Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

DBN-6300 IDPS Security Technical Implementation Guide

V1R2 · · · Released 24 Jul 2024 · 17 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.
Digest of Updates vs. V1R1 · 12 Sep 2017 +17 −16

Comparison against the immediately-prior release (V1R1). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Added rules 17

  • V-237556 Medium In the event of a logging failure, caused by loss of communications with the central logging server, the DBN-6300 must queue audit records locally until communication is restored or until the audit records are retrieved manually or using automated synchronization tools.
  • V-237557 Medium In the event of a logging failure caused by the lack of log record storage capacity, the DBN-6300 must continue generating and storing audit records if possible, overwriting the oldest audit records in a first-in-first-out manner.
  • V-237558 Medium The DBN-6300 must generate log events for detection events based on anomaly analysis.
  • V-237559 Medium The DBN-6300 must install system updates when new releases are available in accordance with organizational configuration management policy and procedures.
  • V-237560 Medium To help detect unauthorized data mining, the DBN-6300 must detect code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
  • V-237561 Medium To protect against unauthorized data mining, the DBN-6300 must monitor for and detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
  • V-237562 Medium To protect against unauthorized data mining, the DBN-6300 must detect SQL code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
  • V-237563 Medium To protect against unauthorized data mining, the DBN-6300 must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code/input fields.
  • V-237564 Medium To protect against unauthorized data mining, the DBN-6300 must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
  • V-237565 Medium The DBN-6300 must support centralized management and configuration of the content captured in audit records generated by all DBN-6300 components.
  • V-237566 Medium The DBN-6300 must off-load log records to a centralized log server.
  • V-237567 Medium The DBN-6300 must integrate with a network-wide monitoring capability.
  • V-237568 Medium The DBN-6300 must continuously monitor inbound communications traffic between the application tier and the database tier for unusual/unauthorized activities or conditions at the SQL level.
  • V-237569 Medium The DBN-6300 must off-load log records to a centralized log server in real time.
  • V-237570 Medium When implemented for protection of the database tier, the DBN-6300 must be logically connected for maximum database traffic visibility.
  • V-237571 Medium When implemented for discovery protection against unidentified or rogue databases, the DBN-6300 must provide a catalog of all visible databases and database services.
  • V-264430 High The DBN-6300 IDPS must be using a version supported by the vendor.

Removed rules 16

  • V-64977 Medium To help detect unauthorized data mining, the DBN-6300 must detect code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
  • V-64999 Medium In the event of a logging failure, caused by loss of communications with the central logging server, the DBN-6300 must queue audit records locally until communication is restored or until the audit records are retrieved manually or using automated synchronization tools.
  • V-65001 Medium In the event of a logging failure caused by the lack of log record storage capacity, the DBN-6300 must continue generating and storing audit records if possible, overwriting the oldest audit records in a first-in-first-out manner.
  • V-65003 Medium The DBN-6300 must generate log events for detection events based on anomaly analysis.
  • V-65005 Medium The DBN-6300 must install system updates when new releases are available in accordance with organizational configuration management policy and procedures.
  • V-65007 Medium To protect against unauthorized data mining, the DBN-6300 must monitor for and detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
  • V-65009 Medium To protect against unauthorized data mining, the DBN-6300 must detect SQL code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
  • V-65011 Medium To protect against unauthorized data mining, the DBN-6300 must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code/input fields.
  • V-65013 Medium To protect against unauthorized data mining, the DBN-6300 must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
  • V-65015 Medium The DBN-6300 must support centralized management and configuration of the content captured in audit records generated by all DBN-6300 components.
  • V-65017 Medium The DBN-6300 must off-load log records to a centralized log server.
  • V-65019 Medium The DBN-6300 must integrate with a network-wide monitoring capability.
  • V-65021 Medium The DBN-6300 must continuously monitor inbound communications traffic between the application tier and the database tier for unusual/unauthorized activities or conditions at the SQL level.
  • V-65023 Medium The DBN-6300 must off-load log records to a centralized log server in real time.
  • V-65025 Medium When implemented for protection of the database tier, the DBN-6300 must be logically connected for maximum database traffic visibility.
  • V-65059 Medium When implemented for discovery protection against unidentified or rogue databases, the DBN-6300 must provide a catalog of all visible databases and database services.
Sort by
b
In the event of a logging failure, caused by loss of communications with the central logging server, the DBN-6300 must queue audit records locally until communication is restored or until the audit records are retrieved manually or using automated synchronization tools.
AU-5 - Medium - CCI-000140 - V-237556 - SV-237556r645496_rule
RMF Control
AU-5
Severity
M
CCI
CCI-000140
Version
DBNW-IP-000009
Vuln IDs
  • V-237556
  • V-64999
Rule IDs
  • SV-237556r645496_rule
  • SV-79489
It is critical that when the IDPS is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure. The DBN-6300 performs a critical security function; therefore, its continued operation is imperative. Since availability of the DBN-6300 is an overriding concern, shutting down the system in the event of an audit failure should be avoided, except as a last resort. The SYSLOG protocol does not support automated synchronization; however, this functionality may be provided by Network Management Systems (NMSs), which are not within the scope of this STIG.
Checks: C-40775r645494_chk

