Fidelis Network Common Criteria Configuration Guide Version 9.0.3
7
www.fidelissecurity.com
Enhanced Information for Common Criteria
Configuration of [1]
Appendix C Common Criteria
This
appendix
includes information about the following
Common Criteria compliant configuration and
other pertinent information.
Common Criteria Compliant Configuration
K2 and the Fidelis Network module have earned Common Criteria Certification. The following provides
the steps required to create the security configuration used for Common Criteria Certification.
1. During initial setup, make sure that NTP is setup correctly and servers are reachable from the
appliance.
2. Change the default passwords for command line for each appliance by following
Change the
Default Account Passwords
.
3. Change the default passwords for admin GUI account (provided in the Quick Start Card) for each
K2.
4. Configure password strength (
Password Strength Requirements
) and account lockout due to
requirements for failed login attempts.
5. Create a user with system administrator privileges.
6. Log in as the system administrator user and create user accounts for each person who will use the
K2. The admin account should not be used anymore.
7. Ensure that session timeouts are set for command line (
Command Line Session Inactivity
Timeout
) and GUI access (
GUI Session Inactivity Timeout
).
8. Create a custom login banner. Refer to
Custom Login Banner
.
9. If you are using LDAP, you must configure it to communicate using TLS. Refer to chapter 13 in the
User Guide
.
10. Enable FIPS 140-2 compliant encryption for the K2 database. Refer to
Encrypted Storage
.
11. Before registering any components, obtain X509 certificates as described in
Security Certificates
and install them on the K2 (
Installing a K2 Certificate
) and all the components being registered to
the K2 (
Installing Certificates for Inter-Component Communications
).
12. Enable sending syslog to a remote server over TLS using configuration described in
Enable Client
Authentication
at Security Practices.
13. Enable TLS auditing. At System / Components / K2/ Config / Audit, select everything for TLS
Handshake.
14. To perform system updates, see
Common Criteria Compliant Published Hash
on published
hash as a common criteria compliant trusted system update.
