WIXLIB

Xerox WorkCentre 7525/7530/7535/7545/7556 Security Targetowner; after a reboot; once the TOE is turned back on after a powerfailure/unorderly shutdown; or on demand of the TOE system administrator.The optional Xerox Embedded Fax accessory provides analog FAX capabilityover Public Switched Telephone Network (PSTN) connections and also enablesLanFax jobs, if purchased by the consumer.Xerox’s Workflow Scanning Accessory is part of the TOE configuration. Thisaccessory allows documents to be scanned at the device with the resultingimage being sent via email, transferred to a remote file repository, kept in aprivate (scan) mailbox or placed on to a personal USB storage device.All models of the TOE support auditing. The TOE generates audit logs thattrack events/actions (e.g., print/scan/fax job submission) to identified users.The audit logs, which are stored locally in a 15000 entry circular log, areavailable to TOE administrators and can be exported for viewing and analysis.SSL must be configured in order for the system administrator to download theaudit records; the downloaded audit records are in comma separated formatso that they can be imported into an application such as Microsoft Excel .All models of the TOE support network security. The system administrator canenable and configure the network security support. Filtering rules can bespecified for IPv4 based on both address and port number. Additional securitysupport is provided in the form of secure network communication protocolssupported. SSL support is available for protecting communication over theWeb User Interface (Web UI). SSL may be used for protecting documenttransfers to the remote file depository. IPSec support is available for protectingcommunication over IPv4 and IPv6. Kerberos or SSL support are available forprotecting communication in support of remote authentication.The TOE controls and restricts the information flow from the externalinterfaces to the network controller (which covers the information flow to andfrom the internal network).The TOE requires users and system administrators to authenticate beforegranting access to user (copy, print, fax etc) or system administration functionsvia the Web User Interface (Web UI) or the Local User Interface (LUI). Theuser or system administrator must enter a username and password at eitherthe Web User Interface or the Local User Interface. The password will beobscured2 as it is being entered. The TOE provides for user identification andauthorization as configured by the system administrator.The TOE restricts (normal) users’ access to the documents. A user can onlyaccess his/her own documents.The TOE can integrate with an IPv4 or IPv6 network with native support fordhcp/dhcpv6.2The LUI obscures input with the asterisk character. The specific character used to obscure input at the WebUI isbrowser dependent.10 Copyright 2011 Xerox Corporation, All rights reserved

Xerox WorkCentre 7525/7530/7535/7545/7556 Security TargetThe TOE supports the Common Access Card (CAC) standard and othermethods (refer to chapter 1.3.2.3) for remote authentication.1.2.2. TOE TypeThe TOE is a multi-function device (MFD) that provides copy and print(monochrome and color), document scanning (monochrome and color) andoptional FAX services.1.2.3. Required Non-TOE Hardware, Software and FirmwareThe TOE does not require any additional hardware, software or firmware inorder to function as a multi-function device, however, the network security andfax flow features are only useful in environments where the TOE is connectedto a network or PSTN. TSF NET ID is only available when one of the followingremote authentication services is present on the network that the TOE isconnected to: LDAP or Kerberos. CAC based TSF NET ID requires CACcompliant smart cards and smart card readers.1.3.TOE DescriptionThis section provides context for the TOE evaluation by identifying the logicaland physical scope of the TOE, as well as its evaluated configuration.1.3.1. Physical Scope of the TOETheTOEisaMulti-FunctionDevice(XeroxWorkCentre 7525/7530/7535/7545/7556) that consists of a printer, copier, scanner, FAX(when purchased by the consumer), and email, as well as all Administrator andUser guidance. The difference between the models is their printing speed. Thehardware included in the TOE is shown in Figure 2 above. The optional FAXcard is not shown in this figure3.The various software and firmware (“Software”) that comprise the TOE arelisted in Table 2. A system administrator can ensure that they have a TOE byprinting a configuration sheet and comparing the version numbers reported onthe sheet to the table below.3For installation, the optional FAX card must be fitted into the machine. After powering on the machine, the FaxInstall window pops up on the Local UI with step by step instructions for installation.11 Copyright 2011 Xerox Corporation, All rights reserved

Xerox WorkCentre 7525/7530/7535/7545/7556 Security TargetTable 2: Evaluated Software/Firmware versionSoftware/Firmware ItemWorkCentre 7525/7530/7535/7545/7556System Software061.121.221.28308Network Controller Software061.121.25025User Interface Software061.121.24120Marking Engine Software (Options)- WC 7525/7530/7535081.077.000- WC 7545/7556082.077.000Copy Controller Software061.121.24121Document Feeder Software (DADH)007.008.050Finisher Software (Options)- A-Finisher013.000.000- C-Finisher032.042.000- SB-Finisher005.009.000Fax Software003.010.004Scanner Software030.141.115NOTE: For the remainder of this Security Target, the terms “NetworkController” and “Copy Controller” will refer to the “Network Controller” and“Copy Controller” software components of the “Controller” subsystem.A customer of the TOE can determine whether the Xerox Embedded Faxaccessory, Xerox Workflow Scan accessory and Image Overwrite SecurityPackage4 are installed by reviewing the TOE configuration report. A consumerof the TOE can also determine that they have the evaluated version of the TOEby reviewing the TOE configuration report and comparing the version numbersto the content of Table 2, above.The Administrator and User guidance included in the TOE are listed in Table 3.A system administrator or user can ensure that they have the appropriate4Xerox Embedded Fax accessory, Xerox Workflow Scan accessory and Image Overwrite Security Package are a part ofthe Network Controller or Copy Controller software package and do not have individual version identifiers.12 Copyright 2011 Xerox Corporation, All rights reserved

