modifying, deleting role definitions]. FMT_SMF.1B SPECIFICATION OF MANAGEMENT FUNCTIONS - USER Dependencies: None. FMT_SMF.1.1b The TSF shall be capable of performing the following management functions: [ • managing user identifiers, • managing user password characteristics, • managing handheld policies]. FMT_SMR.1 SECURITY ROLES Dependencies: FIA_UID.1 Timing of identification FMT_SMR.1.1 The TSF shall maintain the roles [administrator, user]. FMT_SMR.1.2 The TSF shall be able to associate users with roles. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 32 of 44 PROTECTION OF THE TSF (FPT) FPT_ITT_EXP.1 BASIC INTERNAL TSF DATA TRANSFER PROTECTION Dependencies: None. FPT_ITT_EXP.1.1 The TSF shall use mechanisms from the Operational Environment to protect TSF data from [disclosure] when it is transmitted between separate parts of the TOE. FPT_STM.1 RELIABLE TIME STAMPS Dependencies: None. FPT_STM.1.1 The TSF shall be able to provide reliable time stamps. FPT_TDC.1 INTER-TSF BASIC TSF DATA CONSISTENCY Dependencies: None FPT_TDC.1.1 The TSF shall provide the capability to consistently interpret [protected corporate information] when shared between the TSF and another trusted IT product4 . FPT_TDC.1.2 The TSF shall use [the Good Mobile Messaging Server] when interpreting the TSF data from another trusted IT product. TRUSTED PATH / CHANNELS (FTP) FTP_ITC_EXP.1 INTER-TSF TRUSTED CHANNEL Dependencies: None FTP_ITC_EXP.1.1 The TSF shall use a communication channel provided by the Operational Environment to communicate between itself and another trusted IT product that is logically distinct from other communication channels and provides assured identification of its end points and protection of the channel data from modification or disclosure. FTP_ITC_EXP.1.2 The TSF shall permit [the TSF or another trusted IT product] to communicate via the trusted channel. FTP_ITC_EXP.1.3 The TSF shall communicate via the trusted channel for [sending data to and from Exchange and Domino servers]. FTP_TRP_EXP.1 INTER-TSF TRUSTED PATH Dependencies: None FTP_TRP_EXP.1.1 The TSF shall use a communication path provided by the Operational Environment to communicate between itself and [remote] users that is logically distinct from other communication paths and provides assured identification of its end points and protection of the communicated data from [modification or disclosure]. FTP_TRP_EXP.1.2 The TSF shall permit [the TSF] to communicate via the trusted path. FTP_TRP_EXP.1.3 The TSF shall require the use of the trusted path for [communication to handheld devices]. 4 Trusted IT products are Domino/Exchange servers COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 33 of 44 SECURITY ASSURANCE REQUIREMENTS (SARS) Assurance Class Assurance Components ADV ADV_ARC.1, ADV_FSP.4, ADV_IMP.1, ADV_TDS.3 AGD AGD_OPE.1, AGD_PRE.1 ALC ALC_CMC.4, ALC_CMS.4, ALC_DEL.1, ALC_DVS.1, ALC_FLR.1, ALC_LCD.1, ALC_TAT.1 ATE ATE_COV.2, ATE_DPT.1, ATE_FUN.1, ATE_IND.2 AVA AVA_VAN.3 Table 4; Assurance requirements EAL4 augmented with ALC_FLR.1 SECURITY REQUIREMENTS RATIONALE This section gives the relation between SFRs and security objectives. TOE functional requirements Objectives for the TOE O.Secure_Communicatio ns O.Protect O.Admin O.Authenticate_Admin O.Authenticate_User O.Audit O.Access_Int Security Audit (FAU) FAU_GEN.1 Audit data generation X FAU_GEN.1B Audit data generation - Client X FAU_GEN.2 User identity association X User Data Protection (FDP) FDP_ACC.1A Subset access control-Administrator X X FDP_ACC.1B Subset access control-User X X FDP_ACF.1A Security attribute based access control- Administrator X X FDP_ACF.1B Security attribute based access control-User X X FDP_ITC.2, Import of user data with security attributes X FDP_SWA_EXP.1, Secure Web Access X FDP_CDD_EXP.1, Client Data Deletion X Identification and Authentication (FIA) FIA_AFL.1, Authentication failure X X COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 34 of 44 TOE functional requirements Objectives for the TOE O.Secure_Communicatio ns O.Protect O.Admin O.Authenticate_Admin O.Authenticate_User O.Audit O.Access_Int handling FIA_ATD.1 User attribute definition X X X FIA_UAU.1A Timing of authentication-Administrator X X FIA_UAU.1B Timing of authentication - User X X FIA_UID.1 Timing of identification X X X FIA_USB.1 User-subject binding X X X Security Management (FMT) FMT_MOF.1A Management of security functions behaviour- Administrator X FMT_MOF.1B Management of security functions