Dell EMC NetWorker 9 - Common Criteria

Dell EMC NetWorker 9.1Security TargetTOE ComponentSupporting Softwareand Operating SystemSupporting HardwareLinux ClientRed Hat Enterprise Linux6.6General PurposeComputing HardwareTable 1 – TOE Components and Non-TOE Hardware and Software1.5.3TOE GuidanceThe TOE includes the following guidance documentation: EMC NetWorker Version 9.1 Installation Guide EMC NetWorker Version 9.1 Administration Guide EMC NetWorker Version 9.1 Command Reference Guide EMC NetWorker Version 9.1 Security Configuration Guide EMC NetWorker Version 9.1 Error Message Guide1.5.4Logical ScopeThe logical boundary of the TOE includes all interfaces and functions within thephysical boundary. The logical boundary of the TOE may be broken down by thesecurity function classes described in Section 6. Table 2 summarizes the logicalscope of the TOE.Functional ClassesDescriptionSecurity AuditAudit entries are generated for security related events. Theaudit logs are stored and protected from unauthorizedmodification and deletion.User Data ProtectionThe TOE provides a role-based access control capability toensure that only authorized administrators are able toadminister the TOE. The TOE provides backup and recoveryfunctionality.Identification andAuthenticationUsers must identify and authenticate prior to gaining TOEaccess.Security ManagementThe TOE provides management capabilities via a WebBased GUI and through a CLI. Management functions allowthe administrators to perform system configuration, usermanagement, and backup and recovery operations.Protection of the TSFA retention setting may be applied to save sets indicatingthe date before which the save set may not be deleted.TOE AccessA banner is presented on user login to the NMC.Table 2 – Logical Scope of the TOEDoc No: 1986-000-D102Version: 1.2Date: 10 July 2017Page 7 of 36

Dell EMC NetWorker 9.1Security Target1.5.5Functionality Excluded from the EvaluatedConfigurationThe following features are excluded from this evaluation: Although NetWorker supports backup and recovery from many differentplatforms, only Windows and Linux were evaluated. Integration with other EMC products was not evaluated.Doc No: 1986-000-D102Version: 1.2Date: 10 July 2017Page 8 of 36

Dell EMC NetWorker 9.1Security Target2 CONFORMANCE CLAIMS2.1COMMON CRITERIA CONFORMANCE CLAIMThis Security Target claims to be conformant to Version 3.1 of Common Criteriafor Information Technology Security Evaluation according to: Common Criteria for Information Technology Security Evaluation, Part 1:Introduction and General Model; CCMB-2012-09-001, Version 3.1,Revision 4, September 2012 Common Criteria for Information Technology Security Evaluation, Part 2:Security Functional Components; CCMB-2012-09-002, Version 3.1,Revision 4, September 2012 Common Criteria for Information Technology Security Evaluation, Part 3:Security Assurance Components CCMB-2012-09-003, Version 3.1,Revision 4, September 2012As follows: CC Part 2 conformant CC Part 3 conformantThe Common Methodology for Information Technology Security Evaluation,Version 3.1, Revision 4, September 2012 has to be taken into account.2.2ASSURANCE PACKAGE CLAIMThis Security Target claims conformance to Evaluation Assurance Level (EAL) 2augmented with ALC FLR.2 Flaw Reporting Procedures.2.3PROTECTION PROFILE CONFORMANCECLAIMThis ST does not claim conformance of the TOE with any Protection Profile.Doc No: 1986-000-D102Version: 1.2Date: 10 July 2017Page 9 of 36

Dell EMC NetWorker 9.1Security Target3 SECURITY PROBLEM DEFINITION3.1THREATSTable 3 lists the threats addressed by the TOE. Potential threat agents areauthorized TOE users, and unauthorized persons. The level of expertise of bothtypes of attacker is assumed to be unsophisticated. TOE users are assumed tohave access to the TOE, extensive knowledge of TOE operations, and to possessa high level of skill. They have moderate resources to alter TOE parameters, butare assumed not to be wilfully hostile. Unauthorized persons have littleknowledge of TOE operations, a low level of skill, limited resources to alter TOEparameters and no physical access to the TOE.Mitigation to the threats is through the objectives identified in Section 4.1,Security Objectives for the TOE.ThreatDescriptionT.DATALOSSA user or system failure may cause the loss of critical user dataresulting in users being unable to continue their work.T.UNAUTHAn unauthorized user may be able to view recovery files or accesssecurity management functions, resulting in unauthorized access touser data.T.UNDETECTAuthorized or unauthorized users may be able to access TSF or userdata or modify TOE behaviour without a record of those actions inorder to circumvent TOE security functionality.Table 3 – Threats3.2ORGANIZATIONAL SECURITY POLICIESThere are no Organizational Security Policies applicable to this TOE.3.3ASSUMPTIONSThe assumptions required to ensure the security of the TOE are listed in Table 5.AssumptionsDescriptionA.LOCATEThe TOE will be located within controlled access facilities, whichwill prevent unauthorized physical access.A.MANAGEThere are one or more competent individuals assigned tomanage the TOE.A.NOEVILThe authorized administrators are not careless, wilfully negligent,or hostile, are appropriately trained and will follow theinstructions provided by the TOE documentation.Doc No: 1986-000-D102Version: 1.2Date: 10 July 2017Page 10 of 36