Audit records are automatically backed up on a real-time basis via syslog when enabled. Verify the DBN-6300 is connected to the syslog server. Navigate to Settings >> Advanced >> Syslog. Verify that the syslog services are set to "on", the syslog server information is valid, and the syslog server has connected. Navigate to Settings >> Advanced >> Audit Log and verify that the Audit Syslog, "Use System Syslog" button is set to "Yes" and the Audit Configuration Categories are all checked for Audit Log, Syslog, and Audit Console. Following this verification, process a successful account action (of any kind). Confirm the presence of a syslog message on the syslog server containing the information for whatever successful account action was taken. If the DBN-6300 is not connected to the syslog server, or if the syslog server is connected but the message containing the information that a successful account action that was taken and had just occurred is not there, this is a finding.

Fix: F-40738r645495_fix

Audit records are automatically backed up on a real-time basis via syslog when enabled. Verify the DBN-6300 is connected to the syslog server. Navigate to Settings >> Advanced >> Syslog. Verify that the syslog server information is valid and that the syslog server has connected. Navigate to Settings >> Advanced >> Audit Log and verify that the Audit Syslog, "Use System Syslog" button is set to "Yes" and the Audit Configuration Categories are all checked for Audit Log, Syslog, and Audit Console. When a network failure occurs, the audit records can be retrieved manually by downloading the records via the System State Report. This is done by navigating to Support - System State Report, "New Report" (file name is optional). A report will be generated. Using the download arrow on the right of the screen, download and examine the System State Report for the audit record showing the latest audit log.

b
In the event of a logging failure caused by the lack of log record storage capacity, the DBN-6300 must continue generating and storing audit records if possible, overwriting the oldest audit records in a first-in-first-out manner.
AU-5 - Medium - CCI-000140 - V-237557 - SV-237557r645499_rule
RMF Control
AU-5
Severity
M
CCI
CCI-000140
Version
DBNW-IP-000010
Vuln IDs
  • V-237557
  • V-65001
Rule IDs
  • SV-237557r645499_rule
  • SV-79491
It is critical that when the IDPS is at risk of failing to process audit logs as required, it takes action to mitigate the failure. The DBN-6300 performs a critical security function, so its continued operation is imperative. Since availability of the IDPS is an overriding concern, shutting down the system in the event of an audit failure should be avoided, except as a last resort.
Checks: C-40776r645497_chk

Audit records are automatically backed up on a real-time basis via syslog when enabled. Verify the DBN-6300 is connected to the syslog server. Navigate to Settings >> Advanced >> Syslog. Verify that the syslog services are set to "on", the syslog server information is valid, and the syslog server has connected. Navigate to Settings >> Advanced >> Audit Log and verify that the Audit Syslog, "Use System Syslog" button is set to "Yes" and the Audit Configuration Categories are all checked for Audit Log, Syslog, and Audit Console. Following this verification, process a successful account action (of any kind). Confirm the presence of a syslog message on the syslog server containing the information for whatever successful account action was taken. If the DBN-6300 is not connected to the syslog server, or if the syslog server is connected but the message containing the information that a successful account action that was taken and had just occurred is not there, this is a finding.

