DIRECTORY of INFOSEC ASSURED PRODUCTS 2001 CESG DIRECTORY 14/5/01 3:48 Pm Page 2
Total Page:16
File Type:pdf, Size:1020Kb
CESG DIRECTORY 14/5/01 3:48 pm Page 1 DIRECTORY OF INFOSEC ASSURED PRODUCTS 2001 CESG DIRECTORY 14/5/01 3:48 pm Page 2 CONTENTS INTRODUCTION Page 3-4 IACS Introduction to CESG Infosec Assurance and Certification Services Page 5-8 CLEF Contact Details Page 9 International Certification Body Contact Details Page 9 CC and ITSEC Certified Products • Smart Cards Page 10 • PC Access Control Page 11-13 • Operating Systems Page 14-18 • Networking Page 19-24 • Firewalls Page 24-31 • Communications Page 32-37 • Databases Page 38-43 • Miscellaneous Page 43-44 PROTECTION PROFILES Introduction to Protection Profiles Page 45 List of Protection Profiles products Page 46-49 CAPS Introduction to CESG Approved Products Scheme Page 51-52 CAPS products • Data Encryption Page 53-55 • Communications Security Page 55-57 • Access Control Page 58-61 • Miscellaneous Page 62 TEMPEST Introduction to Tempest Page 63 List of Tempest approved products Page 64-66 Company names and addresses Page 67-68 INDEX Page 69-70 2 CESG DIRECTORY 14/5/01 3:48 pm Page 3 INTRODUCTION This ‘Directory of Infosec Assured Products’ is a new publication that replaces the former UKSP-06. It has been produced as a top-level guide for both product developers, vendors and end-users, and gives details of the means by which security products are approved or certified, an overview of the products’ features, and the context in which they should be used. The Directory will be updated on an annual basis. However, as new products are regularly being approved and certified, these will be reflected on CESG’s websites, accessible via www.cesg.gov.uk, as and when they become available. The first part of the Directory contains an introduction to CESG’s Infosec Assurance and Certification Services [IACS]. IACS has been created to provide The Communications-Electronics a seamless service to customers, and Security Group [CESG] is the UK’s products listed in the sections which National Technical Authority for follow cover the various aspects of IACS. Information Security. As part of this It is recognised that, in practice, remit, CESG works closely with IT customers will require more specific developers and vendors to provide guidance. The IACS management office end users with a choice of products has therefore been created to provide whose security features have been advice and guidance to developers, objectively assessed and which vendors and end-users on the most meet clear standards of security appropriate solution to their specific assurance. assurance requirements. This is followed by a description of the mechanisms by which products are certified under ITSEC or Common Criteria, a list of certified products, and an explanation of ‘protection profiles’. Also contained in the Directory is a brief description of the new ‘Fast Track Assessment’ (FTA) service which has been designed to assess IT security products at the specific behest of customers in government. 3 CESG DIRECTORY 14/5/01 3:48 pm Page 4 The Directory next has a section covering the CESG Assisted Products Scheme [CAPS]. This scheme ensures that government and public sector users have access to a wide range of approved products that employ cryptographic security measures. These products have undergone a thorough investigation of the security offered by the cryptography employed, whether this is through implementation of a CESG algorithm or a public domain algorithm. Finally, there is a section containing an introduction to TEMPEST services and a list of TEMPEST certified products. Inevitably, a directory such as this cannot cover all aspects of approved or certified Infosec products and related services. Customers may need more in-depth guidance and advice, and contact details are therefore provided in each of the relevant sections. For any general queries regarding CESG’s wider range of Infosec services, please contact the marketing office, details for which are given on the back page of this directory. 4 CESG DIRECTORY 14/5/01 3:48 pm Page 5 (IACS) Infosec Assurance and Certification Services IACS The IACS approach For Developers… Technical assessors from IACS will work with developers or end users to define the best solution to their assurance requirements. By understanding the developer’s goals, IACS can define the most effective assessment package to achieve them. An assessment package could include: I Internationally recognised CC or ITSEC Certification I Cryptographic approval for HMG and the CNI (usually carried out under CAPS) I Fast Track assessment of products for HMG and the CNI I Systems assessments at all levels for IT products and systems evolve HMG and commerce rapidly and are increasingly diverse and complicated. Similarly, customer For