Bomgar Corporation B200™, B300™, and B400™ Remote Support Appliances Firmware Version: 3.3.2 FIPS; Software Version: 12.1.6 FIPS Hardware Version: B200 with Tamper Evident Label Kit: TEL135325 B300r1 with Tamper Evident Label Kit: TEL135325 and Front Bezel: FB000300 B400r1 with Tamper Evident Label Kit: TEL135325 and Front Bezel: FB000400 FIPS 140-2 Security Level: 2 Non-Proprietary Security Policy FIPS 140-2 Security Level: 2 Document Version: 1.6 September 10th, 2012 Security Policy, Version 1.6 Table of Contents 1 INTRODUCTION ................................................................................................................... 4 1.1 PURPOSE ................................................................................................................................................................ 4 1.2 REFERENCES .......................................................................................................................................................... 4 1.3 DOCUMENT ORGANIZATION ............................................................................................................................ 4 2 B200, B300R1, AND B400R1 APPLIANCES ......................................................................... 5 2.1 OVERVIEW ............................................................................................................................................................. 5 2.2 MODULE SPECIFICATION..................................................................................................................................... 7 2.3 MODULE INTERFACES .......................................................................................................................................... 8 2.4 ROLES AND SERVICES .........................................................................................................................................11 2.4.1 Crypto-Officer Role.............................................................................................................................................. 11 2.4.2 Instance-Admin Role ........................................................................................................................................... 12 2.4.3 Instance-User Role .............................................................................................................................................. 12 2.4.4 Services ................................................................................................................................................................... 12 2.4.5 Unauthenticated Operator Services .............................................................................................................. 14 2.4.6 Authentication Mechanism ............................................................................................................................... 14 2.5 PHYSICAL SECURITY ...........................................................................................................................................14 2.6 OPERATIONAL ENVIRONMENT.........................................................................................................................15 2.7 CRYPTOGRAPHIC KEY MANAGEMENT ............................................................................................................15 2.8 EMI/EMC ............................................................................................................................................................17 2.9 SELF-TESTS ..........................................................................................................................................................17 2.9.1 Power-Up Self-Tests ............................................................................................................................................ 17 2.9.2 Conditional Self-Tests ......................................................................................................................................... 18 2.10 MITIGATION OF OTHER ATTACKS ..................................................................................................................18 3 SECURE OPERATION ......................................................................................................... 19 3.1 INITIAL SETUP......................................................................................................................................................19 3.1.1 B200 Hardware Setup ...................................................................................................................................... 19 3.1.2 B200 Label Inspection ....................................................................................................................................... 19 3.1.3 B300 Hardware Setup ...................................................................................................................................... 20 3.1.4 B300 Label Inspection ....................................................................................................................................... 21 3.1.5 B400 Hardware Setup ...................................................................................................................................... 23 3.1.6 B400 Label Inspection and Application ....................................................................................................... 23 3.1.7 Firmware/Software Version Verification ....................................................................................................... 26 3.2 FIPS MODE COMPLIANCE .................................................................................................................................26 3.3 CRYPTO-OFFICER GUIDANCE ..........................................................................................................................29 3.3.1 Management ........................................................................................................................................................ 29 3.3.2 Status Monitoring ................................................................................................................................................ 29 3.3.3 Zeroization ............................................................................................................................................................ 29 3.4 INSTANCE-ADMIN AND INSTANCE-USER GUIDANCE...................................................................................29 4 ACRONYMS .......................................................................................................................... 31 Table of Figures FIGURE 1 – BOMGAR B200 (TOP), B300 (MIDDLE), AND B400 (BOTTOM) ......................................................................5 FIGURE 2 – TYPICAL DEPLOYMENT.........................................................................................................................................6 FIGURE 3 – BLOCK DIAGRAM FOR B200 WITH CRYPTOGRAPHIC BOUNDARY ...............................................................7 FIGURE 4 – BLOCK DIAGRAM FOR B300 AND B400 WITH CRYPTOGRAPHIC BOUNDARY ...........................................8 FIGURE 5 – FRONT AND REAR VIEW OF THE B200 ..............................................................................................................9 FIGURE 6 – FRONT AND REAR VIEW OF THE B300 ..............................................................................................................9 FIGURE 7 – FRONT AND REAR VIEW OF THE B400 ..............................................................................................................9 Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 2 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 FIGURE 8 – TAMPER-EVIDENT LABEL APPLIED TO TOP OF B200, OVERLAPPING THE GALVANIZED METAL COVER AND THE FRONT PANEL............................................................................................................................................... 