Fix: F-40739r645498_fix

Audit records are automatically backed up on a real-time basis via syslog when enabled. Verify the DBN-6300 is connected to the syslog server. Navigate to Settings >> Advanced >> Syslog. Verify that the syslog server information is valid and that the syslog server has connected. Navigate to Settings >> Advanced >> Audit Log and verify that the Audit Syslog, "Use System Syslog" button is set to "Yes" and the Audit Configuration Categories are all checked for Audit Log, Syslog, and Audit Console. When a network failure occurs, the audit records can be retrieved manually by downloading the records via the System State Report. This is done by navigating to Support - System State Report, "New Report" (file name is optional). A report will be generated. Using the download arrow on the right of the screen, download and examine the System State Report for the audit record showing the latest audit log.

b
The DBN-6300 must generate log events for detection events based on anomaly analysis.
AU-12 - Medium - CCI-000169 - V-237558 - SV-237558r645502_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
DBNW-IP-000012
Vuln IDs
  • V-237558
  • V-65003
Rule IDs
  • SV-237558r645502_rule
  • SV-79493
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. While auditing and logging are closely related, they are not the same. Logging is recording data about events that take place in a system, while auditing is the use of log records to identify security-relevant information such as system or user accesses. In short, log records are audited to establish an accurate history. Without logging, it would be impossible to establish an audit trail. The IDPS must have the capability to capture and log detected security violations and potential security violations.
Checks: C-40777r645500_chk

Verify the DBN-6300 is connected to the syslog server. Navigate to Settings >> Advanced >> Syslog. Verify that the syslog services are set to "on", the syslog server information is valid, and the syslog server has connected. If the DBN-6300 is not connected to the syslog server, or if the syslog server is connected when an event/alert occurs and this event does not appear in the syslog server, this is a finding.

Fix: F-40740r645501_fix

Configure the DBN-6300 to be connected to the syslog server. Navigate to Settings >> Advanced >> Syslog. Enter the syslog connection information (port and IP address) and push the "enabled" button for both "TCP" and "enable". Click on "Commit".

b
The DBN-6300 must install system updates when new releases are available in accordance with organizational configuration management policy and procedures.
SI-3 - Medium - CCI-001240 - V-237559 - SV-237559r982258_rule
RMF Control
SI-3
Severity
M
CCI
CCI-001240
Version
DBNW-IP-000024
Vuln IDs
  • V-237559
  • V-65005
Rule IDs
  • SV-237559r982258_rule
  • SV-79495
Failing to update malicious code protection mechanisms, including application software files, signature definitions, and vendor-provided rules, leaves the system vulnerable to exploitation by recently developed attack methods and programs. The IDPS is a key malicious code protection mechanism in the enclave infrastructure. To ensure this protection is responsive to changes in malicious code threats, IDPS components must be updated, including application software files, anti-virus signatures, detection heuristics, vendor-provided rules, and vendor-provided signatures. Updates must be installed in accordance with the CCB procedures for the local organization. However, at a minimum: 1. Updates designated as critical security updates by the vendor must be installed immediately. 2. Updates for signature definitions, detection heuristics, and vendor-provided rules must be installed immediately. 3. Updates for application software must be installed in accordance with the CCB procedures. 4. Prior to automatically installing updates, either manual or automated integrity and authentication checking is required, at a minimum, for application software updates.
Checks: C-40778r645503_chk

To verify the current version is installed, navigate to the main screen of the DBN-6300. View the current running code that is visible in the upper-right corner of the screen. Log on to the organization's DB Networks SFTP site and view the version number of the current release. If the current code version does not match the version of the latest available release, this is a finding.

Fix: F-40741r645504_fix

Configure the DBN-6300 for system updates. Log on to the DB Networks SFTP site reserved specifically for the organization using the site's unique logon and password issued by DB Networks administrators. Using the SFTP protocol, navigate to the latest system image. Download this image to a local file repository. The file cannot be downloaded directly to the DBN-6300. If the machine with access to the DB Networks SFTP site does not have access, the upgrade image, once tested, may be moved to a system that does have direct connectivity to the DBN-6300 to be upgraded. Click on Tools >> File Management and click the "Upload File" button. A file navigation window will open. Navigate to the upgrade file and start the file upload. When file upload is complete, select "Tools" and click on the "Updates" button. Select the upgrade file and click on "Upgrade". After the upgrade is complete, click on Admin >> System Control >> Restart Production Mode to restart the system.