behaviour-User X FMT_MSA.1A Management of security attributes-Administrator X FMT_MSA.1B Management of security attributes-User X FMT_MSA.3A Static attribute initialisation-Administrator X FMT_MSA.3B Static attribute initialisation-User X FMT_SMF.1A Specification of Management Functions- Administrator X FMT_SMF.1B Specification of Management Functions-User X FMT_SMR.1 Security roles X Protection of the TSF (FPT) FPT_ITT_EXP.1 Basic internal TSF data transfer protection X X FPT_STM.1 Reliable time stamps X X FPT_TDC.1, Inter-TSF basic TSF data consistency X Trusted Path / Channels (FTP) FTP_ITC_EXP.1, Inter-TSF trusted channel X X FTP_TRP_EXP.1Inter-TSF Trusted path X X Table 5; Tracing of functional requirements to objectives COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 35 of 44 O.SECURE_COMMUNICATIONS The TOE shall use secure communications provided by the Operational Environment to protect TSF data from disclosure when transmitted between separate parts of the TOE to meet FPT_ITT_EXP.1. The TSF shall use a communication channel provided by the Operational Environment to communicate between itself and another trusted IT product to meet the requirements of FTP_ITC_EXP.1. The TOE shall use a secure communications path between the Server and handhelds provided by the Operational Environment to satisfy FTP_TRP_EXP.1. O.PROTECT The TOE must ensure the integrity of audit and system data by protecting itself from unauthorized modifications and access to its functions and data. FPT_ITT_EXP.1 requires the TOE to protect the collected data from disclosure when the data is transmitted to a separate part of the TOE. FPT_STM.1 requires that the TOE provide reliable timestamps for its own use. FPT_TDC.1 requires that the TSF shall provide the capability to consistently interpret all information when shared between the TSF and the enterprise mail server. FTP_ITC_EXP.1 requires that the TSF shall provide a communication channel between itself and mobile devices that is logically distinct from other communication channels and provides assured identification of its end points and protection of the channel data from modification or disclosure. The TOE shall use a secure communications path between the TOE and administrators provided by the Operational Environment to satisfy FTP_TRP_EXP.1. O.ADMIN The TOE must include a set of functions that allow management of its functions and data, ensuring that TOE users with the appropriate privileges and only those TOE users, may exercise such control. FMT_MOF.1A&B restricts access to TOE management functions. FMT_MSA.1A&B specifies which roles can access security attributes. FMT_MSA.3A&B enforces the User Access Control SFP and Administrator Access Control SFP to provide default values for security attributes that are used to enforce the SFP and who can modify the default values. FMT_SMF.1A&B specifies the management functions the TOE must provide. FMT_SMR.1 requires the TOE to maintain separate Administrator roles. O.AUTHENTICATE_ADMIN The TOE must be able to identify and authenticate administrators prior to allowing access to TOE administrative functions and data. FDP_ACC.1A requires the TOE to enforce the Administrator Access Control SFP. FDP_ACF.1A specifies the attributes used to enforce the Administrator Access Control SFP. FIA_ATD.1.1 defines security attributes of subjects used to enforce the authentication policy of the TOE. FIA_UAU.1A requires Administrators to be authenticated before they are able to perform any other actions. FIA_UID.1 requires Administrators to be identified before they are able to perform any other actions. FIA_USB.1 ensures that user security attributes are associated with subjects acting on the behalf of that user. O.AUTHENTICATE_USER The TOE must be able to identify and authenticate users prior to allowing access to TOE functions and data. FDP_ACC.1B requires the TOE to enforce the User Access Control SFP. FDP_ACF.1B specifies the attributes used to enforce the User Access Control SFP. FIA_AFL.1 ensures that user data is not accessible when the defined number of unsuccessful authentication attempts has been met or surpassed. FIA_ATD.1 defines security attributes of subjects used to enforce the authentication policy of the TOE. FIA_UAU.1B requires users to be authenticated before they are able to perform any other actions. FIA_UID.1 requires users to be identified before they are able to perform COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 36 