20 FIGURE 9 – TAMPER-EVIDENT LABEL APPLIED TO REAR OF B200, OVERLAPPING THE GALVANIZED METAL COVER AND THE REAR STEEL BEZEL ........................................................................................................................................ 20 FIGURE 10 – REAR METALLIC BEZEL SEAL (LEFT) AND SEALED TOP COVER (RIGHT).................................................. 22 FIGURE 11 – SEALED FRONT BEZEL TO CHASSIS TOP (LEFT) AND SEALED FRONT BEZEL TO CHASSIS BOTTOM (RIGHT) .......................................................................................................................................................................... 22 FIGURE 12 – SEALED TOP CHASSIS TO LEFT POWER SUPPLY (LEFT) AND SEALED TOP CHASSIS TO RIGHT POWER SUPPLY (RIGHT)............................................................................................................................................................. 22 FIGURE 13 – SEALED TOP COVER ........................................................................................................................................ 24 FIGURE 14 – SEALED POWER SUPPLY #1 TO CHASSIS BOTTOM (LEFT) AND SEALED POWER SUPPLY #2 TO CHASSIS TOP (RIGHT) .................................................................................................................................................................. 24 FIGURE 15 – SEALED FRONT BEZEL TO CHASSIS BOTTOM (LEFT) AND SEALED FRONT BEZEL TO CHASSIS TOP (RIGHT) .......................................................................................................................................................................... 24 FIGURE 16 – IP CONFIGURATION PAGE ............................................................................................................................. 25 FIGURE 17 – SSL CONFIGURATION PAGE .......................................................................................................................... 26 FIGURE 18 – STATUS BASICS PAGE ...................................................................................................................................... 27 FIGURE 19 – ADVANCED SUPPORT PAGE ........................................................................................................................... 28 FIGURE 20 – SECURITY PAGE ................................................................................................................................................ 28 FIGURE 21 – SUPPORT PAGE ................................................................................................................................................. 28 List of Tables TABLE 1 – SECURITY LEVEL PER FIPS 140-2 SECTION .........................................................................................................6 TABLE 2 – PHYSICAL PORTS AND LOGICAL INTERFACES .................................................................................................. 10 TABLE 3 – LED DESCRIPTIONS............................................................................................................................................. 10 TABLE 4 – MAPPING OF AUTHENTICATED OPERATOR SERVICES TO INPUTS, OUTPUTS, CSPS, AND TYPE OF ACCESS ........................................................................................................................................................................... 12 TABLE 5 – UNAUTHENTICATED OPERATOR SERVICE ....................................................................................................... 14 TABLE 6 – AUTHENTICATION MECHANISM USED BY THE MODULES ............................................................................. 14 TABLE 7 – FIPS-APPROVED ALGORITHM IMPLEMENTATIONS .......................................................................................... 15 TABLE 8 – LIST OF CRYPTOGRAPHIC KEYS, CRYPTOGRAPHIC KEY COMPONENTS, AND CSPS................................. 16 TABLE 9 – ACRONYMS .......................................................................................................................................................... 31 Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 3 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 1 Introduction 1.1 Purpose This is a non-proprietary Cryptographic Module Security Policy for the B200, B300r1, and B400r1 Remote Support Appliances from Bomgar Corporation. This Security Policy describes how the B200, B300r1, and B400r1 Remote Support Appliances meet the security requirements of FIPS1 140-2 and how to run the modules in a secure FIPS 140-2 mode. This policy was prepared as part of the Level 2 FIPS 140-2 validation of the modules. FIPS 140-2 – Security Requirements for Cryptographic Modules details the U.S. and Canadian Government requirements for cryptographic modules. More information about the FIPS 140-2 standard and validation program is available on the Cryptographic Module Validation Program (CMVP) website, which is maintained by the National Institute of Standards and Technology (NIST) and the Communications Security Establishment Canada (CSEC): http://csrc.nist.gov/groups/STM/cmvp. The B200, B300r1, and B400r1 Remote Support Appliances are referred to in this document as the Bomgar Appliances, the cryptographic modules, or the modules. 1.2 References This document deals only with operations and capabilities of the modules in the technical terms of a FIPS 140-2 cryptographic module security policy. More information is available on the modules from the following sources: The Bomgar website (http://www.bomgar.com/fips) contains information on the full line of • products from Bomgar Corporation. The CMVP website (http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm) • contains contact information for individuals to answer technical or sales-related questions for the modules. 1.3 Document Organization The Security Policy document is one document in a FIPS 140-2 Submission Package. In addition to this document, the Submission Package contains: Vendor Evidence document • Finite State Model • Other supporting documentation as additional references • This Security Policy and the other validation submission documentation are produced by Bomgar Corporation. With the exception of this Non-Proprietary Security Policy, the FIPS 140-2 Validation Documentation is proprietary to Bomgar Corporation and is releasable only under appropriate non- disclosure agreements. For access to these documents, please contact Bomgar Corporation. 