McAfee SAV85E - Active VirusScan

Supplement for Common Criteria

Operational User Guidance and Preparative

Procedures

McAfee®VirusScan®Enterprise 8.8

McAfee®ePolicy Orchestrator®4.5 Software

2Operational User Guidance and Preparative Procedures Supplement for Common Criteria

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any

means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE),

MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registered

trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of

McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners.

LICENSE INFORMATION

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS

AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER

RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE

PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT

AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF

PURCHASE FOR A FULL REFUND.

Prepared For:

Prepared By:

McAfee, Inc.

2821 Mission College Blvd.

Santa Clara, CA 95054

www.mcafee.com

Apex Assurance Group, LLC

530 Lytton Avenue, Ste. 200

Palo Alto, CA 94301

www.apexassurance.com

Operational User Guidance and Preparative Procedures Supplement for Common Criteria 3

Contents

1Introduction 5

About the Common Criteria.................................................................................................5

Assumptions .....................................................................................................................6

Authorized Administrators ............................................................................................6

Physical Access ...........................................................................................................6

Acronyms .........................................................................................................................6

2Installation Guidelines and Preparative Procedures 7

Overview..........................................................................................................................7

Downloading the TOE.........................................................................................................7

Evaluated Configuration......................................................................................................8

Functionality Not Included in the Evaluation....................................................................9

Verify Software .................................................................................................................9

Updating System Software .........................................................................................10

Install Database Capacity Monitor Extension .......................................................................10

Step 1: Adjust or Review Database space requirements .................................................11

Step 2: Create a Server Task to generate the Event ......................................................11

Step 3: Setting up the automatic response...................................................................12

3Guidance for Administrators 15

Software Version Inspection.............................................................................................. 15

Required Password Length................................................................................................15

4Operational User Guidance and Preparative Procedures Supplement for Common Criteria

Operational User Guidance and Preparative Procedures Supplement for Common Criteria 5

1Introduction

This guide provides operational guidance and installation procedures for the VirusScan Enterprise 8.8

and ePolicy Orchestrator 4.5.

This guide was written to provide the evidence required by the following assurance requirements of

the Common Criteria (CC) Version 3.1, Part 3:

AGD_OPE.1

AGD_PRE.1

These assurance requirements call for documentation of installation procedures that provide assurance

that the TOE is installed and configured in the evaluated configuration.

This document serves as a supplement to the standard McAfee documentation set including the

following:

McAfee VirusScan Enterprise 8.8 Product Guide

McAfee VirusScan Enterprise 8.8 Installation Guide

McAfee ePolicy Orchestrator 4.5 Installation Guide

McAfee ePolicy Orchestrator 4.5 Product Guide

These documents should be read prior to configuring the product in accordance with the Common

Criteria evaluated configuration. The documents listed above in conjunction with this supplement

describe how to administer the TOE in a manner that meets the Common Criteria evaluated

configuration. Any changes to or deviations from the information provided in this document will result

in noncompliance between the product and the Common Criteria evaluated configuration.

The audience for this document includes administrators who are authorized to install and configure

TOE. Since administrators configure the TOE and set policies for use, there is no specific user guidance

documentation.

Contents

About the Common Criteria

Assumptions

Acronyms

About the Common Criteria

The Common Criteria for Information Technology Security Evaluation (or “Common Criteria”) provides

a methodology for evaluating security features of IT products. Product vendors pursue Common

Criteria evaluation to meet assurance needs of customers and to seek third-party validation of security

function claims. The Target of Evaluation (TOE) encompasses the evaluated security functionality of a

product.

Introduction

Assumptions

6Operational User Guidance and Preparative Procedures Supplement for Common Criteria

The McAfee VirusScan Enterprise 8.8 and ePolicy Orchestrator 4.5 (hereafter called “Target of

Evaluation” or the “TOE”) has achieved Common Criteria Evaluation Assurance Level 2 and augmented

by ALC_FLR.2 – Flaw Reporting Procedures.

Please visit: http://www.commoncriteriaportal.org for more information on the Common Criteria.

Assumptions

The TOE and the TOE operating environment should be managed to satisfy the assumptions presented

in the following sections.

Authorized Administrators

Authorized administrators are non-hostile, are authenticated to the internal network, and follow all

administrator guidance. Human users (considered to be anyone who interacts with the TOE) who are

not authorized administrators cannot access the administration features.