of 44 any other actions. FIA_USB.1 ensures that user security attributes are associated with subjects acting on the behalf of that user. O.AUDIT The TOE must record the actions taken by administrators and users, and provide reliable timestamps for its own use. FAU_GEN.1 requires that the TOE records relevant commands entered by an Administrator. FAU_GEN.2 requires that the TOE associates events with users. FPT_STM.1 requires that the TOE provide reliable timestamps for its own use. FAU_GEN.1B ensures that diagnostic data is collected on the handheld. O.ACCESS_INT The TOE must be able to identify and authenticate users and administrators prior to allowing access to TOE functions and data. FDP_ACC.1A&B requires the TOE to enforce the Administrator and User Access Control SFP. FDP_ACF.1A&B specifies the attributes used to enforce the Administrator and User Access Control SFP. FIA_AFL.1 ensures that user data is not accessible when the defined number of unsuccessful authentication attempts has been met or surpassed. FIA_ATD.1 defines security attributes of subjects used to enforce the authentication policy of the TOE. FIA_UAU.1A&B requires users and administrators to be authenticated before they are able to perform any other actions. FIA_UID.1 requires users and administrators to be identified before they are able to perform any other actions. FIA_USB.1 ensures that user and administrators security attributes are associated with subjects acting on the behalf of that user. FDP_CDD_EXP.1 ensures that user data on the handheld is erased when the administrator issues the remote wipe command. FDP_ITC.2 requires the TOE to enforce the network perimeter security SFP when importing user data. SFR DEPENDENCIES The table below shows the dependencies of the security functional requirement of the TOE and gives a rationale for each of them. Security functional requirement Dependency Rationale Security Audit (FAU) FAU_GEN.1 Audit data generation FPT_STM.1 Reliable time stamps Included. FAU_GEN.2 User identity association FAU_GEN.1 Audit data generation FIA_UID.1 Timing of identification Included User Data Protection (FDP) FDP_ACC.1 Subset access control FDP_ACF.1 Security attribute based access control Included FDP_ACF.1 Security attribute based access control FDP_ACC.1 Subset access control FMT_MSA.3 Static attribute initialisation Included COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 37 of 44 Security functional requirement Dependency Rationale FDP_ITC.2, Import of user data with security attributes [FDP_ACC.1 Subset access control, or FDP_IFC.1 Subset information flow control] [FTP_ITC.1 Inter-TSF trusted channel, or FTP_TRP.1 Trusted path] FPT_TDC.1 Inter-TSF basic TSF data consistency Included (FDP_ACC.1, FTP_TRP_EXP.1, FTP_TDC.1 and FTP_ITC_EXP.1,) FDP_SWA_EXT.1 Secure Web Access None FDP_CDD_EXP.1 Client Data Deletion None Identification and Authentication (FIA) FIA_AFL.1, Authentication failure handling FIA_UAU.1 Timing of authentication Included FIA_ATD.1 User attribute definition None FIA_UAU.1 Timing of authentication FIA_UID.1 Timing of identification Included FIA_UID.1 Timing of identification None FIA_USB.1 User- subject binding FIA_ATD.1 User attribute definition Included Security Management (FMT) FMT_MOF.1 Management of security functions behaviour FMT_SMF.1 Specification of Management Functions FMT_SMR.1 Security roles Included FMT_MSA.1 Management of security attributes [FDP_ACC.1 Subset access control, or FDP_IFC.1 Subset information flow control] FMT_SMR.1 Security roles FMT_SMF.1 Specification of Management Functions Included (FDP_ACC.1, FMT_SMR.1, FMT_SMF.1) FMT_MSA.3 Static attribute initialisation FMT_MSA.1 Management of security attributes FMT_SMR.1 Security roles Included FMT_SMF.1 Specification of Management Functions None FMT_SMR.1 Security roles FIA_UID.1 Timing of identification Included Protection of the TSF (FPT) FPT_ITT_EXP.1 Basic internal TSF data transfer protection None FPT_STM.1 Reliable time stamps None COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 38 of 44 Security functional requirement Dependency Rationale FPT_TDC.1, Inter- TSF basic TSF data consistency None Trusted Path / Channels (FTP) FTP_ITC_EXP.1, Inter-TSF trusted channel None FTP_TRP_EXP.1 Trusted path None Table 6; Security functional requirements dependency rationale SAR RATIONALE This ST contains the assurance requirements from the CC EAL4 assurance package augmented with ALC_FLR.1. A major market for Good Technology is government agencies. A requirement from several of the government agencies is that we have this level (EAL4+) of Common Criteria certification. 