Enhanced Information For Common Criteria Configuration Of [1]; Appendix C Common Criteria; Common Criteria Compliant Configuration - Fidelis Common Criteria Configuration Manual

Enhanced Information for Common Criteria
Configuration of [1]

Appendix C Common Criteria

This appendix
other pertinent information.

Common Criteria Compliant Configuration

K2 and the Fidelis Network module have earned Common Criteria Certification. The following provides
the steps required to create the security configuration used for Common Criteria Certification.
1. During initial setup, make sure that NTP is setup correctly and servers are reachable from the
appliance.
2. Change the default passwords for command line for each appliance by following
Default Account
3. Change the default passwords for admin GUI account (provided in the Quick Start Card) for each
K2.
4. Configure password strength
requirements for failed login attempts.
5. Create a user with system administrator privileges.
6. Log in as the system administrator user and create user accounts for each person who will use the
K2. The admin account should not be used anymore.
7. Ensure that session timeouts are set for command line
Timeout) and GUI access
8. Create a custom login banner. Refer to
9. If you are using LDAP, you must configure it to communicate using TLS. Refer to chapter 13 in the
User Guide.
10. Enable FIPS 140-2 compliant encryption for the K2 database. Refer to
11. Before registering any components, obtain X509 certificates as described in
and install them on the K2
the K2 (Installing Certificates for Inter-Component
12. Enable sending syslog to a remote server over TLS using configuration described in
Authenticationat Security Practices.
13. Enable TLS auditing. At System / Components / K2/ Config / Audit, select everything for TLS
Handshake.
14. To perform system updates, see
hash as a common criteria compliant trusted system update.
Fidelis Network Common Criteria Configuration Guide Version 9.0.3
includes information about the following
Passwords.
(Password Strength
(GUI Session Inactivity
(Installing a K2
Common Criteria Compliant Published Hash
Common Criteria compliant configuration and
Requirements) and account lockout due to
(Command Line Session Inactivity
Timeout).
Custom Login Banner.
Certificate) and all the components being registered to
Communications).
7
Change the
Encrypted Storage.
Security Certificates
Enable Client
on published
www.fidelissecurity.com