Physical Access

The TOE must be located in a physically secure environment, and only an authorized administrator has

access to this environment. The evaluated configuration of the TOE can be compromised if an intruder

gains physical access to the product. Therefore only authorized administrators shall be allowed

physical access to the workstation(s) for power/reset controls.

Acronyms

The following table lists the acronyms used in this document:

Table 1 – Acronyms and Terms

Acronym Term

CC Common Criteria

EAL Evaluation Assurance Level

TOE Target of Evaluation

TSF TOE Security Function

Operational User Guidance and Preparative Procedures Supplement for Common Criteria 7

2Installation Guidelines and Preparative

Procedures

This section provides guidelines for installing McAfee VirusScan Enterprise 8.8 and ePolicy Orchestrator

4.5 to meet the Common Criteria evaluated configuration. The following guidelines may augment the

details of or provide exceptions to the documents referenced in the Purpose section of this document.

Prior to installation, the administrator should read and be familiar with the details of all documentation

for VirusScan Enterprise 8.8 and ePolicy Orchestrator 4.5.

Contents

Overview

Downloading the TOE

Evaluated Configuration

Verify Software

Install Database Capacity Monitor Extension

Overview

Prior to installation, the administrator should read and be familiar with the details of all documentation

for McAfee VirusScan Enterprise 8.8 and ePolicy Orchestrator 4.5.

Downloading the TOE

The administrator should follow these steps to download the VirusScan TOE component:

1 Log in to the download/upgrade site.

(https://secure.nai.com/us/forms/downloads/upgrades/login.asp) and enter the grant number

provided.

The My Products page appears showing links for the products to which the customer is entitled.

For example, if the grant number includes entitlement to McAfee VirusScan Enterprise, there will

be an entry for the McAfee Active VirusScan.

2 Select McAfee Active VirusScan.

The list of related products appears.

3 Select VirusScan Enterprise v8.8.

The license agreement page appears.

Installation Guidelines and Preparative Procedures

Evaluated Configuration

8Operational User Guidance and Preparative Procedures Supplement for Common Criteria

4 Click I Agree.

The VirusScan Enterprise download page appears.

5 On the Software Downloads tab, select VSE880LML.zip and VSE880_Client_Help.Zip.

6 Download each item.

7 On the Documentation tab, select English from the Language drop-down box.

8 Select any or all of the available VirusScan Enterprise documentation.

9 Download each item.

The administrator should follow these steps to download the ePolicy Orchestrator TOE component:

1 Log in to the download/upgrade site

(https://secure.nai.com/us/forms/downloads/upgrades/login.asp) and enter the grant number

provided.

The My Products page appears.

2 Select McAfee Active VirusScan.

The list of related products appears.

3 Select ePolicy Orchestrator v4.5.0.

The license agreement page appears.

4 Click I Agree, the ePolicy Orchestrator download page appears, containing a list of links.

5 Click and download the ePolicy Orchestrator file (ePO450P3.Zip).

6 Click the Documentation tab.

7 Select English from the Language drop-down box, and click Go.

8 Select any or all of the available ePolicy Orchestrator documentation.

9 Download each item.

The administrator should follow these steps to download the Database Capacity Monitor TOE

component:

1 Log in to the McAfee Service Portal site (https://mysupport.mcafee.com/Eservice/Default.aspx).

2 Select Download Software Updates.

3 Click on Download EPolicy Orchestrator 4.5 Database Capacity Monitor.

4 Follow the instructions in the Install Database Capacity Monitor Extension section of this

document.

Evaluated Configuration

The evaluated configuration includes one or more instances of McAfee Agent and McAfee VirusScan

Enterprise and an instance of McAfee ePolicy Orchestrator. Note that for the evaluated configuration,

all user accounts defined in McAfee ePO must specify Windows authenticaltion (rather than McAfee

ePO authentication).

Installation Guidelines and Preparative Procedures

Verify Software

Operational User Guidance and Preparative Procedures Supplement for Common Criteria 9

The evaluated configuration includes one or more instances of McAfee Agent and VirusScan Enterprise

and an instance of McAfee ePO. The following configuration should apply to the evaluated

configuration:

1 All user accounts defined in McAfee ePO must specify Windows authentication.

2 McAfee Agent should only be installed by using the McAfee ePO interface.

3 Remote viewing of TOE log files on the clients is disabled.

4 Only authorized processes may initiate network connections to remote port 25 (SMTP). The

Central Administrator configures the list of authorized processes.