1 FIPS – Federal Information Processing Standard Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 4 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 2 B200, B300r1, and B400r1 Appliances 2.1 Overview Bomgar Corporation specializes in appliance-based solutions for remote support. Their remote support appliances give support technicians secure remote control of computers over the Internet, LAN2, or WAN3. The software works through firewalls with no pre-installed client on the remote computer. With the Bomgar Appliances, a support technician can see the screen and control the remote system virtually as if physically present. Figure 1 – Bomgar B200 (top), B300r1 (middle), and B400r1 (bottom) The B200, B300r1, and B400r1 Appliances (shown in Figure 1 above) enable the use of remote support in multiple areas of an organization in a way that is secure, integrated and manageable. The Bomgar Appliances can integrate with LDAP4 for secure user management, prevent sensitive data from being routed outside the organization, and support extensive auditing and recording of support sessions. The logging is performed by the Bomgar Appliances, which allows for the review of all Customer and Support Representative interactions, including playback of all desktop screen data. The appliances also integrate with leading systems management and identity management solutions and include an Application Programming Interface (API) for deeper integration. With Bomgar, support managers can create support teams, customize queues, and report on all support activity. Network administrators can also monitor the Bomgar Appliances using Simple Network Management Protocol (SNMP). The Bomgar Appliances enable remote access to multiple common operating systems, including various Linux distributions. They also enable remote control of various kinds of systems, including laptops, desktops, servers, kiosks, point-of-sale systems, smartphones, and network devices. The Bomgar Appliances can work over internal and extended networks and can be internet-accessible. This allows support organizations to reduce less effective means of support by driving requests through custom support portals hosted on the appliances. The Bomgar Appliances can route support requests to the appropriate technician or team and mediate connections between Customers and Support Representatives, allowing chat sessions, file downloads/uploads, screen-sharing, remote control of desktops, and access to system and diagnostic information. To enable the functionality described above, Bomgar has implemented architecture that places the Bomgar Appliances at the center of all communications (see Figure 2 below for a typical deployment scenario). The 2 LAN – Local Area Network 3 WAN – Wide Area Network 4 LDAP – Lightweight Directory Access Protocol Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 5 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Bomgar Appliances provide a platform upon which one or more support sites are constructed. Sites represent individual help centers, and multiple sites can be set up to support multiple departments or groups in a company. Each site would offer a web site interface using Hypertext Transfer Protocol (HTTP) for unauthenticated services and HTTP over TLS5 (HTTPS) for authenticated services, in addition to accepting direct client connections over a protocol running on top of TLS. Figure 2 – Typical Deployment6 The Bomgar Appliances have two primary components that provide the appliances’ functionality. The first is the Firmware that provides system-level configuration of the Bomgar Appliances. Settings such as IP7 addresses and SSL/TLS configuration are all configured via the Firmware interface. The second component is made up of the software that provides site-level configuration, as well as the software clients that users interact with. The web interface behind the /login page is part of the software, as are the Representative Console, Customer Client, Connection Agent, and all other clients which are downloadable from the Bomgar Appliances. The B200, B300r1, and B400r1 Remote Support Appliances are validated at the FIPS 140-2 Section levels in Table 1. Table 1 – Security Level Per FIPS 140-2 Section Section Section Title Level 1 Cryptographic Modules Specification 2 2 Cryptographic Modules Ports and Interfaces 2 3 Roles, Services, and Authentication 2 4 Finite State Model 2 5 Physical Security 2 N/A8 6 Operational Environment 5 TLS – Transport Layer Security 6 Rep – Representative; SSL – Secure Sockets Layer; DMZ – Demilitarized Zone; POS – Point of Sale; AD – Active Directory 7 IP – Internet Protocol 8 N/A – Not applicable Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 6 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Section Section Title Level 7 Cryptographic Key Management 2 9 8 EMI/EMC 2 9 Self-tests 2 10 Design Assurance 2 11 Mitigation of Other Attacks N/A 2.2 Module Specification The B200, B300r1, and B400r1 Appliances (running Firmware version 3.3.2 FIPS and Software version 12.1.6 FIPS) are multi-chip standalone modules that meet overall Level 2 FIPS 140-2 requirements. Physically, the modules are composed of the components of a standard server platform. Figure 3 and Figure 4 show block diagrams for the B200, B300r1, and B400r1 respectively and identify the various components, connections and information flows. The cryptographic boundary of each module (denoted by the dotted lines in Figure 3 and Figure 4) is defined by the outer case of the appliance, which surrounds the complete set of hardware, firmware, and software components. Figure 3 – Block Diagram for B200 with Cryptographic Boundary 9 EMI/EMC – Electromagnetic Interference / Electromagnetic Compatibility Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 7 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Figure 4 – Block Diagram for B300r1 and B400r1 with Cryptographic Boundary 2.3 Module Interfaces The modules’ design separates the physical ports into four logically distinct and isolated categories. They are: Data Input • Data Output • Control Input • Status Output • In addition, the modules receive power via a defined power input interface. Data input/output are the network data packets utilizing the services provided by the modules. These packets enter and exit the modules through the network ports. Control input consists of both configuration and administration data entering the modules through the web interface and also the input for the power and reset buttons. Status output consists of status information relayed via the LED10 indicators and the web interface. The physical ports and interfaces of the modules are depicted in Figure 5, Figure 6, and Figure 7 below. 10 LED – Light Emitting Diode Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 8 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Figure 5 – Front and Rear View of the B200 Figure 6 – Front and Rear View of the B300r1 Figure 7 – Front and Rear View of the B400r1 Of the ports and interfaces depicted in the figures above, only the following are enabled to be used in FIPS mode of operation: Network ports • Power button • Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 9 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Reset button • Power connector(s) • LEDs • The mouse port, keyboard port, network port, 2 USB ports, serial port and VGA port behind the rear bezel are inaccessible. These ports are excluded components for the FIPS 140-2 validation of the modules. Table 2 lists the physical interfaces available in the Bomgar Appliances and also provides the mapping from the physical interfaces to logical interfaces as defined by FIPS 140-2. Table 2 – Physical Ports and Logical Interfaces FIPS 140-2 Logical Bomgar Appliance Interface Physical Port Data Input Network ports Data Output Network ports Network ports, power Control Input button, reset button Status Output LEDs, network ports Power Input Power connector(s) The cryptographic modules have a number of LEDs which indicate the state of the modules. The descriptions for the LEDs for each