Akamai KSD Service Impact Level 2 ALG Security Technical Implementation Guide

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: [email protected]

Details

Version / Release: V1R1

Published: 2017-09-15

Updated At: 2018-09-23 19:11:48

Actions

Download

Filter


Findings
Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-91087r1_rule AKSD-WF-000001 CCI-001414 HIGH Kona Site Defender must immediately use updates made to policy enforcement mechanisms to enforce that all traffic flows over HTTPS port 443. Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in
    SV-91089r1_rule AKSD-WF-000002 CCI-001414 HIGH Kona Site Defender must immediately apply updates to the Kona Rule Set to block designated traffic of interest in response to new or emerging threats. Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in
    SV-91091r1_rule AKSD-WF-000003 CCI-001414 MEDIUM Kona Site Defender must immediately use updates made to policy enforcement mechanisms to block traffic from organizationally defined geographic regions. Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in
    SV-91093r1_rule AKSD-WF-000004 CCI-001414 MEDIUM Kona Site Defender must immediately use updates made to policy enforcement mechanisms to block traffic from organizationally defined IP addresses (i.e., IP blacklist). Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in
    SV-91095r1_rule AKSD-WF-000005 CCI-001414 MEDIUM Kona Site Defender must immediately use updates made to policy enforcement mechanisms to allow traffic from organizationally defined IP addresses (i.e., IP whitelist). Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in
    SV-91097r1_rule AKSD-WF-000007 CCI-000068 HIGH Kona Site Defender that provides intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52. NIST SP 800-52 provides guidance on using the most secure version and configuration of the TLS/SSL protocol. Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that e
    SV-91099r1_rule AKSD-WF-000009 CCI-002346 MEDIUM To protect against data mining, Kona Site Defender providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields. Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of inform
    SV-91101r1_rule AKSD-WF-000010 CCI-002346 MEDIUM To protect against data mining, Kona Site Defender providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code. Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of inform
    SV-91103r1_rule AKSD-WF-000011 CCI-002346 MEDIUM To protect against data mining, Kona Site Defender providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields. Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of inform
    SV-91105r1_rule AKSD-WF-000012 CCI-002347 MEDIUM To protect against data mining, Kona Site Defender providing content filtering must detect code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields. Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks launched against organizational databases may result in the compromise of information. Injection attacks allow a
    SV-91107r1_rule AKSD-WF-000013 CCI-002347 MEDIUM To protect against data mining, Kona Site Defender providing content filtering must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields. Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks launched against organizational databases may result in the compromise of information. SQL injection attacks are
    SV-91109r1_rule AKSD-WF-000014 CCI-002347 MEDIUM To protect against data mining, Kona Site Defender providing content filtering as part of its intermediary services must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code. Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks launched against organizational applications may result in the compromise of information. Injection attacks allo
    SV-91111r1_rule AKSD-WF-000015 CCI-001851 MEDIUM Kona Site Defender must off-load audit records onto a centralized log server. Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. This does not apply to audit logs generated on behalf of the
    SV-91113r1_rule AKSD-WF-000016 CCI-001851 LOW Kona Site Defender must off-load audit records onto a centralized log server in real time. Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. Off-loading is a common process in information s
    SV-91115r1_rule AKSD-WF-000018 CCI-000804 MEDIUM Kona Site Defender must not strip origin-defined HTTP session headers. Lack of authentication enables anyone to gain access to the network or possibly a network element that provides the opportunity for intruders to compromise resources within the network infrastructure. By identifying and authenticating non-organizational u
    SV-91117r1_rule AKSD-WF-000019 CCI-002385 MEDIUM Kona Site Defender providing content filtering must protect against known and unknown types of denial-of-service (DoS) attacks by employing rate-based attack prevention behavior analysis. If the network does not provide safeguards against DoS attacks, network resources may not be available to users during an attack. Installation of content filtering gateways and application layer firewalls at key boundaries in the architecture mitigates t
    SV-91119r1_rule AKSD-WF-000020 CCI-002385 MEDIUM Kona Site Defender providing content filtering must protect against known types of denial-of-service (DoS) attacks by employing signatures. If the network does not provide safeguards against DoS attacks, network resources may not be available to users during an attack. Installation of content filtering gateways and application layer firewalls at key boundaries in the architecture mitigates t