End Users… requirements change and expand to Products which have been certified by counter new threats and to adapt us, or by our partners around the world, to new ways of working. CESG has offer end users ready-made assurance. brought together its assurance Where a Government or CNI customer services under IACS to offer has a requirement for assurance in an bespoke solutions to these uncertified product, we can perform a new security challenges. Fast Track Assessment. This allows the customer to determine whether the product is appropriate for his needs. If assurance is required in a system, then a range of packages, including IT Health Check, is available. www.cesg.gsi.gov.uk e-mail: [email protected] IACS Management Office PO Box 152 Cheltenham Gloucestershire GL52 5UF Tel. +44 (0)1242 238739 Fax: +44 (0)1242 235233 5 CESG DIRECTORY 14/5/01 3:48 pm Page 6 Formal Evaluation and Certificate Maintenance Scheme Certification Evaluation results only apply to a The products within this section have specific version of a product, and any been certified against either Common subsequent changes (including patches, Criteria or IT Security Evaluation Criteria hot fixes and service packs) to that (ITSEC). Certificates are awarded product may invalidate those results following extensive testing of the and, therefore, the Certificate. Because product’s IT security features to ensure the evolution of products is so rapid, that those features meet an agreed the Certificate Maintenance Scheme Security Target. Results of a successful (CMS) has been devised in response. evaluation are published in a CMS provides a means of maintaining Certification Report. This contains the same level of assurance in a product additional information and advice on after certification without the need for how the certified product should be re-evaluation. used and any restrictions that may apply in its configuration or use on specific ITSEC platforms. Prospective purchasers of ITSEC is the set of criteria used for the certified products should read both the past decade by Europe and Australasia ST and the CR to ensure that the for the evaluation of products and product is suitable. STs and CRs are systems. ITSEC was a major building available from the developers and, in block in the formulation of the addition, can usually be downloaded Common Criteria. from the CESG web site. Common Criteria What is a Security Target? CC represents the outcome of international efforts to align and This is a document specifying the develop the existing European and security functionality of a product and North American criteria and has been the assurance level against which it is ratified as ISO standard 15408. The evaluated as well as a description approximate assurance correspondence relating the product to the environment between ITSEC and CC is shown below. in which it will operate. A fuller description of the testing carried out at each assurance level is contained Vulnerabilities on the web site. Certification is not a guarantee of freedom from security vulnerabilities; Common Criteria ITSEC there remains a possibility that exploitable vulnerabilities may be EAL1 – discovered after a Certificate has been EAL2 E1 awarded. Users and prospective EAL3 E2 purchasers should check regularly whether any security vulnerabilities have EAL4 E3 been discovered since certification and, EAL5 E4 if appropriate, should check with the EAL6 E5 vendor to see if any patches exist for the product. EAL7 E6 6 CESG DIRECTORY 14/5/01 3:48 pm Page 7 International Mutual Recognition on products which have been assessed Developers whose products are certified elsewhere. Links are available from the against ITSEC or CC enjoy the benefits of CESG web site and contact details for an internationally recognised Certificate. the other recognised Certification Bodies In this brochure we detail only those appear on page 9. products which have been evaluated in HMG Departments wishing to use the UK, but end users should access the foreign certified products in other relevant national web sites to environments where national security is obtain the most up to date information an issue are advised to consult CESG. Our Certificates are currently recognised as follows: Assurance Levels Recognised Evaluation – CESG working Australia & ITSEC E1-E6 with industry New Zealand CC EAL1-4 Formal evaluation in the UK is carried Canada out by independent testing laboratories Israel CC EAL1-4 known as CLEFs which are appointed by USA the Certification Body in CESG. CLEFs meet rigorous security and ISO/IEC France 17025 quality standards. The UK has 5 Finland CLEFs, which can be contracted to carry out both evaluation and preparatory Germany consultancy work. CLEF contact details Greece are on page 9. Italy ITSEC E1-E6 The results of the testing of the product Netherlands