Dell EMC NetWorker 9.1Security TargetAssumptionsDescriptionA.TIMEThe operational environment provides the TOE with reliabletimestamps.Table 4 – AssumptionsDoc No: 1986-000-D102Version: 1.2Date: 10 July 2017Page 11 of 36

Dell EMC NetWorker 9.1Security Target4 SECURITY OBJECTIVESThe purpose of the security objectives is to address the security concerns and toshow which security concerns are addressed by the TOE, and which areaddressed by the environment. Threats may be addressed by the TOE or thesecurity environment or both. Therefore, CC identifies two categories of securityobjectives: Security objectives for the TOE Security objectives for the environment4.1SECURITY OBJECTIVES FOR THE TOEThis section identifies and describes the security objectives that are to beaddressed by the TOE.SecurityObjectiveDescriptionO.ADMINThe TOE will provide all the functions necessary to support theadministrators in their management of the security of the TOE.The TOE must advise users of possible unauthorized use, andrestrict security management functions from unauthorized use.O.AUDITThe TOE must record audit records for use of the TOE functions,and must protect the stored audit records to preventunauthorized modification or removal.O.BACKUPThe TOE must implement backup and recovery functionality thatrestricts access to backed-up data to owners and authorizedadministrators.O.IDENTAUTHThe TOE must be able to ensure that users are identified andauthenticated prior to gaining access to the administrativefunctions, TSF data or user data.Table 5 – Security Objectives for the TOE4.2SECURITY OBJECTIVES FOR THEOPERATIONAL ENVIRONMENTThis section identifies and describes the security objectives that are to beaddressed by the IT environment or by non-technical or procedural means.Doc No: 1986-000-D102Version: 1.2Date: 10 July 2017Page 12 of 36

Dell EMC NetWorker 9.1Security TargetSecurityObjectiveDescriptionOE.MANAGEThose responsible for TOE deployment will provide competentadministrators who are appropriately trained and follow allguidance.OE.PROTECTThose responsible for the TOE must ensure that TOEcomponents are protected from interference, tampering andphysical attack.OE.TIMEThe operational environment must provide reliable timestampsfor use by the TOE.Table 6 – Security Objectives for the Operational Environment4.3SECURITY OBJECTIVES O.ADMINT.UNAUTHT.DATALOSSThe following table maps the security objectives to the assumptions, threats,and organizational policies identified for the TOE.XOE.TIMEXTable 7 – Mapping Between Objectives, Threats, OSPs, and Assumptions4.3.1Security Objectives Rationale Related toThreatsThe security objectives rationale related to threats traces the security objectivesfor the TOE back to the threats addressed by the TOE.Threat:A user or system failure may cause the loss of critical user dataDoc No: 1986-000-D102Version: 1.2Date: 10 July 2017Page 13 of 36

Dell EMC NetWorker 9.1Security TargetT.DATALOSSresulting in users being unable to continue their work.Objectives:O.BACKUPRationale:O.BACKUP mitigates the threat by ensuring that the TOE providesbackup and recovery functionality that affords access to criticaluser data even if the original data is lost.Threat:T.UNAUTHAn unauthorized user may be able to view recovery files or accesssecurity management functions, resulting in unauthorized access touser data.Objectives:O.ADMINThe TOE will provide all the functionsnecessary to support the administrators intheir management of the security of the TOE.The TOE must advise users of possibleunauthorized use, and restrict securitymanagement functions from unauthorized use.O.IDENTAUTHThe TOE must be able to ensure that users areidentified and authenticated prior to gainingaccess to the administrative functions, TSFdata or user data.Rationale:The TOE must implement backup and recoveryfunctionality that restricts access to backed-updata to owners and authorized administrators.O.ADMIN mitigates this threat by ensuring that only authorizedadministrators may access security management functions of theTOE.O.IDENTAUTH mitigates this threat by ensuring that administratorsand users are identified and authenticated prior to being grantedaccess to security management functions or user data.Threat:T.UNDETECTAuthorized or unauthorized users may be able to access TSF oruser data or modify TOE behaviour without a record of thoseactions in order to circumvent TOE security functionality.Objectives:O.AUDITRationale:O.AUDIT mitigates this threat by ensuring audit records are createdto make note of access to TSF and user data.Doc No: 1986-000-D102Version: 1.2The TOE must record audit records for use ofthe TOE functions, and must protect thestored audit records to prevent unauthorizedmodification or removal.Date: 10 July 2017Page 14 of 36