b
To help detect unauthorized data mining, the DBN-6300 must detect code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
AC-23 - Medium - CCI-002346 - V-237560 - SV-237560r856496_rule
RMF Control
AC-23
Severity
M
CCI
CCI-002346
Version
DBNW-IP-000032
Vuln IDs
  • V-237560
  • V-64977
Rule IDs
  • SV-237560r856496_rule
  • SV-79467
Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks that use unauthorized data mining techniques to attack databases may result in the compromise of information. SQL Injection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database, or change data on a website. Web applications frequently access databases to store, retrieve, and update information. An attacker can construct inputs that the database will execute. This is most commonly referred to as a SQL injection attack. IDPS component(s) with the capability to detect code injections must be included in the IDPS implementation to detect unauthorized data mining. These components must include behavior-based anomaly detection algorithms to monitor for atypical database queries or accesses.
Checks: C-40779r645506_chk

View the organization's documentation to determine which databases are required to be protected. If the documentation does not exist, this is a finding. Navigate to Learning >> Time Regions and view the table of detected databases. For each database requiring protection, view the "State". Unprotected databases show a red shield. Protected databases show a green shield. If databases that are required to be protected are not being protected, this is a finding.

Fix: F-40742r645507_fix

Configure a database for SQL injection protection. Enable the SQL injection detection capabilities on the applicable interface for the database to be protected. Navigate to Admin >> Capture >> Capture Sources. Select the interface connected the network that contains the database traffic. Click on the "Enable" button and ensure the "Link up" indicator turns green. Map the database. Navigate to Database >> Database Mapping and find the database to be protected. Click on the check box on the left. Click on the first button at the top of the table which, when hovering over the button, is labeled “Map selected service to new db using their default names". The Mapping Status of the database will change to "Pending Mapping". On the left side of the screen above the label that says "showing", click the button with the arrow. The Mapping Status for the database will change to "Mapped". Note: The learning process requires enough database traffic to properly characterize normal application behavior. Navigate to Learning >> Time Regions and click on the left arrow to expand the window. Click on the plus sign to view the captured traffic. Organizations must capture a significant amount of traffic to enable the device to learn the traffic patterns. The vendor recommends at least three or more days of database traffic learning depending on the organization's traffic volume. Click the "Commit Learning" button on the lower right. View the "State" column of the database to verify the shield symbol is green.

b
To protect against unauthorized data mining, the DBN-6300 must monitor for and detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
AC-23 - Medium - CCI-002346 - V-237561 - SV-237561r856497_rule
RMF Control
AC-23
Severity
M
CCI
CCI-002346
Version
DBNW-IP-000034
Vuln IDs
  • V-237561
  • V-65007
Rule IDs
  • SV-237561r856497_rule
  • SV-79497
Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks that use unauthorized data mining techniques to attack databases may result in the compromise of information. The DBN-6300 is a passive listening device, and operates only as a detector, inspecting database traffic from a mirrored/SPAN port or tap for the purpose of analyzing every SQL statement visible on that network segment, and is therefore not in a position to block the flow of network traffic. Any blocking will be performed by a different device on the network based on the analysis provided by the DBN-6300. Protection against attacks launched against data storage objects, databases, database records and database fields will be managed by other devices, potentially based on information provided by the IDPS-6300.
Checks: C-40780r645509_chk

View the organization's documentation to determine which databases are required to be protected. If the documentation does not exist, this is a finding. Navigate to Learning >> Time Regions and view the table of detected databases. For each database requiring protection, view the "State". Unprotected databases show a red shield. Protected databases show a green shield. If databases that are required to be protected are not being protected, this is a finding.

Fix: F-40743r645510_fix

Configure a database for SQL injection protection. Enable the SQL injection detection capabilities on the applicable interface for the database to be protected. Navigate to Admin >> Capture >> Capture Sources. Select the interface connected to the network that contains the database traffic. Click on the Enable button and ensure the Link up indicator turns green. Map the database. Navigate to Database >> Database Mapping and find the database to be protected. Click on the check box on the left. Click on the first button at the top of the table which, when hovering over the button, is labeled "Map selected service to new db using their default names". The "Mapping Status" of the database will change to "Pending Mapping". On the left side of the screen above the label that says "showing", click the button with the arrow. The "Mapping Status" for the database will change to "Mapped". Note: The learning process requires enough database traffic to properly characterize normal application behavior. Navigate to Learning >> Time Regions and click on the left arrow to expand the window. Click on the plus sign to view the captured traffic. Organizations must capture a significant amount of traffic to enable the device to learn the traffic patterns. The vendor recommends at least three or more days of database traffic learning depending on the organization's traffic volume. Click the "Commit Learning" button on the lower right. View the "State" column of the database to verify the shield symbol is green.

