WIXLIB

Low Assurance Security Target for aCisco VoIP Telephony SystemSecurity TargetVersion 1.6March 14, 2005

Document ControlPreparationActionNameDatePrepared by:Rob Hunter of TNO -ITSEF BV onbehalf of Cisco14 March 2005ReleaseVersionDate Released Change NoticePages ution ListName1.BSI2.BSI3.TNO-ITSEF BVRemarksInitial version of rewriteby ITSEFModified after evaluatorcomments and site visitModified after firstround BSI certifiercommentsModified after secondround BSI certifiercommentsModified after thirdround BSI certifiercomments

Cisco SystemsLAST -Cisco VoIP Telephony System-1.6Document InformationVersion number reportCertification IDSchemeSponsor1.6BSI-DSZ-CC-0306BSIBSIEvaluation LabTNO-ITSEF BVDelftech Park 12628XJ DelftThe NetherlandsEvaluation Lab addressTarget of Evaluation (TOE)Cisco VoIP Telephony SystemTOE reference nameCC-EAL numberCisco VoIP Telephony System1Report titleLow Assurance Security Target for aCisco VoIP Telephony SystemReport reference nameLAST-Cisco VoIP Telephony System -1.6March 14, 2005Version 1.6 Copyright 2005 Cisco SystemsPage 3 of 23

Cisco SystemsLAST -Cisco VoIP Telephony System-1.6TABLE OF CONTENTS1SECURITY TARGET INTR ODUCTION . 81.1ST R EFERENCE .81.2TOE REFERENCE .81.3TOE OVERVIEW .81.4TOE DESCRIPTION .91.4.1Physical Scope and Boundaries . 91.4.2Logical Scope and Boundaries . 142CONFORMANCE CLAIMS . 162.12.22.33CONFORMANCE CLAIM .16PROTECTION PROFILE CLAIM .16PACKAGE CLAIM .16DEFINITION OF TERMS. 173.1DEFINITION OF SUBJECTS, INFORMATION AND OPERATIONS .173.1.1Subjects . 173.1.2Operations. 173.1.3Objects . 174SECURITY OBJECTIVES FOR THE OPERATIONAL ENVIRONMENT . 185SECURITY REQUIREMENTS. 195.1EXTENDED COMPONENTS DEFINITION .195.2SFRS .195.2.1Restricting access to certain telephone numbers. 195.2.2Voice mail . 195.2.3Managing telephones . 195.2.4Identifying users . 205.2.5Logging and auditing . 205.2.6Self-protection . 205.3SARS .216TOE SUMMARY SECTION . 226.1TOE SECURITY FUNCTIONS .226.1.1Restricting access to certain telephone numbers. 226.1.2Voice mail . 226.1.3Managing telephones . 236.1.4Identifying users . 236.1.5Logging and auditing . 236.1.6Self-protection . 23March 14, 2005Version 1.6 Copyright 2005 Cisco SystemsPage 4 of 23

LIST OF TABLESTable 1: Components and Software in the TOE .10Table 2: Physical Definition of 7970G Components .11Table 3: Physical Definition of 7970G Touch Screen Components .11Table 4: Physical Definition of 7960G Components .12March 14, 2005Version 1.6 Copyright 2005 Cisco SystemsPage 5 of 23

LIST OF FIGURESFigure 1: Front View of the Cisco IP Phone 7970G.11Figure 2: Front View of the Cisco IP Phone 7960G.12March 14, 2005Version 1.6 Copyright 2005 Cisco SystemsPage 6 of 23

References[VOIP-PP]Low Assurance Protection Profile for a VoIP Infrastructure, Versionth1.1, 14 March 2004.The following references can be downloaded from the developers website.[CDR-DEF]Cisco CallManager 4.1(2) Call Detail Record Definition pages 11-28inclusive.[CM ADMIN]Cisco CallManager Administration Guide, Release 4.1(2).[CM TRACE]Cisco CallManager Serviceability Administration Guide, Release4.1(2).[UNITY USER]Cisco Unity User Guide Release 4.0(3).[CISCO-CC]Commentary and Configuration Guidelines for Implementation of therdIPT System Evaluated Common Criteria 2.4 EAL 1, dated feb 23 ,2005, version 1.0March 14, 2005Version 1.6 Copyright 2005 Cisco SystemsPage 7 of 23

1Security Target Introduction1.1ST ReferenceThis is the Low Assurance Security Target for aCisco VoIP Telephony System 1.6 , BSI, March 14th, 20051.2TOE ReferenceThe TOE reference is defined as the ‘Cisco VoIP Telephony System Version 1.0’ and is thecollective reference for the TOE components as described in section 1.41.3TOE overviewThe VoIP Telephony System provides all the technology required to replace a traditional PrivateBranch Exchange (PBX) with an Internet Protocol (IP) -based solution. The System includesCisco IP-based telephones (IP phones), Cisco CallManager (Cisco’s PBX call-agent - CCM), aCisco Voice Gateway router and Cisco Unity for voice messaging. The IP phones combine thefunctions of a traditional telephone with an Ethernet connection. Cisco CallManager is asoftware-based call processing agent that extends enterprise telephony features and functions topacket telephony network devices. Cisco Unity is a Windows 2000-based communicationssolution that provides voice mail and unified messaging (voice to text -based systems).The TOE provides the following security functionality: Access to certain phone numbers can be restricted. Access to Voice mail in order to listen to messages and delete them is only allowedafter successful user identification and authentication. The administrator can only manage the TOE after successful user identification andauthentication. The TOE generates audit records for each telephone call and for auditenabling/disabling. The TOE security functionality protects itself from tempering and interference by beingwell designed, produced and tested.The following non TOE hardware, software or firmware is required by the TOE components inorder for the TOE to operate as described in this Security Target: Cisco CallManager requires a Cisco MCS7800 server platform (a rack mounted PC) withMicrosoft Windows 2000 server running: Sun JRE, Microsoft SQL Server 2000 updatedwith SP3a (or later)Cisco Unity (Voicemail) requires a Cisco MCS7800 server platform (a rack mounted PC)with Microsoft Windows 2000 server running: Sun JRE, Microsoft SQL Server 2000updated with SP3a (or later)The TOE requires an underlying IP based network for data transport.March 14, 2005Version 1.6 Copyright 2005 Cisco SystemsPage 8 of 23