7. TOE SUMMARY SPECIFICATION (ASE_TSS) TOE SECURITY FUNCTIONS SPECIFICATION This section describes the security functions provided by the TOE to meet the security functional requirements specified for the TOE in section 6. List of security functions: • Security_Audit • Userdata_Protection • Identification_Authentication • Security_Management • TSF_Protection • Trusted_Path-Channels SF.SECURITY_AUDIT The TOE provides a capability to generate and view events by recording them in a log file. The GFE Common Criteria Supplement provides details of the log information. This Server log file records the administrative tasks performed by Good Mobile Control Console and Good Messaging Manager Server. It contains auditing information about when the tasks were performed and who performed them. Event messages are recorded in the Windows Event Viewer Application log. This log file records the server’s Exchange/handheld synchronization activity for messages and events. Synchronization error and event messages are recorded in the Windows Event Viewer Application log. The Client log file records diagnostic information. The Client log is stored in non-volatile memory and can be uploaded to the Server for diagnostic purposes. SF_USERDATA_PROTECTION The TOE supports access operation access with the subject attributes administrator roles and user roles. Administrator access to management tasks is restricted based on the COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 39 of 44 assigned administrator role and the options within that role. User access to corporate data is restricted based on the assigned handheld policy. The TOE shall enforce network perimeter security when importing user data from outside of the TOE. Communications between the TOE and Domain Controllers and SQL Servers is protected by the Operational Environment. Clients can be configured to use a secure web browser (Good Mobile Access) to access intranet web sites. All administrators have to be authenticated. Good provides the capability of enforcing role based administration to separate administrative functions if so desired. Administrators can wipe handheld data with a remote wipe command from the Administrator’s console. SF.IDENTIFICATION_AUTHENTICATION Administrator access of the Good servers is not a part of the domain. Therefore administrator access is being authenticated against Active Directory. The Good System offers Role-Based-Administration (RBA) features that allow system- administration permissions to be customized according to the needs and qualifications of each user. By controlling users’ access according to their roles and the associated permissions, RBA provides a tool for managing IT assets and increasing security. The handheld device can be configured with a password. When the handheld device is locked, Good applications will not display any of the user’s data. Access can be restored only by entering the correct password. If an unauthorized user tries to guess the password exceeding the administrator-specified limit, the Good client software can be configured to lock the device or delete all Good application data stored on it. Passwords set on Android control access to the Good application. Passwords set on iPhone can control access to the device or Good application, or both. SF.SECURITY_MANAGEMENT Good Mobile Messaging Server monitors activity in the handheld user’s email, calendar, contacts, tasks, notes, and other folders and relays all changes to the Network Operations Center, where they are queued up and delivered to the handheld. In the same way, handheld activity is passed along to the Exchange or Domino account. Good Mobile Messaging Server can manage synchronization for accounts on multiple Exchange servers in an Exchange Organization. Good Mobile Control Server uses the Exchange Global Address List (GAL) to list, monitor, and manage handheld users across sites. Good Mobile Control Console communicates with Good Mobile Control Server. There must be at least one Good Mobile Control Server installed. A Good Mobile Control Console can communicate with any Good Mobile Messaging Server; where a Console menu item allows specifying which. To access the Console, administrators enter a URL to the Server. Console use is controlled by the roles that are assigned to the administrators who use it. The