b
To protect against unauthorized data mining, the DBN-6300 must detect SQL code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
AC-23 - Medium - CCI-002347 - V-237562 - SV-237562r856498_rule
RMF Control
AC-23
Severity
M
CCI
CCI-002347
Version
DBNW-IP-000035
Vuln IDs
  • V-237562
  • V-65009
Rule IDs
  • SV-237562r856498_rule
  • SV-79499
Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks that use unauthorized data mining techniques to attack databases may result in the compromise of information. Injection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database or change data on a website. Web applications frequently access databases to store, retrieve, and update information. An attacker can construct inputs that the database will execute. This is most commonly referred to as a code injection attack. This type of attack includes XPath and LDAP injections. IDPS component(s) with anomaly detection must be included in the IDPS implementation to protect against unauthorized data mining. These components must include rules and anomaly detection algorithms to monitor for atypical database queries or accesses.
Checks: C-40781r645512_chk

Verify that the DBN-6300 is configured to detect code injection attacks. Navigate to Application >> Time Learning. Validate that the database or databases of interest has/have the "state" shield set to green (in detection mode). If the "state" shield is not set to green, this is a finding (as the database or databases are not in detection mode).

Fix: F-40744r645513_fix

Configure the DBN-6300 to detect code injection attacks. Navigate to Application >> Time Learning. Validate that the database or databases of interest has the "state" shield set to green (in detection mode). If the "state" shield is not set to green: 1) Create a learned set (or new learned set) by clicking on the caret to the left of the database name; 2) Click on the "+" to the left of the "Time Periods" label; 3) Accept the default time period or enter the desired time period for the Learned Set; and 4) Click on "Commit Learning". This may take a small amount of time and will finish when the "Learned State" shows "Passed" and the "state" shield turns to green. Now the database is in protection mode for SQL injection attack.

b
To protect against unauthorized data mining, the DBN-6300 must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code/input fields.
AC-23 - Medium - CCI-002347 - V-237563 - SV-237563r856499_rule
RMF Control
AC-23
Severity
M
CCI
CCI-002347
Version
DBNW-IP-000036
Vuln IDs
  • V-237563
  • V-65011
Rule IDs
  • SV-237563r856499_rule
  • SV-79501
Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks that use unauthorized data mining techniques to attack applications may result in the compromise of information. Injection attacks allow an attacker to inject SQL code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database or change data on a website. IDPS component(s) with anomaly detection must be included in the IDPS implementation. These components must include behavior-based anomaly detection algorithms to monitor for atypical application behavior, which may include commands and accesses.
Checks: C-40782r645515_chk

View the organization's documentation to determine which databases are required to be protected. If the documentation does not exist, this is a finding. Navigate to Learning >> Time Regions and view the table of detected databases. For each database requiring protection, view the "State". Unprotected databases show a red shield. Protected databases show a green shield. If databases that are required to be protected are not being protected, this is a finding.

Fix: F-40745r645516_fix

Configure a database for SQL injection protection. Enable the SQL injection detection capabilities on the applicable interface for the database to be protected. Navigate to Admin >> Capture >> Capture Sources. Select the interface connected to the network that contains the database traffic. Click on the "Enable" button and ensure the "Link up" indicator turns green. Map the database. Navigate to Database >> Database Mapping and find the database to be protected. Click on the check box on the left. Click on the first button at the top of the table which, when hovering over the button, is labeled "Map selected service to new db using their default names". The "Mapping Status" of the database will change to "Pending Mapping". On the left side of the screen above the label that says "showing", click the button with the arrow. The "Mapping Status" for the database will change to "Mapped". Note: The learning process requires enough database traffic to properly characterize normal application behavior. Navigate to Learning >> Time Regions and click on the left arrow to expand the window. Click on the plus sign to view the captured traffic. Organizations must capture a significant amount of traffic to enable the device to learn the traffic patterns. The vendor recommends at least three or more days of database traffic learning depending on the organization's traffic volume. Click the "Commit Learning" button on the lower right. View the "State" column of the database to verify the shield symbol is green.