A standard PC equipped with a web browser that supports HTTPS to Cisco CallManagerand Cisco Unity over the LAN and a serial connection to the Cisco Voice Gateway routervia a terminal emulator such as Hyper terminal is needed to administer the TOE.The other TOE components are self contained and do not require supporting hardware, softwareor firmware to operate.1.4TOE descriptionThe TOE is a Cisco VoIP System composed of IP phones, a Cisco CallManager, a Cisco Unityand a Cisco Voice Gateway router to connect the infrastructure to the Public Switched TelephoneNetwork (PSTN). The goal of this VoIP System is to provide telephony services over an IPnetwork. An IP-based networ k is the backbone of the TOE, and carries the IP packets betweenthe distinct pieces of the System.The major Security Features that are provided by the TOE are: The restriction of IP phone users access to certain telephone numbers. Identification and authentication of users who wish to access the TOEs’ voice mailservices. The management of IP Phones. The provision of systems traces through alarms, system traces and call information. Protection of itself and the security functions it offers by being well designed,implemented and tested.1.4.1 Physical Scope and BoundariesIP Telephony enables calls to be made between IP phones, as well as between an IP-based phoneand a traditional PSTN telephone. The components for a VoIP System are shown in Figure 1.Cisco CallManagerPSTNCisco UnityCisco 2651XM-VUnderlying NetworkCisco 7960G or 7970G IP PhonesFigure 1: The Cisco VoIP system – note that that network is not part of the TOE.A minimum of two Cisco IP phones (type 7960G or 7970G) are required to place calls betweenIP-based phones.March 14, 2005Version 1.6 Copyright 2005 Cisco SystemsPage 9 of 23

Cisco CallManager (CCM) is a central entity that provides call control and configurationmanagement for the IP Phones. The CCM provides the core functionality to provide call set-upand route calls throughout the network to voice gateways and voice mail systems.The Cisco Unity system provides IP-based voicemail storage.The Cisco 2651XM-V voice gateway router provides access and data conversion to and from thePSTN and the IP network.The version numbers for the components that together form the TOE are:ComponentCisco IP Telephone 7960GCisco IP Telephone 7970GCisco CallManagerCisco UnityCisco 2651XM-VSoftware Version in theTOE7.0(2)6.0(2)4.1(2)4.0(4)12.3(10)Table 1: Components and Software in the TOE1.4.1.1 IP PhonesTwo different IP phone models are included in the TOE: Cisco IP Phone 7960G and 7970G. Themain difference between the two models is the inclusion of a color screen on the 7970, its touchscreen capabilities, and its support for user-defined LCD backgrounds. Both phones are selfcontained operational units.Cisco IP phones are full-featured telephones that provide voice communication over an IP-basednetwork.The 7970G IP PhoneMarch 14, 2005Version 1.6 Copyright 2005 Cisco SystemsPage 10 of 23

Figure 1: Front View of the Cisco IP Phone 7970G1Programmable buttons23456789Foot stand buttonDisplay buttonMessages (voicemail)Directories buttonHelpSettingsServices10Toggles the speaker phone on andoff11Toggles mute on and off12Toggles the headset on and off13Navigation button14Keypad15Soft keys16Handset Light Strip17Touch screenVolumeTable 2: Physical Definition of 7970G Components1357Primary LineProgrammable button labelsStatusPhone tab2468Line Area and Call OverviewSoft key labelsCall activityFeature tabTable 3: Physical Definition of 7970G Touch Screen ComponentsMarch 14, 2005Version 1.6 Copyright 2005 Cisco SystemsPage 11 of 23

The 7960G IP PhoneFigure 2: Front View of the Cisco IP Phone 7960G123456789Handset light strip, indicates anincoming call or voice messageLCD ScreenModel TypeProgrammable buttonsFoot stand buttonDirectories buttonHelpSettings10Toggles mute on and off11121314151617SpeakerToggles the headset on and offVolumeServicesMessages (voicemail)ScrollKeypadSoft keysTable 4: Physical Definition of 7960G Components1.4.1.2 Cisco CallManagerThe operating system that hosts the CCM application is a turn-key, pre-configured version ofMicrosoft Windows 2000 Server that runs on Cisco’s MCS7800 server hardware. It includes thefollowing software packages: Sun Microsystem Java Runtime Environnent (JRE) Microsoft SQL Server 2000 Microsoft SQL Server 2000 Service Pack 3a (or later)The “Cisco CallManager Operating System Optional Security Settings” are applied to the CiscoCallManager before the Cisco CallManager is placed into production.1.4.1.3 Cisco UnityThe operating system that hosts the Cisco Unity application is a turn-key, pre-configured versionof Microsoft Windows 2000 Server that runs on Cisco’s MCS7800 server hardware. It includesthe following software packages:March 14, 2005Version 1.6 Copyright 2005 Cisco SystemsPage 12 of 23