Good Mobile Control Console is used to assign handhelds to users and to monitor and manage Good Mobile Messaging Servers. The Console manages the Good for Enterprise handhelds and servers, and control and limit the tasks performed by an individual or group using Good Mobile Control Console. The console can be configured so that some individuals and groups can use it only to set up handhelds and not to add or remove COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 40 of 44 users from Good Mobile Messaging Servers, by creating roles for different users and group of users for Good Mobile Control Console. The Administrator role is created with access to all management functions. Administrators may change the default settings to restrict access to management functions. By default, the Administrator role has access to the following management functions: • Handheld rights • Handheld security rights • Manage Mobile Sevice Settings • Server rights • Deployment Rights Administrators create all user accounts with user identifiers and password charcteristics. Handheld user accounts are assigned handheld policies created by the Administrator. Administrators configure handheld policies with the following restrictive default settings as shown in Table 7 - Handheld Policy Settings. Handheld Policy Parameter Setting GFE Password Related Password protected lock screen N Expire password after 60 days Disallow previously used passwords 6 Minimum password length of 8 characters Disallow repeated characters after 1 character Require both letters and numbers Y Require both upper and lower case Y Require at least one special character Y Do not allow sequential numbers Y Lock Screen Protection Require password when idle for more than 15 minutes Take action after __ invalid password attempts 3 Action to take Wipe data Show notifications on lock screen N Allow event reminder details over lock screen N Messaging Do not allow data to be copied from the Good application Y Do not allow data to be copied into the Good application Y Provisioning OTA Pin expires after 3 days Allow OTA PIN reuse N iOS Specific Configuration Enable MDM profile Y Require passcode length of at least 8 char Allow simple value N Alphanumeric Y Enable Remote Wipe Y Maximum failed attempts 3 Android Specific Configuration Enable full device remote wipe Y Enable remote full device lock Y Enable Remote Password reset Y Require passcode with minimum length of 8 char Maximum failed passcode attempts 3 COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 41 of 44 Good Mobile Access (Secure Browser) Enable access to the Intranet Y Table 7 - Handheld Policy Settings Administrators can change the following handheld policy default settings to be more restrictive: • Enable password protected lock screen • Expire password less than 60 days • Disallow previously used passwords greater than 6 • Minimum password length greater than 8 characters • Require password when idle for less than 15 minutes • Take action after less than 3 invalid password attempts • OTA PIN expires in less than 3 days • Require iOS passcode length of greater than 8 characters • Maximum iOS failed attempts less than 3 • Require Android passcode with minimum length of greater than 8 characters • Maximum Android failed passcode attempts less than 3 SF.TSF_PROTECTION Specification of products is described in sections 1.2.2 and 1.2.3, where trusted IT products are Exchange Server5 and Domino Server. Other TOE Environment products described are Primary Domain Controller, and Microsoft SQL Server. Data transmitted from the TSF to another trusted IT product is protected by the Operational Environment from unauthorised disclosure during transmission. TSF data shall be protected when it is transmitted between separate parts of the TOE (GMC to GMM). The Operational environment will provide secured communication mechanisms used by the TOE data types that are transferred including e-mail, attachments, contacts, calendar, and browser. The TOE provides timestamps for the TOE’s use in audit log timestamps. TRUSTED_PATH-CHANNELS The Good System provides an end-to-end system designed to protect corporate information at all times—while it is being transmitted over the wireless network and while it resides on the handheld. The information between Good Mobile Messaging Server and mobile devices is transferred via a secure communications mechanism provided by the Operational Environment and used by the TOE. Connections from the Good Mobile Messaging Server to the Good Network Operations Center use HTTP and are protected by the SSL. Connections to the Good Network Operations Center are used only for sending data to and receiving data from handheld devices. Perimeter security includes: • End-to-end encryption • AES • Reliable message delivery SECURITY FUNCTIONS RATIONALE The table below shows that all TOE security requirements can be traced to at least one TOE security function. 