module are listed in Table 3 below. Table 3 – LED Descriptions Model LED Condition Description On System on Power Off System off On IDE channel activity Hard Disk Drive SAS/SATA drive or DVD-ROM drive Blink (HDD) activity Off No HDD activity B200 On Linked LAN1/LAN2 Blink Network activity Off Disconnected On System overheat condition Overheat/Fan Blink Fan failure Off System normal On System on B300r1 Power Off System off Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 10 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Model LED Condition Description Hard Disk Drive Blink HDD activity (HDD) Off No HDD activity On Linked LAN1/LAN2 Blink Network activity Off Disconnected Fast Blink Red (1x/ Fan fail sec) Solid Red CPU overheat Universal Slow Blink Red (1x/ Information Power fail 4 sec) Local Unit Identifier (UID) button Solid Blue depressed On System on Power Off System off Hard Disk Drive On/Blink HDD activity (HDD) Off No HDD activity On Linked LAN 1/LAN2 Blink Network activity B400r1 Off Disconnected On System overheat condition Overheat/Fan Blink Fan failure Off System normal On Power supply failure Power fail Off System off 2.4 Roles and Services As required by FIPS 140-2, the modules support a Crypto-Officer (CO) role and a User role. The User role comprises an Instance-Admin role and an Instance-User role. The modules support role-based authentication for the Crypto-Officer and identity-based authentication for the Instance-Admin and Instance-User roles. Operators explicitly assume the role of Instance-Admin or Instance-User based on the authentication credentials used. The credentials used determine the services available to the operator. 2.4.1 Crypto-Officer Role The Crypto-Officer role is the administrator for the module and is responsible for the initial setup and configuration. The Crypto-Officer has administrator rights to monitor and manage the firmware component’s configuration, manage the CO account, and reset the default Instance-Admin account passwords. Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 11 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 2.4.2 Instance-Admin Role The Instance-Admin has administrator rights to monitor and manage the software instance’s configuration, manage Instance-Admin accounts, and manage Instance-User accounts. 2.4.3 Instance-User Role The Instance-User can access the support services in the module based on the permissions set by the Instance-Admin. The Instance-Admin has to grant access to Instance-Users to access services on the module. 2.4.4 Services All services available in FIPS mode are also available in non-FIPS mode. Services provided to authenticated operators are listed in Table 4 below. Please note that the keys and Critical Security Parameters (CSPs) listed indicate the type of access required: Read: The CSP is read • Write: The CSP is established, generated, modified, or zeroized. • Table 4 – Mapping of Authenticated Operator Services to Inputs, Outputs, CSPs, and Type of Access Service Description Operator Input Output CSP and Type of Access 11 • RSA12 public key – Read, Write Manage Configure IP CO Command Command Bomgar and TLS settings response • RSA private key – Read, Write Appliance • Session key – Read, Write settings • Session integrity key – Read, Write • PRNG13 seed/seed key – Read, Write • CO Password – Read • Firmware update key – Read, Write Manage CO Manage CO CO Command Command • RSA public key – Read account account response • RSA private key – Read password • Session key – Read, Write • Session integrity key – Read, Write • PRNG seed/seed key – Read, Write • CO Password – Read, Write 11 IP – Internet Protocol 12 RSA – Rivest, Shamir, and Adleman 13 PRNG – Pseudo Random Number Generator Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 12 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Service Description Operator Input Output CSP and Type of Access Reset Instance- Reset Instance- CO Command Command • RSA public key – Read Admin Admin account response • RSA private key – Read password password • Session key – Read, Write • Session integrity key – Read, Write • PRNG seed/seed key – Read, Write • Instance-Admin Password – Write Configure Set up and CO, Command Command • RSA public key – Read Instance-Admin monitor Instance- response • RSA private key – Read accounts Instance- Admin Admin • Session key – Read, Write accounts • Session integrity key – Read, Write • PRNG seed/seed key – Read, Write • Instance-Admin Password – Read, Write Configure Set up and Instance- Command Command • RSA public key – Read Instance-User monitor Admin, response • RSA private key – Read accounts Instance-User Instance- • Session key – Read, Write accounts User • Session integrity key – Read, Write • PRNG seed/seed key – Read, Write • Instance-User Password – Read, Write Execute self- Perform power- CO Command Command • None tests up self-tests on response demand Monitor status Monitor the CO Command Status • RSA public key – Read status of the information • RSA private key – Read modules Zeroize keys Zeroize plaintext CO Command Command • All CSPs – Write keys response Perform Access and Instance- Command Command • RSA public key – Read Representative perform services Admin, response • RSA private key – Read Console for Instance- • Session key – Read, Write service Representative User • Session integrity key – Read, Consoles Write • PRNG seed/seed key – Read, Write • Instance-Admin Password – Read • Instance-User Password – Read Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 13 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Service Description Operator Input Output CSP and Type of Access Manage Manage instance Instance- Command Command • RSA public key – Read instance configuration Admin, response • RSA private key – Read settings settings Instance- • Session key – Read, Write User • Session integrity key – Read, Write • PRNG seed/seed key – Read, Write 2.4.5 Unauthenticated Operator Services The modules provide a service to unauthenticated operators as listed in Table 5 below. Table 5 – Unauthenticated Operator Service CSP and Type Service Description Input Output of Access Start an An unauthenticated user Command Command None unauthenticated request support service response support session Power-up self- Power cycle the module by Press the LEDs show None tests and module pressing the power button to Power state state monitoring initiate power-up self-tests button 2.4.6 Authentication Mechanism The Crypto-Officer can access the module remotely over a TLS session. The Crypto-Officer authenticates to the module using a user ID and password. Instance-Admins and Instance-Users authenticate themselves with a user ID and password combination. Instance-Admins and Instance-Users can also authenticate to the module via one of the following configurable methods: LDAP, Kerberos, or RADIUS. Table 6 lists the authentication mechanisms used by the modules. Table 6 – Authentication Mechanism Used by the Modules Authentication Type Strength Password Passwords are required to be at least 6 characters in length and can be a maximum of 64 characters in length. Numeric, alphabetic (upper and lower cases), and keyboard/extended characters can be used, for a total of 95 characters to choose from. A six-character password will yield a total of 956 = 735,091,890,625 possible combinations. Any failed authentication attempt will result in at least one second delay in response. Hence there cannot be more than 60 invalid attempts in any given minute and probability that a random attempt will succeed or a false acceptance will occur is 60 x 1/ 735,091,890,625 which is less than one in 100,000 in one minute. 