Dell EMC NetWorker 9.1Security Target4.3.2Security Objectives Rationale Related toAssumptionsThe security objectives rationale related to assumptions traces the securityobjectives for the operational environment back to the assumptions for theTOE’s operational environment.Assumption:A.LOCATEThe TOE will be located within controlled access facilities, which willprevent unauthorized physical access.Objectives:OE.PROTECTRationale:OE.PROTECT supports this assumption by protecting TOEcomponents from physical attack.Assumption:There are one or more competent individuals assigned to managethe TOE.A.MANAGEThose responsible for the TOE must ensurethat TOE components are protected frominterference, tampering and physical attack.Objectives:OE.MANAGERationale:OE.MANAGE supports this assumption by ensuring that competent,trained individuals who follow guidance are in place to manage theTOE.Assumption:A.NOEVILThe authorized administrators are not careless, wilfully negligent,or hostile, are appropriately trained and will follow the instructionsprovided by the TOE AGE supports this assumption by ensuring that theindividuals managing the TOE are competent, trained and follow allguidance.Assumption:The operational environment provides the TOE with reliabletimestamps.A.TIMEObjectives:OE.TIMEDoc No: 1986-000-D102Version: 1.2Those responsible for TOE deployment willprovide competent administrators who areappropriately trained and follow all guidance.Those responsible for TOE deployment willprovide competent administrators who areappropriately trained and follow all guidance.The operational environment must providereliable timestamps for use by the TOE.Date: 10 July 2017Page 15 of 36

Dell EMC NetWorker 9.1Security TargetRationale:OE.TIME supports this assumption by ensuring that the operationalenvironment provides reliable timestamps.Doc No: 1986-000-D102Version: 1.2Date: 10 July 2017Page 16 of 36

Dell EMC NetWorker 9.1Security Target5 EXTENDED COMPONENTS DEFINITION5.1 SECURITY FUNCTIONAL REQUIREMENTSThis ST does not include extended Security Functional Requirements.5.2SECURITY ASSURANCE REQUIREMENTSThis ST does not include extended Security Assurance Requirements.Doc No: 1986-000-D102Version: 1.2Date: 10 July 2017Page 17 of 36

Dell EMC NetWorker 9.1Security Target6 SECURITY REQUIREMENTSSection 6 provides security functional and assurance requirements that must besatisfied by a compliant TOE. These requirements consist of functionalcomponents from Part 2 of the CC, and an Evaluation Assurance Level (EAL) thatcontains assurance components from Part 3 of the CC.6.1CONVENTIONSThe CC permits four types of operations to be performed on functionalrequirements: selection, assignment, refinement, and iteration. Theseoperations, when performed on requirements that derive from CC Part 2, areidentified in this ST in the following manner: Selection: Indicated by surrounding brackets, e.g., [selected item]. Assignment: Indicated by surrounding brackets and italics, e.g., [assigneditem]. Refinement: Refined components are identified by using bold foradditional information, or strikeout for deleted text. Iteration: Indicated by assigning a number in parenthesis to the end ofthe functional component identifier as well as by modifying the functionalcomponent title to distinguish between iterations, e.g., ‘FDP ACC.1(1),Subset access control (administrators)’ and ‘FDP ACC.1(2) Subset accesscontrol (devices)’.6.2TOE SECURITY FUNCTIONAL REQUIREMENTSThe security functional requirements for this ST consist of the followingcomponents from Part 2 of the CC, and are summarized in Table 9 - Summary ofSecurity Functional Requirements.ClassIdentifierNameSecurity Audit (FAU)FAU GEN.1Audit data generationFAU STG.1Protected audit trail storageFDP ACC.1(1)Subset access control (RBAC)FDP ACC.1(2)Subset access control (Backup andRecovery)FDP ACF.1(1)Security attribute based access control(RBAC)FDP ACF.1(2)Security attribute based access control(Backup and Recovery)FIA UAU.2User authentication before any actionVersion: 1.2Date: 10 July 2017User Data Protection(FDP)Identification andDoc No: 1986-000-D102Page 18 of 36

Dell EMC NetWorker 9.1Security TargetClassAuthentication (FIA)Security Management(FMT)TOE Access (FTA)IdentifierNameFIA UID.2User identification before any actionFMT MSA.1(1)Management of security attributes (RBAC)FMT MSA.1(2)Management of security attributes (Backupand Recovery)FMT MSA.3(1)Static attribute initialisation (RBAC)FMT MSA.3(2)Static attribute initialisation (Backup andRecovery)FMT SMF.1Specification of Management FunctionsFMT SMR.1Security rolesFTA SSL.3TSF-initiated terminationFTA TAB.1Default TOE access bannersTable 8 – Summary of Security Functi

Dell EMC NetWorker 9.1 . Server allows to be simultaneously active for the purposes of backup or recovery. Data lifecycle operations require that the server routinely compare the age and status of stored data with policies specified by the administrator, and take the actio