Maintenance Report SonicWALL SonicOS v5.5.1

Maintenance Report

Issued by:

Communications Security Establishment Canada

Certification Body

Canadian Common Criteria Evaluation and Certification Scheme

© Government of Canada, Communications Security Establishment Canada, 2010

1 Introduction

SonicWALL, Inc. has submitted (via EWA-Canada) the Impact Analysis Report (IAR) for SonicWALL SonicOS v5.5.1, satisfying the requirements outlined in Version 1.0 of the Common Criteria document CCIMB-2004-02-009: Assurance Continuity: CCRA Requirements. In accordance with those requirements, the IAR describes the changes made to SonicWALL SonicOS v5.0.1 (the maintained Target of Evaluation), the evidence updated as a result of the changes and the security impact of the changes.

2 Description of changes to the TOE

The changes in the SonicWALL SonicOS v5.5.1 comprise bug fixes and performance improvements outside of the scope of the original evaluation. For each change, it was verified that there were no required changes to the security functional requirements in the ST, and thorough functional and regression testing was conducted by the developer to ensure that the assurance in the Target of Evaluation (TOE) was maintained.

3 Description of Changes to the IT Environment

Changes to the IT environment's hardware consist of the dropping of some existing hardware platforms, and the addition of new hardware platforms, as follows:

4 Affected developer evidence

Modifications to the product necessitated changes to a subset of the developer evidence that was previously submitted for the TOE. The set of affected developer evidence was identified in the IAR.

5 Conclusions

All changes to the TOE were bug fixes and performance improvements, as well as the addition of new hardware platforms. Through functional and regression testing of the SonicWALL SonicOS v5.5.1, assurance gained in the original TOE certification was maintained. As all of the changes to the TOE have been classified as minor, it is the conclusion of the CB that the maintained TOE is appropriate for assurance continuity and re-evaluation is not required.

6 References

Assurance Continuity: CCRA Requirements, CCIMB-2004-02-009, version 1.0, February 2004

Technical Oversight for Assurance Continuity of a Certified TOE, version 1.2, October 2005

Certification Report EAL 4+ Evaluation of SonicOS v5.0.1 on NSA Series and TZ Series Appliances

Notes

• [1] The cryptographic module is in the process of FIPS 140-2 validation under the Cryptographic Module Validation Program (CMVP). Information regarding the status of the module validation can be found on the NIST website.