2.5 Physical Security The B200, B300r1, and B400r1 Appliances are multi-chip standalone cryptographic modules. Each is enclosed in a hard and opaque metal case that completely encloses all of the internal components of the module. Tamper-evident labels are applied to the cases to provide physical evidence of attempts to gain Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 14 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 access to the modules’ internal components. All of the modules’ components are production grade. The placement of tamper-evident labels can be found in Sections 3.1.2, 3.1.4, and 3.1.6 of this document. 2.6 Operational Environment The operational environment requirements do not apply to the Bomgar Appliances. The modules provide only a limited operational environment; they do not provide a general-purpose operating system environment. 2.7 Cryptographic Key Management The modules implement the FIPS-Approved algorithms listed in Table 7. Table 7 – FIPS-Approved Algorithm Implementations Bomgar Appliance Reference Algorithm Certificate Number Advanced Encryption Standard (AES) in CBC14, ECB15, FIPS 197 OFB16, and CFB17128 modes (with 128-bit, 192-bit, 2219 and 256-bit keys) Triple Data Encryption Standard (Triple-DES) – CBC, FIPS 46-3 ECB, OFB, CFB8, and CFB64 modes (with 2-key 19and 1389 ANSI X.952-1998 3-key) RSA ANSI18 X9.31 (key generation19) – 1024-, 1536-, FIPS 186-2 1136 and 2048-bit ANSI X.931-1998 RSA Public Key Cryptography Standard #1 (PKCS#1) 1136 FIPS 186-2 v1.5 (sign/verify) – 1024-, 2048-, 3072-, and 4096-bit RSA Probabilistic Signature Scheme (PSS) (sign/verify) 1136 FIPS 186-2 – 1024-, 2048-, 3072-, and 4096-bit Secure Hash Algorithm (SHA)-1, SHA-224, SHA-256, FIPS 180-2 1910 SHA-384, and SHA-512 Keyed-Hash Message Authentication Code (HMAC19) FIPS 198 using SHA-1, SHA-224, SHA-256, SHA-384, and SHA- 1350 512 ANSI X9.31 A.2.4 PRNG19 ANSI X.931-1988 and NIST-Recommended RNG Based on ANSI 1113 X9.31 Appendix A.2.4 Using the 3-Key Triple DES and AES Algorithms. 14 CBC – Cipher Block Chaining 15 ECB – Electronic Codebook 16 OFB – Output Feedback 17 CFB – Cipher Feedback 18 ANSI – American National Standards Institute 19 SP800-131A provides guidance for transitions to the use of stronger cryptographic keys. Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 15 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 The modules also support the following non-FIPS-Approved algorithms: RSA key transport: 1024-, 1536-, 2048-, 3072-, 4096-bits (key wrapping; key establishment • methodology provides between 80 and 150 bits of encryption strength) RC420 • RC4-40 • DES • DES-40 • MD521 • The modules support the Critical Security Parameters (CSPs) in Table 8. Table 8 – List of Cryptographic Keys, Cryptographic Key Components, and CSPs Generation CSP Type CSP Output Storage Zeroization Use / Input RSA 1024-, 1536-, Internally Exits only via Hard disk in By command or Key exchange private 2048-, 3072-, or generated or a secure TLS plaintext overwritten by for TLS key 4096-bit RSA imported via session another key or by sessions private key a secure TLS factory reset session RSA 1024-, 1536-, Internally Exits in Hard disk in By command or Key exchange public key 2048-, 3072-, or generated or plaintext plaintext overwritten by for TLS 4096-bit RSA imported via form another key or by sessions public key a secure TLS factory reset session Session Internally Exits in Resides on By power cycle Data encryption • 128-bit AES key generated encrypted volatile or session and decryption CBC 128 key form during memory termination for TLS • 256-bit AES TLS only in sessions CBC 256 key handshake plaintext • 192-bit Triple- DES CBC 112 key Session Internally Exits in Resides on By power cycle Ensure • HMAC-SHA integrity generated encrypted volatile or session authenticity of key form during memory termination encrypted TLS TLS only in session data handshake plaintext Crypto- 6-character Enters the Never exits Hard disk in Overwritten by Authenticates Officer minimum modules in the modules hashed form another password the CO password password encrypted or zeroized by form factory reset Instance- 6-character Enters the Never exits Hard disk in Overwritten by Authenticates Admin minimum modules in the modules hashed form another password the Instance- password password encrypted or zeroized by Admin form factory reset 20 RC4 – Rivest Cipher 4 21 MD5 – Message Digest 5 Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 16 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Generation CSP Type CSP Output Storage Zeroization Use / Input Instance- 6-character Enters the Never exits Hard disk in Overwritten by Authenticates User minimum modules in the modules hashed form another password the Instance- password password encrypted or zeroized by User form factory reset PRNG 32 bytes of Internally Never exits Resides on By power cycle, Seeds the FIPS- seed key random value generated the modules volatile session Approved memory termination, or PRNG only in factory reset plaintext PRNG 16 bytes of Internally Never exits Resides on By power cycle, Seeds the FIPS- seed random value generated the modules volatile session Approved memory termination, or PRNG only in factory reset plaintext Firmware 4096-bit RSA Generated by Never exits Hard disk in Overwritten by Used to verify update public key Bomgar the module plaintext another key the authenticity key Corp. and distributed by (signature) of enters the Bomgar Corp. module module in firmware encrypted updates form. 2.8 EMI/EMC The modules were tested and found conformant to the EMI/EMC requirements specified by 47 Code of Federal Regulations, Part 15, Subpart B, Unintentional Radiators, Digital Devices, Class A (i.e., for business use). 2.9 Self-Tests 2.9.1 Power-Up Self-Tests The Bomgar Appliances perform the following self-tests at power-up to verify the integrity of the software/firmware and the correct operation of the FIPS-Approved algorithm implementations employed by the modules: Software/firmware integrity check using a SHA-1 EDC22 • AES Known Answer Test (KAT) • Triple-DES KAT • RSA KAT (sign/verify) • HMAC KATs (SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512) • SHA-1 KAT (note that all SHA-2 implementations are tested as part of the underlying mechanism • of the HMAC SHA self-tests) ANSI X9.31 PRNG KAT • 22 EDC – Error Detection Code Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 17 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 If any of the power-up self-tests fail, then the module enters an error state, logs the error to a file, and disables all cryptographic operations. 2.9.2 Conditional Self-Tests The Bomgar Appliances perform the following conditional self-tests: ANSI X9.31 A.2.4 PRNG Continuous RNG test: Verifying the correct operation of the PRNG • algorithm implementation. RSA pair-wise consistency check (sign/verify and encrypt/decrypt): Verifying that a newly • generated RSA key pair works properly. Software/firmware load test: Verifying the upgrade packages. Upgrade packages are digitally- • signed using RSA-4096, and are only loaded once the digital signature is verified. If any of the conditional self-tests fail, then the module enters a soft error state until the error can be cleared. 2.10 Mitigation of Other Attacks This section is not applicable. The modules do not claim to mitigate any attacks beyond the FIPS 140-2 Level 2 requirements for this validation. Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 18 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 3 Secure Operation The B200, B300r1, and B400r1 Appliances meet Level 2 requirements for FIPS 140-2. The sections below describe how to ensure that the modules are running securely. 3.1 Initial Setup The following sections provide the necessary step-by-step instructions for the secure hardware installation of the B200, B300r1, and B400r1 Appliances, as well as the steps necessary to configure the modules for a FIPS-Approved mode of operation. If you have any questions or if issues arise at any point during the installation and configuration of your Bomgar Appliances, contact the Bomgar support team toll-free at 1-877-826-6427 x2 or internationally at +01-601-519-0123 x2. 3.1.1 B200 Hardware Setup In order to set up the Bomgar B200, the following steps will need to be performed by the Crypto-Officer: 1. Inspect the tamper-evident labels as described in Section 3.1.2 below. The tamper evident labels must be applied for the module to operate in a FIPS-Approved mode of operation. If you find a label that is questionable in appearance, contact Bomgar support toll-free at 1-877-826-6427 x2 or internationally at +01-601-519-0123 x2. 2. Follow the procedures included in the Hardware Setup Guide to install your B200 in your server rack. 3. After you have installed the B200 per the Hardware Setup Guide, refer to the included Bomgar Hardware Installation Guide to configure your network settings. 4. Once the B200’s network settings are correctly configured, return to Section 3.1.6.1 in this document to configure your B200 for FIPS mode. 3.1.2 B200 Label Inspection The B200 with tamper evident label kit – part#TEL135325 will be shipped from the factory with two labels pre-applied. Upon delivery, the Crypto-Officer should ensure that the module was not tampered with during shipment and that the labels have been applied properly. Also, tamper-evident labels shall be routinely inspected for damage by the Crypto-Officer and replaced accordingly. Inspect all tamper evident labels that shipped pre-applied to the B200 chassis (see Figure 8 and Figure 9), ensuring that each label shows no sign of tampering and is properly placed. Any attempt to reposition or remove the label will result in the voiding of that label and leave a residue on the surface. Also, tamper-evident labels shall be routinely inspected for damage by the Crypto-Officer. If you find a label that is questionable in appearance, contact Bomgar support toll-free at 1-877-826-6427 x2 or internationally at +01-601-519-0123 x2. If any additional labels are needed contact Bomgar support toll-free at 1-877-826-6427 x2 or internationally at +01-601-519-0123 x2 with part# TEL135325. The Crypto-Officer is responsible for securing and having control of the additional tamper evident labels at all time. Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 19 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Pre-Applied Tamper Evident Label 1 Figure 8 – Tamper-Evident Label Applied to Top of B200, Overlapping the Galvanized Metal Cover and the Front Panel Pre-Applied Tamper Evident Label 2 Figure 9 – Tamper-Evident Label Applied to Rear of B200, Overlapping the Galvanized Metal Cover and the Rear Steel Bezel 3.1.3 B300r1 Hardware Setup In order to set up the Bomgar B300r1, the following steps will need to be performed by the Crypto-Officer: 1. Unpack the B300r1 and remove the front bezel from the front of the B300r1: a. Loosen the set screw on the right-hand side of the front bezel. This screw keeps the tab in place during shipping. b. Press the tab on the right side of the front bezel and pull the front bezel towards you, right side first. 2. Reseat the hard drives: Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 20 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 a. Remove each of the hard drives by pressing the dark red buttons to unlatch the drive carrier handles. Use the handles to pull the drives about halfway out of the B300 chassis. b. As you reinsert each of the drives, the carrier handles will begin to close. Close the handles (you will feel them lock) and fully insert the drives into the B300r1 by firmly pressing on the left and right edges of the front of the drive carriers. Even if no movement is felt, this helps to ensure that the disk is completely engaged. 3. Reattach the B300r1’s front bezel: a. Engage the left side of the faceplate first, taking care to align the stubs of the faceplate with the drilled holes in the left ear. b. Repeat on the right side and then tighten the set screw. Take care not to over tighten this screw. 4. Inspect the tamper-evident labels as described in Section 3.1.4 below. The tamper evident labels must be applied for the module to operate in a FIPS-Approved mode of operation. If you find a label that is questionable in appearance, contact Bomgar support toll-free at 1-877-826-6427 x2 or internationally at +01-601-519-0123 x2. 5. Follow the procedures included in the Hardware Setup Guide to install your B300 in your server rack. 6. After you have installed the B300r1 per the Hardware Setup Guide, refer to the included Bomgar Hardware Installation Guide to configure your network settings. 7. Once the B300r1’s network settings are correctly configured, return to Section 3.1.6.1 in this document to configure your B300r1 for FIPS mode. 3.1.4 B300r1 Label Inspection The B300 with tamper evident label kit – part#TEL135325 and front bezel – part#FB000300, will be shipped from the factory with six labels. Four labels are pre-applied at factory (see Figure 10 and Figure 12 below).Two labels are to be applied by the Crypto-Officer on chassis top and bottom overlapping the front bezel (see Figure 11 below). This is to allow the end-user to reseat the drives upon receipt before affixing the front bezel to the appliance. Upon delivery, the Crypto-Officer should ensure that the module was not tampered with during shipment and that the labels have been applied properly. Also, tamper evident labels shall be routinely inspected for damage by the Crypto-Officer. If the Crypto-Officer finds a label that is questionable in appearance, contact Bomgar support toll-free at 1-877-826-6427 x2 or internationally at +01-601-519-0123 x2. If any additional labels are needed contact Bomgar support toll-free at 1-877-826-6427 x2 or internationally at +01-601-519-0123 x2 with part# TEL135325. The Crypto-Officer is also responsible for securing and having control of the additional tamper evident labels at all time. 1. Inspect all tamper-evident labels that shipped pre-applied to the B300r1 chassis (see Figure 10 below), ensuring that each label shows no sign of tampering and is properly placed. Any attempt to reposition or remove the label will result in the voiding of that label and leave a residue on the surface. If you find a label that is questionable in appearance, contact Bomgar support toll-free at 1-877-826-6427 x2 or internationally at +01-601-519-0123 x2. 2. To apply the front bezel labels, first you must clean the top surface and front bezel of the B300 with isopropyl alcohol in the area where the tamper-evident labels will be placed. 3. Holding the label by the edges, place the label on the surface as indicated in Figure 11 and Figure 12. 4. Apply the included tamper-evident labels by rubbing gently across the entire label to ensure adhesion to the surface. NOTE: Any attempt to reposition or remove the label will result in the voiding of that label and leave a residue on the surface. 