    SV-91121r1_rule AKSD-WF-000021 CCI-000366 MEDIUM Kona Site Defender that provides intermediary services for HTTP must inspect inbound and outbound HTTP traffic for protocol compliance and protocol anomalies. Application protocol anomaly detection examines application layer protocols such as HTTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and un
    SV-91123r1_rule AKSD-WF-000022 CCI-002450 HIGH Kona Site Defender providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes. Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides ass
    SV-91125r1_rule AKSD-WF-000023 CCI-002450 MEDIUM Kona Site Defender providing encryption intermediary services must implement NIST FIPS-validated cryptography for digital signatures. Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides ass
    SV-91127r1_rule AKSD-WF-000024 CCI-002450 HIGH Kona Site Defender providing encryption intermediary services must use NIST FIPS-validated cryptography to implement encryption services. Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides ass
    SV-91129r1_rule AKSD-WF-000025 CCI-002470 HIGH Kona Site Defender providing user authentication intermediary services using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of protected sessions. Non-DoD approved PKIs have not been evaluated to ensure that they have security controls and identity vetting procedures in place that are sufficient for DoD systems to rely on the identity asserted in the certificate. PKIs lacking sufficient security con
    SV-91131r1_rule AKSD-WF-000026 CCI-001240 MEDIUM Kona Site Defender providing content filtering must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures. Malicious code protection mechanisms include but are not limited to anti-virus and malware detection software. To minimize any potential negative impact to the organization caused by malicious code, malicious code must be identified and eradicated. Malici
    SV-91133r1_rule AKSD-WF-000028 CCI-001243 MEDIUM Kona Site Defender providing content filtering must block malicious code upon detection. Taking an appropriate action based on local organizational incident handling procedures minimizes the impact of malicious code on the network. This requirement is limited to ALGs, web content filters, and packet inspection firewalls that perform maliciou
    SV-91135r1_rule AKSD-WF-000030 CCI-001243 MEDIUM Kona Site Defender providing content filtering must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection. Without an alert, security personnel may be unaware of an impending failure of the audit capability. This will impede the ability to perform forensic analysis and detect rate-based and other anomalies. The ALG generates an immediate (within seconds) aler
    SV-91137r1_rule AKSD-WF-000032 CCI-002656 LOW Kona Site Defender providing content filtering must be configured to integrate with a system-wide intrusion detection system. Without coordinated reporting between separate devices, it is not possible to identify the true scale and possible target of an attack. Integration of the ALG with a system-wide intrusion detection system supports continuous monitoring and incident respo
    SV-91139r1_rule AKSD-WF-000033 CCI-002661 MEDIUM Kona Site Defender providing content filtering must continuously monitor inbound communications traffic crossing internal security boundaries for unusual or unauthorized activities or conditions. If inbound communications traffic is not continuously monitored, hostile activity may not be detected and prevented. Output from application and traffic monitoring serves as input to continuous monitoring and incident response programs. Internal monitori
    SV-91141r1_rule AKSD-WF-000034 CCI-002664 MEDIUM Kona Site Defender providing content filtering must send an alert to, at a minimum, the ISSO and ISSM when detection events occur. Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. Since these incidents require immediate action, these messages are assigne
    SV-91143r1_rule AKSD-WF-000035 CCI-002664 MEDIUM Kona Site Defender providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources (e.g., IAVMs or CTOs) are detected. Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The ALG generates an alert that notifies designated personnel of the Indic
    SV-91145r1_rule AKSD-WF-000036 CCI-002664 MEDIUM Kona Site Defender providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected. Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The ALG generates an alert that notifies designated personnel of the Indic
    SV-91147r1_rule AKSD-WF-000037 CCI-001310 MEDIUM Kona Site Defender must check the validity of all data inputs except those specifically identified by the organization. Invalid user input occurs when a user inserts data or characters into an application's data entry fields and the application is unprepared to process that data. This results in unanticipated application behavior, potentially leading to an application or i
    SV-91149r1_rule AKSD-WF-000039 CCI-001314 HIGH Kona Site Defender must reveal error messages only to the ISSO, ISSM, and SCA. Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can give configuration details about the network element. Limiting access to system logs and admi
    SV-91151r1_rule AKSD-WF-000055 CCI-002403 MEDIUM Kona Site Defender must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations. Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources. Access control policies and access c