See attached for reply needed
Due Sep 8th
Reply needed 1 In response to product evaluation based on the Common Criteria, I focused my search on operating systems looking specifically at Red Hat Enterprise Linux 7.6. As it is necessary to evaluate potential OS candidates to be the base of the software platform provided to customers, Red Hat is the primary candidate. While auditing various operating systems it was determined that by using the Common Criteria as our basis, we would gain greater assurance whether our final choice is in keeping with compliance standards and provides a high level of security. This is crucial as we are able to first determine our security and assurance requirements, and then find an OS vendor that meets those benchmarks. According to Nancy Mead of CISA, “The Common Criteria contain a grouping of 60 security functional requirements in 11 classes. This grouping allows specific classes of requirements to be evaluated in a standard way in order to arrive at an Evaluation Assurance Level” (2006). By using the Common Criteria, we can match our requirements with industry standards, along with customer specifications, and adapt to other OS’s if necessary. However, after an extensive review, the primary OS chosen was Red Hat Enterprise Linux 7.6.
Per the Common Criteria evaluation, the Security Target report first determined the level of protection in using Red Hat. It highlighted specific conformance to:
· Protection Profile for General Purpose Operating Systems, Version 4.2.1 [GPOSPP]
· Extended Package for Secure Shell (SSH), Version 1.0 [SSHEP]
Both pieces were important to our internal evaluation as the Protection Profile identifies key threats an OS is expected to address, and the SSH package was a requirement for customers to access their system as needed. The SSH portion also provided a look into the cryptographic protocols used and the conformance to specified standards. Additionally, user data protection is addressed through Discretionary Access Control (DAC) and by implementing Access Control Lists (ACLs) with varying discretion. Identification and Authentication are also accounted for with Red Hat, providing all forms of interactive login. All of these are essential components for an OS being used as part of the underlying architecture of a software platform such as ours. Lastly, the report provided great detail into the security assurance measures in which Red Hat satisfies. They identify how such measures will be met, such as vulnerability analysis and life cycle support (Acumen Security, LLC, 2020).
Finally, after an extensive review of the Security Target report, the Validation Report was the focus before final sign-off on the OS. As the document describes, “This Validation Report (VR) is intended to assist the end-user of this product and any security certification Agent for that end user in determining the suitability of this Information Technology (IT) product for their environment” (Durrant et al., 2020). The VR describes the testing and evaluation of claims presented in the Security Target, making a review of both reports essential. Per the results section of the report, it was determined that the Security Target, Development Documentation, Guidance Documents, Life Cycle Support Activities, Test Documentation and the Test Activity, and Vulnerability Assessment Activity were all in proper standing with the Red Hat Enterprise Linux 7.6 operating system. As an overall evaluation of results, it was determined that the OS met all claims presented in the Security Target. Red Hat was provided the CCRA Certificate, issued on 07/17/2020, and deemed PP (Protection Profile) compliant (Durrant et al., 2020). Therefore, Red Hat was chosen as the primary OS to support our software platform.
Accuman Security, LLC. (2020, June). Red Hat Enterprise Linux 7.6 Security Target. https://www.commoncriteriaportal.org/files/epfiles/st_vid11039-st.pdf.
Collins, M. (1998). Formal methods. Carnegie Mellon University. https://users.ece.cmu.edu/~koopman/des_s99/formal_methods/.
Durrant, S., Butterworth, J., Dotson, J., Carlson, M., Bicknell, P., & Morrison, L. (2020, July 7). Validation report for the Red Hat Enterprise Linux Version 7.6, version 1.0. Common Criteria Evaluation and Validation Scheme. https://www.commoncriteriaportal.org/files/epfiles/st_vid11039-vr.pdf.
Eberly, W. (1997). CPS 333: Introduction to formal methods for software development. University of Calgary. http://pages.cpsc.ucalgary.ca/~eberly/Courses/CPSC333/Lectures/Formal_Methods/intro.html.
Mead, N. (2006, August 10). The common criteria. Cybersecurity & Infrastructure Security Agency. https://us-cert.cisa.gov/bsi/articles/best-practices/requirements-engineering/the-common-criteria.
Massachusetts Institute of Technology. (n.d.). Introducing formal methods. https://web.mit.edu/16.35/www/lecturenotes/FormalMethods.pdf.
Reply 2 Needed:
Chosen Product: NetIQ Identity Manager 4.7
The above product provides data sharing and synchronization services that allow the sharing of information between applications, directories, and databases. It offers the foundation for account provisioning, security, authentication among other services by allowing integration, management, and control of distribution identity information for it to be securely delivered to the right destination. Its evaluation assurance level is EAL3 + ALC_FLR.2 with a common criteria version of 3.1 release 5 (Svensson, 2015). The evaluator of the product focused on the repetition of the developer’s test cases and penetration testing. This is because all its security functional requirements had already been tested by the developer.
The security requirements for NetIQ Identity Manager 4.7 meet my set standards and they include the following. First, the product manages data such that it provides a means to manage the secrets and all the data relating to remote IT systems. Secondly, the product manages policy such that it provides a workflow that helps in managing authentication and access to all control policies. Lastly, NetIQ Identity Manager 4.7 assures of providing cryptographic mechanisms that help in protecting passwords through cryptographic steps and processes such as generating and destroying keys. Additionally, the product passes on all the assurance requirements including development, guidance documents, and life-cycle support. Under development assurance, it assures security, functional specifications with a complete summary as well as an architectural design. For guidance documents, the product assures of operational user guidance and preparative procedures that ensure the end-user has no difficulty in operating the product. Lastly, under life-cycle support, it assures authorization controls, implementation representation, delivery procedures, flaw reporting procedures among others that assures the end-user long-term service from the product.
Svensson, H. (2015). Certification Report NetIQ® Identity Manager 4.7. Commoncriteriaportal.org. Retrieved 2 September 2020, from https://www.commoncriteriaportal.org/files/epfiles/Certification%20Report%20-%20NetIQ%C2%AE%20Identity%20Manager%204.7.pdf.
Gartenstein, D. (2019). What Are the Advantages and Disadvantages of Evaluation Forms?. Bizfluent. Retrieved 2 September 2020, from https://bizfluent.com/info-8595898-advantages-disadvantages-evaluation-forms.html.