Aruba achieves cyber security first with Common Criteria certification for network access control solutions

Aruba, a Hewlett Packard Enterprise company (NYSE:HPE), today announced that Aruba ClearPass is the first in the cyber security industry to be awarded Common Criteria certification for a network access control (NAC) solution, under both the Network Device Collaborative Protection Profile1 and the Extended Package for Authentication Servers2 modules.

ClearPass is also the industry's first NAC solution to receive certification as an authentication server.

With this advanced Common Criteria certification, governed by ISO/IEC standards bodies and awarded by the National Information Assurance Partnership (NIAP), Aruba ClearPass was validated through an independent testing laboratory to ensure it adheres to strict government and defence cyber security standards.

ClearPass empowers IT teams with the ability to intelligently profile, authenticate, and authorise users, systems, and devices to access network and IT resources. ClearPass allows government agencies and private organisations to rely on Common Criteria certification as assurance for providing a global, independent, and certifiable cyber security baseline.

Mobile, cloud, and IOT have imposed new demands on cyber security professionals. Aruba ClearPass is designed for this new era of threats and it was awarded Common Criteria certification for the Network Device Collaborative Protection Profile after completing tests focused on a set of demanding security requirements that mitigate a series of well-defined threats. Tests replicate real-world threat situations covering all aspects of access control including encryption, physical security, certificate validation, and processing, along with TLS/SSL processing. NDcPP represents a security baseline for any network-connected device or system.

As an important complement to NDcPP, Aruba ClearPass received Common Criteria certification for the Extended Package for Authentication Servers module. This extended package assesses functionality specific to RADIUS authentication servers, and qualifies ClearPass to appear on the approved product list for the US National Security Agency's Commercial Solutions for Classified (CSfC) program. US government customers deploying classified communications systems under the CSfC program may use ClearPass to securely authenticate user and device access over wired, WiFi, and remote connections.

Aruba's certification was granted by the NIAP, which is a United States government initiative that oversees a national programme to evaluate commercial off-the-shelf (COTS) IT products for conformance to the internationally recognised Common Criteria security testing standards. Tests were performed by Gossamer Security Solutions, one of the world's most renowned security testing laboratories.

Common Criteria is a global standard to which security products are evaluated on behalf of both government agencies and private sector organisations which are focused on dealing with an increasingly complex and dangerous threat environment. Certifications are universally recognised by 28 nations and products certified in one country are recognised by all other countries. NIAP also works with NATO and international standards bodies (ISO) to share Common Criteria evaluation experiences and increase efficiencies by avoiding the duplication of efforts. To learn more, visit the NIAP portal.

"Common Criteria validation provides the highest level of security certification an organisation can receive, which elevates Aruba network access control to new levels," said Jon Green, CTO for Security at Aruba, a Hewlett Packard Enterprise company. "Securing enterprises for the mobile, cloud, and IOT era has never been this challenging. The certification demonstrates Aruba's commitment to providing customers with the industry's most secure solutions for multi-vendor, wired, and WiFi network infrastructures, even if it's not an Aruba network."

"Government agencies and enterprise organisations alike continue to seek clarity through the chaos caused by the increasingly complex and sophisticated threat landscape," said Bill Buckalew, vice-president of partner sales for Optiv, a Denver-based market-leading provider of end-to-end cyber security solutions. "We are pleased Aruba was first to receive certification status for such a well-established security standard like Common Criteria. Efforts like this from our key technology partners, such as Aruba, play an important role in enabling Optiv to perform comprehensive security optimisation - from strategy and planning straight through to implementation and management - for our clients."