5. Allow the labels to fully adhere to the B300r1 within 24 hours in a physically secure environment before placing the B300 in the intended environment. Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 21 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Pre-Applied Pre-Applied Tamper Tamper Evident Evident Label 2 Label 1 Figure 10 – Rear Metallic Bezel Seal (Left) and Sealed Top Cover (Right) Tamper Tamper Evident Evident Label 4 Label 3 Figure 11 – Sealed Front Bezel to Chassis Top (Left) and Sealed Front Bezel to Chassis Bottom (Right) Pre-Applied Tamper Evident Label 6 Pre-Applied Tamper Evident Label 5 Figure 12 – Sealed Top Chassis to Left Power Supply (Left) and Sealed Top Chassis to Right Power Supply (Right) Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 22 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 3.1.5 B400r1 Hardware Setup In order to set up the Bomgar B400r1, the following steps will need to be performed by the Crypto-Officer: 1. Unpack the B400r1. 2. Reseat the hard drives: a. Remove each of the hard drives by pressing the dark red buttons to unlatch the drive carrier handles. Use the handles to pull the drives about halfway out of the B400r1 chassis. b. As you reinsert each of the drives, the carrier handles will begin to close. Close the handles (you will feel them lock) and fully insert the drives into the B400r1 by firmly pressing on the left and right edges of the front of the drive carriers. Even if no movement is felt, this helps to ensure that the disk is completely engaged. 3. Attach the B400r1’s front bezel by engaging first the left side of the faceplate and then the right side. 4. Inspect the tamper-evident labels as described in Section 3.1.6 below. The tamper evident labels must be applied for the module to operate in a FIPS-Approved mode of operation. If you find a label that is questionable in appearance, contact Bomgar support toll-free at 1-877-826-6427 x2 or internationally at +01-601-519-0123 x2. 5. Follow the procedures included in the Hardware Setup Guide to install your B400 in your server rack. 6. After you have installed the B400r1 per the Hardware Setup Guide, refer to the included Bomgar Hardware Installation Guide to configure your network settings. 7. Once the B400r1’s network settings are correctly configured, return to Section 3.1.6.1 in this document to configure your B400r1 for FIPS mode. 3.1.6 B400r1 Label Inspection and Application The B400r1 with tamper evident label kit – part#TEL135325 and front bezel – part#FB000400, will be shipped from the factory with five labels. Three labels are pre-applied at factory (see Figure 13 and Figure 14 below). Two labels are to be applied by the Crypto-Officer on chassis top and bottom overlapping the front bezel (see Figure 15 below). This is to allow the end-user to reseat the drives upon receipt before affixing the front bezel to the appliance. Upon delivery, the Crypto-Officer should ensure that the module was not tampered with during shipment and that the labels have been applied properly. Also tamper-evident labels shall be routinely inspected for damage by the Crypto-Officer. If the Crypto-Officer finds a label that is questionable in appearance, contact Bomgar support toll-free at 1-877-826-6427 x2 or internationally at +01-601-519-0123 x2. If any additional labels are needed contact Bomgar support toll-free at 1-877-826-6427 x2 or internationally at +01-601-519-0123 x2 with part# TEL135325. The Crypto-Officer is responsible for securing and having control of the additional tamper evident labels at all time 1. Inspect all tamper-evident labels that shipped pre-applied to the B400r1 chassis (see Figure 13 and Figure 14 below), ensuring that each label shows no sign of tampering and is properly placed. Any attempt to reposition or remove the label will result in the voiding of that label and leave a residue on the surface. If you find a label that is questionable in appearance, contact Bomgar support toll-free at 1-877-826-6427 x2 or internationally at +01-601-519-0123 x2. 2. To apply the front bezel labels, first you must clean the top surface and front bezel of the B400r1 with isopropyl alcohol in the area where the tamper-evident labels will be placed. 3. Holding the label by the edges, place the label on the surface as indicated in Figure 15 below. 4. Apply the included tamper-evident labels by rubbing gently across the entire label to ensure adhesion to the surface. NOTE: Any attempt to reposition or remove the label will result in the voiding of that label and leave a residue on the surface. 5. Allow the labels to fully adhere to the B400r1 within 24 hours in a physically secure environment before placing the B400r1 in the intended environment. Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 23 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Pre-Applied Tamper Evident Label 1 Figure 13 – Sealed Top Cover Pre-Applied Tamper Evident Label 3 Pre-Applied Tamper Evident Label 2 Figure 14 – Sealed power supply #1 to chassis bottom (Left) and Sealed power supply #2 to chassis top (Right) Tamper Evident Tamper Evident Label 5 Label 4 Figure 15 – Sealed front bezel to chassis bottom (Left) and Sealed front bezel to chassis top (Right) Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 24 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 3.1.6.1 B200, B300r1, and B400r1 FIPS Mode Configuration Once all necessary initialization procedures have been performed as described in the preceding sections, the modules need to be configured to comply with FIPS 140-2 requirements. Once configured as described in this section, the modules will be considered to be in FIPS-Approved mode, which can be verified at any time by viewing the IP Configuration page and the SSL Configuration page and ensuring they match Figure 16 and Figure 17 below. FIPS-Approved Mode Configuration Log into the Bomgar Appliance Administrative Interface (e.g., support.example.com/appliance) and configure your settings as described below23: Navigate to the IP Configuration page under the Networking tab (see Figure 16 below). 1. Click the default 169.254.1.1 IP address to edit it. 2. Set the Telnet Server setting to Simplified. 3. Click the Save Changes button to commit these configuration changes. 4. Figure 16 – IP Configuration Page Navigate to the SSL Configuration page under the Security tab (see Figure 17 below). 5. Disable SSLv2 by ensuring that the Allow SSL v2 checkbox is cleared. 6. Disable SSLv3 by ensuring that the Allow SSL v3 checkbox is cleared. 7. 8. Ensure that only FIPS-Approved cipher suites are enabled: TLS_RSA_WITH_AES_256_CBC_SHA • TLS_RSA_WITH_AES_128_CBC_SHA • TLS_RSA_WITH_3DES_EDE_CBC_SHA • Click the Save button to commit these configuration changes. 9. 10. Navigate to Basics under Status tab and click on Reboot This Appliance (see Figure 18 below). 23 NOTE: The module comes preloaded with a default password. The Crypto-Officer is responsible for changing this password before proceeding with the configuration steps. Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 25 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Figure 17 – SSL Configuration Page 3.1.7 Firmware/Software Version Verification To ensure that the modules are running the validated versions of the module Firmware and Software, operators should compare the running versions to those documented in this Security Policy. To obtain the version of the Firmware, an operator must visit the /appliance site, which is the interface used by the Crypto-Officer. To obtain the software version, an operator must visit the /login site, which requires the use of the credentials of the Instance-Admin role. Upon signing in, both display the Status page by default, showing the version number (“3.3.2fips (FIPS 140-2) (38611)” and “12.1.6fips (38611)”). 