5 Exchange Server 2007 is an evaluated product COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 42 of 44 TOE functional requirements Security audit Userdata_Protection Identification_Authentication Security_Management TSF_Protection Trusted_Path-Channels Security Audit (FAU) FAU_GEN.1 Audit data generation X FAU_GEN.1B Audit data generation – Client X FAU_GEN.2 User identity association X User Data Protection (FDP) FDP_ACC.1A&B Subset access control X FDP_ACF.1A&B Security attribute based access control X FDP_ITC.2, Import of user data with security attributes X FDP_SWA_EXP.1 Secure Web Access X FDP_CDD_EXP.1 Client Data Deletion X Identification and Authentication (FIA) FIA_AFL.1, Authentication failure handling X FIA_ATD.1 User attribute definition X FIA_UAU.1A&B Timing of authentication X FIA_UID.1 Timing of identification X FIA_USB.1 User-subject binding X Security Management (FMT) COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 43 of 44 TOE functional requirements Security audit Userdata_Protection Identification_Authentication Security_Management TSF_Protection Trusted_Path-Channels FMT_MOF.1A&B Management of security functions behaviour X FMT_MSA.1A&B Management of security attributes X FMT_MSA.3A&B Static attribute initialisation X FMT_SMF.1A&B Specification of Management Functions X FMT_SMR.1 Security roles X Protection of the TSF (FPT) FPT_ITT_EXP.1 Basic internal TSF data transfer protection X FPT_STM.1 Reliable time stamps X FPT_TDC.1, Inter-TSF basic TSF data consistency X Trusted Path / Channels (FTP) FTP_ITC_EXP.1, Inter-TSF trusted channel X FTP_TRP_EXP.1 Trusted path X Table 8; Tracing of TOE functional requirements to TOE security functions SF.SECURITY_AUDIT The TOE security function SF.Security_Audit, “The TOE provides a capability to generate and view events by recording them in a log fileâ€, meets the audit requirements FAU_GEN.1 and FAU_GEN.2. Recording diagnostic information on the handhelds is satisfied by FAU_GEN.1B. COMPANY CONFIDENTIAL Good Technology Security Target for Good for Enterprise System 2013-08-07 Version 1.19 Page 44 of 44 SF.USERDATA_PROTECTION The TOE security function SF.Userdata_Protection, “The TOE supports access operation access with the subject attributes administrator roles and user rolesâ€, meets the protection of user data requirements FDP_ACC.1A, FDP_ACC.1B, FDP_ACF.1A, FDP_ACF.1B, FDP_ITC.2, FDP_SWA_EXT.1, and FDP_CDD_EXP.1. SF.IDENTIFICATION_AUTHENTICATION The TOE security function SF.Identification_Authentication, “The Good System offers Role-Based-Administration (RBA) features that allow system-administration permissions to be customized. When the handheld device is locked, Good applications will not display any of the user’s dataâ€, meets the identification and authentication requirements FIA_AFL.1, FIA_ATD.1, FIA_UAU.1A, FIA_UAU.1B, FIA_UID.1 and FIA_USB.1. SF.SECURITY_MANAGEMENT The TOE security function SF.Security_Management, “The Good Mobile Control Console is used to assign handhelds to users and to monitor and manage Good Mobile Messaging Serversâ€, meets the management requirements FMT_MOF.1A, FMT_MOF.1B, FMT_MSA.1A, FMT_MSA.1B, FMT_MSA.3A, FMT_MSA.3B, FMT_SMF.1A. FMT_SMF.1B and FMT_SMR.1. SF.TSF_PROTECTION The TOE security function SF.TSF_Protection, “Data transmitted from the TSF to another trusted IT product is protected by the Operational Environment from unauthorised disclosure during transmission The TOE provides timestamps for the TOE’s useâ€, meets the protection of the TSF requirements FPT_ITT_EXP.1, FPT_STM.1 and FPT_TDC.1. SF.TRUSTED PATH-CHANNELS The TOE security function SF.Trusted Path-Channels, the TOE uses secure communications channel mechanisms provided by the Operational Environment to exchange information with trusted external IT entities meets the Trusted Channel requirements FTP_ITC_EXP.1. The TOE uses secure communications path mechanisms provided by the Operational Environment to transfer data between the Server and Clients meets the trusted path requirement FTP_TRP_EXP.1.