PRODUCT DESCRIPTION

The TOE is webMethods Fabric 6.5, a software product that facilitates the secure exchange of data and logic among resources and supports the development and management of complex business processes through browser or web-enabled interfaces.

The TOE consists of two primary components:

• “Integration Server” – enables access control over the integration logic through the integrated applications;
• “Broker” – a high-speed message router which enables access control over asynchronous messaging.

And two secondary components:

• “Host Adapters” – zero or more special modules that link back-end resources with the Integration Server;
• “Developer” – a graphical Integrated Development Environment (IDE) tool used by administrators to build, edit and test integration logic.

SECURITY EVALUATION SUMMARY

The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) processes and procedures. webMethods Fabric 6.5 was evaluated against the criteria contained in the Common Criteria for Information Technology Security Evaluation, Version 2.2. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 2.2. CygnaCom Solutions has determined that the product meets the security criteria in the Security Target, which specifies an assurance level of EAL2. A validator, on behalf of the CCEVS Validation Body, monitored the evaluation. The evaluation was completed in December 2005.

ENVIRONMENTAL STRENGTHS

The TOE provides the following security services:

• Access Control Policy – the TOE enforces a discretionary information flow control policy to control access to services and documents based on users and groups.
• Identification and Authentication – the TOE allows only users who have been successfully identified and authenticated (authorized administrators) to access security-relevant functionality, including viewing audit records.
• Security Management – the TOE supports an administrative role to perform security management, including the management of interaction between TOE components and control of service configuration and development.
• Self Protection – the TOE ensures that all information must flow through policy enforcement mechanisms and protects its programs and data from unauthorized access through its own interfaces.
• Security Audit – the TOE generates audit information for security-relevant events and enables authorized administrators to view the audit records.

Vendor Information

WebMethods, Inc.
Jeremy Epstein
703.460.5852
703.460.2599 (Fax)
jeremy.epstein@webmethods.com

http://www.webmethods.com