3.2 FIPS Mode Compliance Any time the modules deviate from the configuration detailed in Section 3.1.6.1 above, the modules will be considered to be in a non-FIPS-Approved mode of operation. Additionally, the guidance provided below must be followed to ensure that the modules remain in a FIPS-Approved mode of operation. Failure to do so will result in non-compliance. When entering OR leaving FIPS-Approved mode, navigate to the Basics page under the Status tab of the /appliance • interface and clear all existing CSPs by clicking the Reset Appliance to Factory Defaults button. NOTE: All Firmware and Software will be completely uninstalled after reset. Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 26 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Figure 18 – Status Basics Page Never install software or firmware versions other than those listed on the cover page of this security policy. Only the • software and firmware versions listed are considered part of the validated configuration. When using the module’s administrative interface, do not use the Advanced Support page under the Support tab of • the /appliance interface. Doing so will result in non-compliance. Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 27 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Figure 19 – Advanced Support Page Enforce minimum password requirements for the Instance-Admin and Instance-User roles using the Security page • under the Management tab of the /login interface. Figure 20 – Security Page When using the management interface, do not use the Support page under the Management tab of the /login • interface. Figure 21 – Support Page Never install a Bomgar software package via the Software Management page under the Management tab of the • /login interface. Instead, ensure that any received Bomgar software packages are FIPS-Approved, and upload them Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 28 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 from the Updates page under the Support tab of the appliance administrative interface (e.g. support.example.com/appliance). You should always upload updates manually rather than using the auto-update feature. Do not use the Appliance Key Check for Updates functionality. To maintain compliance, only the software update versions listed in this security policy are to be used. 3.3 Crypto-Officer Guidance The Crypto-Officer can initiate the execution of self-tests and can access the module’s status reporting capability. Self-tests can be initiated at any time by power cycling the modules. 3.3.1 Management It is the responsibility of the Crypto-Officer to ensure that the modules are set up to run securely. Please refer to Section 3.2 above for guidance that the Crypto-Officer must follow for the modules to be considered in a FIPS-Approved mode of operation. Additionally, the Crypto-Officer should be careful to protect any secret/private keys in their possession. For details regarding the management of the modules, please refer to the appropriate Bomgar Appliance Administrative User’s Guide. 3.3.2 Status Monitoring Error message and status review is the responsibility of the Crypto-Officer. When any of a module’s self-tests fail, the module reports an error message which can be viewed over a network connection. This connection is set using the IP Configuration page under the Networking tab as shown in Figure 16 in Section 3.1.6.1 above. Issuing the command "telnet [ip-address- assigned-to-network-port]" brings up the following options: 1. Show Error Message 2. Shutdown the Device 3. Reboot the Device 4. Reset the Device to Factory Default 5. Done Issuing the Show Error Message command will display the reported error message. 3.3.3 Zeroization Session keys are zeroized at the termination of the session but are also cleared when the module is power-cycled. All other CSPs may be zeroized by either: issuing the Reset Appliance to Factory Defaults command (found on the Basics page under the Status tab of the • /appliance interface) and rebooting the module, or selecting the Reset the Device to Factory Default option from a telnet session and rebooting the module. • The zeroization of keys and CSPs is immediate, providing insufficient time for an attacker to compromise them. The Crypto- Officer must wait until the module has successfully rebooted in order to verify that zeroization has completed. 3.4 Instance-Admin and Instance-User Guidance The Instance-Admins do not have the ability to configure sensitive information on the modules, with the exception of the Instance-User and their own passwords. The Instance-Admin has the ability to configure the password strength policy for Instance-Admins and Instance-Users. Please refer to Section 3.2 above for guidance that should be followed for the modules to be considered in a FIPS-Approved mode of operation. Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 29 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Instance-Users do not have the ability to configure sensitive information on the modules, with the exception of their own passwords. The Instance-Admins and Instance-Users must employ strong passwords that meet or exceed the password strength requirements documented in Section 2.4.6 of this document and must not reveal their passwords to anyone. Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 30 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 4 Acronyms This section describes the acronyms used in this document. Table 9 – Acronyms Acronym Definition AD Active Directory AES Advanced Encryption Standard ANSI American National Standards Institute API Application Programming Interface CBC Cipher Block Chaining CFB Cipher Feedback CMVP Cryptographic Module Validation Program CO Crypto-Officer CSEC Communication Security Establishment Canada CSP Critical Security Parameter DMZ Demilitarized Zone ECB Electronic Codebook EDC Error Detection Code EMC Electromagnetic Compatibility EMI Electromagnetic Interference FIPS Federal Information Processing Standard HDD Hard Disk Drive HMAC (Keyed-) Hash Message Authentication Code HTTP Hypertext Transfer Protocol HTTPS Hypertext Transfer Protocol over TLS IP Internet Protocol KAT Known Answer Test LAN Local Area Network LDAP Lightweight Directory Access Protocol LED Light Emitting Diode MD Message Digest N/A Not Applicable NIST National Institute of Standards and Technology OFB Output Feedback PCI Peripheral Component Interconnect PKCS Public Key Cryptography Standard Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 31 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice. September 10th, 2012 Security Policy, Version 1.6 Acronym Definition POS Point of Sale PRNG Pseudo Random Number Generator PSS Probabilistic Signature Scheme RAID Redundant Array of Independent Disks RC Rivest Cipher RNG Random Number Generator RSA Rivest, Shamir, and Adleman SHA Secure Hash Algorithm SNMP Simple Network Management Protocol SSL Secure Sockets Layer Triple-DES Triple Data Encryption Standard TLS Transport Layer Security UID Unit Identifier USB Universal Serial Bus WAN Wide Area Network Bomgar B200, B300r1, and B400r1 Remote Support Appliances Page 32 of 32 © 2012 Bomgar Corporation This document may be freely reproduced and distributed whole and intact including this copyright notice.