Xerox WorkCentre 7525/7530/7535/7545/7556 Security Targetguidance by comparing the software version number to the version numberslisted in the table below.Table 3: System User and Administrator GuidanceTitle Xerox WorkCentre 7500 SeriesSystem Administrator Guide v1.0Document NumberNoneDateSeptember 2010NoneSeptember 2010NoneDecember 2011Xerox WorkCentre 7500 SeriesUser Guide v1.0Secure Installation and Operationof Your WorkCentre 7525/7530/7535/7545/7556 v1.3The TOE’s physical interfaces include a power port, an Ethernet port, USB ports,serial ports, FAX ports (if the optional FAX card is installed), Local UserInterface (LUI) with keypad, a document scanner, a document feeder and adocument output.1.3.2. Logical Scope of the TOEThe logical scope of the TOE includes all software and firmware that areinstalled on the product (see Table 2). The TOE logical boundary is composedof the security functions provided by the product.The following security functions are controlled by the TOE: Image Overwrite (TSF IOW)Authentication (TSF AUT)Network Identification (TSF NET ID)Security Audit (TSF FAU)Cryptographic Operations (TSF FCS)User Data Protection – IP Filtering (TSF FDP FILTER)Network Security (TSF NET SEC)Information Flow Security (TSF FLOW)Security Management (TSF FMT)User Data Protection – Disk Encryption (TSF FDP UDE)1.3.2.1.Image Overwrite (TSF IOW)The TOE has an “Immediate Image Overwrite” (IIO) function that overwritesfiles created during job processing. This IIO process automatically starts for allabnormally terminated copy, print, scan or fax jobs stored on the HDD prior tocoming “on line” when any of the following occurs: a reboot or once the MFDis turned back on after a power failure/unorderly shutdown.The TOE also has an “On-Demand Image Overwrite” (ODIO) function thatoverwrites the hard drive(s) on-demand of the system administrator. The13 Copyright 2011 Xerox Corporation, All rights reserved

Xerox WorkCentre 7525/7530/7535/7545/7556 Security TargetODIO function operates in two modes: full ODIO and standard ODIO. Astandard ODIO overwrites all files written to temporary storage areas of theHDD. A full ODIO overwrites those files as well as the Fax mailbox/dialdirectory and Scan-to-mailbox data.Contents stored on the hard disk are overwritten using a three pass overwriteprocedure.1.3.2.2.Authentication (TSF AUT)A user must authenticate by entering a username and password prior to beinggranted access to the Local UI or the Web UI. While the user is typing thepassword, the TOE obscures5 each character entered.Upon successful authentication, users are granted access based on their roleand predefined privileges. Only a system administrator is allowed full access tothe TOE including all the system administration functions. Each common user’saccess is determined by which function (copy, scan, print, fax etc.) they havepermission for.If configured for local authentication the system requires the systemadministrator to enter a username and password for each user. The systemwill authenticate the user against an internal database.By default, the Local UI will terminate any session that has been inactive for 1minutes. By default, the Web UI will terminate any session that has beeninactive for 60 minutes. The system administrator can configure both theLocal UI and Web UI session timeouts to terminate an inactive session aftersome other period of time.1.3.2.3.Network Identification (TSF NET ID)As an alternative to TSF AUT, the TOE allows user name and password for auser to be validated by a designated authentication server (a trusted remoteIT entity). The user is not required to login to the network; account informationentered at Local UI or Web UI of the TOE is authenticated at the serverinstead of the TOE. The remote authentication services6 supported by the TOEinclude: CAC authentication, LDAP v4, Kerberos v5 (Solaris) and Kerberos v5(Windows 2000/2003).The TOE maintains the username from a successful authentication during thecontext of the job, and this value is entered into the audit log as the username.5The LUI obscures input with the asterisk character. The specific character used to obscure input at the WebUI isbrowser dependent6User account (authorization privilege) information can be maintained locally by the TOE or at the remoteauthentication server without impacting how a user session is presented or controlled; however, the use of remoteauthentication servers for this purpose is outside the scope of this evaluation.14 Copyright 2011 Xerox Corporation, All rights reserved

Xerox WorkCentre 7525/7530/7535/7545/7556 Security Target1.3.2.4.Security Audit (TSF FAU)The TOE generates audit logs that track events/actions (e.g.,copy/print/scan/fax job completion) to identified users. The audit logs, whichare stored locally in a 15000 entry circular log, are available to TOEadministrators and can be exported for viewing and analysis.

ST Title: Xerox WorkCentre 7525/7530/7535/7545/7556 Security Target ST Version: 1.0 Revision Number: Revision 1.4 Publication Date: December 7, 2011 Authors: CSC Security Testing/Certification Laboratories, Xerox Corporation TOE Identification: Xerox WorkCentre 7525/7530/7535/7545/7556 (see Section 1.3.1 for software version numbers)