5 The U.S. Government Protection Profile Anti-Virus Applications for Workstations in Basic

Robustness Environments requires the TOE to restrict specific management functionality to the

Central Administrator role. At least one ePO user must be defined as a Central Administrator. For

this TOE, the Central Administrator role is defined as an authorized administrator with Global

Administrator status.

6 Because the U.S. Government Protection Profile Anti-Virus Applications for Workstations in Basic

Robustness Environments requires the TOE to restrict specific management functionality to the

Central Administrator role, the following permissions may never be assigned:

a View audit log.

b View and purge audit log.

c View VSE settings.

d View and change VirusScan Enterprise settings.

Functionality Not Included in the Evaluation

The following functionality is not included in the evaluation:

The ability to protect against buffer overflows

The ability to identify spyware

The Scriptscan feature that scans JavaScript and VBScript scripts

The ability to update the TOE (scan engine). Note that the ability to update the virus

signatures (DAT file) is included in the evaluation.

The optional Alert Manager product

Verify Software

The administrator should follow one of the following points to ensure the proper version of software is

installed:

The administrator can view McAfee ePO versioning information on the title bar/tab header

when logged into ePolicy Orchestrator:

Installation Guidelines and Preparative Procedures

Install Database Capacity Monitor Extension

10 Operational User Guidance and Preparative Procedures Supplement for Common Criteria

The administrator can view VirusScan Enterprise versioning information via Menu / Software /

Extensions / VirusScan Enterprise when logged into ePolicy Orchestrator

Updating System Software

If the TOE is not running the evaluated version of software, the administrator should contact McAfee

to obtain the appropriate license/grant for the evaluated software version.

Install Database Capacity Monitor Extension

The purpose of the feature is to enable the use of automatic responses to alert the administrator of

the exhaustion of storage space being used by the SQL database. To facilitate events, a new project

has been created that allows the user to configure alert settings. This project is being released by way

of an extension and can be installed by the end user.

To install the Database Capacity Monitor Extension, follow the instructions below:

1 Download the Database Capacity Monitor Extension (DBCapMon.zip) from McAfee Service Portal.

2 As a Global Admin, select Software / Extensions from the main menu.

This manual suits for next models

Table of contents

Other McAfee Software manuals

McAfee

McAfee VSMCDE-AA-AA - VirusScan Mobile - PC User manual

McAfee

McAfee Agent 4.0 Instruction Manual

McAfee

McAfee EPOLICY ORCHESTRATOR 3.6 - WALKTHROUGH GUIDE User manual

McAfee

McAfee VIRUSSCAN ENTERPRISE 8.7I PATCH 2 - S... Instruction Manual

McAfee

McAfee MTP08EMB3RUA - Total Protection - PC User manual

McAfee

McAfee EPOLICY ORCHESTRATOR 4.5 - User manual

McAfee

McAfee MFN10EMB3RAA - Family Protection - PC User manual

McAfee

McAfee DFFCDE-AA-DA - Endpoint Encryption For Files User manual

McAfee

McAfee EPOLICY ORCHESTRATOR 4.5 - User manual

McAfee

McAfee DTP-1650-MGRA - Network DLP Manager 1650... User manual

McAfee

McAfee VIRUSSCAN 5.1 Service manual

McAfee

McAfee OFFICE 3.1 User manual

McAfee

McAfee VIRUSSCAN 5.1 User manual

McAfee

McAfee VIRUSSCAN ENTERPRISE 8.7I PATCH 3 - S... Instruction Manual

McAfee

McAfee EPOCDE-AA-BA - ePolicy Orchestrator - PC User manual

McAfee

McAfee NAPCKE-AB-AA - VirusScan For NetApp User manual

McAfee

McAfee PASCDE-AB-IA - Policy Auditor For Servers User manual

McAfee

McAfee VPF40E001RAA - VirusScan 2005 - PC User manual

McAfee

McAfee MANAGEMENT EDITION 2.5 Service manual

McAfee

McAfee VIRUSSCAN ENTERPRISE User manual

McAfee

McAfee EPOLICY ORCHESTRATOR 4.0 PATCH 5 - S... Instruction Manual

McAfee

McAfee MIS09EMB3RAA - Internet Security 2009 User manual

McAfee

McAfee MTP09EMB1RAA - Total Protection 2009 User manual

McAfee

McAfee NETSHIELD - FOR NETWARE SERVERS User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual

McAfee SAV85E - Active VirusScan - PC Owner's manual

Popular Software manuals by other brands