b
To protect against unauthorized data mining, the DBN-6300 must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
AC-23 - Medium - CCI-002347 - V-237564 - SV-237564r856500_rule
RMF Control
AC-23
Severity
M
CCI
CCI-002347
Version
DBNW-IP-000037
Vuln IDs
  • V-237564
  • V-65013
Rule IDs
  • SV-237564r856500_rule
  • SV-79503
Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks that use unauthorized data mining techniques to attack databases may result in the compromise of information. SQL injection attacks are the most prevalent attacks against web applications and databases. These attacks inject SQL commands that can read, modify, or compromise the meaning of the original SQL query. An attacker can spoof identity; expose, tamper, destroy, or make existing data unavailable; or gain unauthorized privileges on the database server. IDPS component(s) with anomaly detection must be included in the IDPS implementation to monitor for and detect unauthorized data mining. These components must include rules and anomaly detection algorithms to monitor for SQL injection attacks.
Checks: C-40783r645518_chk

View the organization's documentation to determine which databases are required to be protected. If the documentation does not exist, this is a finding. Navigate to Learning >> Time Regions and view the table of detected databases. For each database requiring protection, view the "State". Unprotected databases show a red shield. Protected databases show a green shield. If databases that are required to be protected are not being protected, this is a finding.

Fix: F-40746r645519_fix

Configure a database for SQL injection protection. Enable the SQL injection detection capabilities on the applicable interface for the database to be protected. Navigate to Admin >> Capture >> Capture Sources. Select the interface connected to the network that contains the database traffic. Click on the "Enable" button and ensure the "Link up" indicator turns green. Map the database. Navigate to Database >> Database Mapping and find the database to be protected. Click on the check box on the left. Click on the first button at the top of the table which, when hovering over the button, is labeled "Map selected service to new db using their default names". The "Mapping Status" of the database will change to "Pending Mapping". On the left side of the screen above the label that says "showing", click the button with the arrow. The "Mapping Status" for the database will change to "Mapped". Note: The learning process requires enough database traffic to properly characterize normal application behavior. Navigate to Learning >> Time Regions and click on the left arrow to expand the window. Click on the plus sign to view the captured traffic. Organizations must capture a significant amount of traffic to enable the device to learn the traffic patterns. The vendor recommends at least three or more days of database traffic learning depending on the organization's traffic volume. Click the "Commit Learning" button on the lower right. View the "State" column of the database to verify the shield symbol is green.

b
The DBN-6300 must support centralized management and configuration of the content captured in audit records generated by all DBN-6300 components.
AU-3 - Medium - CCI-001844 - V-237565 - SV-237565r982261_rule
RMF Control
AU-3
Severity
M
CCI
CCI-001844
Version
DBNW-IP-000038
Vuln IDs
  • V-237565
  • V-65015
Rule IDs
  • SV-237565r982261_rule
  • SV-79505
Without the ability to centrally manage the content captured in the log records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an attack. Centralized management and storage of log records increases efficiency in maintenance and management of records and facilitates the backup and archiving of those records. The IDPS must be configured to support centralized management and configuration of the content to be captured in audit records generated by all network components. IDPS sensors and consoles must have the capability to support centralized logging. They must be configured to send log messages to centralized, redundant servers and be capable of being remotely configured to change logging parameters (such as facility and severity levels). DB Networks can (and does) use Splunk as the current Security Operations Center (SOC) alert notification mechanism, which is driven off the syslog on the DB Networks DBN-6300.
Checks: C-40784r645521_chk

Verify integration with a network-wide monitoring capability. Obtain the IP address and port number for the centralized event management system (e.g., SIEM) from site personnel. Navigate to the "Admin" tab. Click on the "External Service Settings" button. Verify the IP address and port number for the centralized event management system are implemented. If the DBN-6300 is not configured to send syslog information to a centralized event management system that manages the DBN-6300 network-wide monitoring capability, this is a finding.

Fix: F-40747r645522_fix

Configure the DBN-6300 with syslog output to the SIEM. Navigate to the "Admin" tab. Click on the "External Service Settings" button. Enter the centralized event management system IP address and port number. Click on the "Commit" button to start the process.

b
The DBN-6300 must off-load log records to a centralized log server.
AU-4 - Medium - CCI-001851 - V-237566 - SV-237566r856502_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
DBNW-IP-000039
Vuln IDs
  • V-237566
  • V-65017
Rule IDs
  • SV-237566r856502_rule
  • SV-79507
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. This also prevents the log records from being lost if the logs stored locally are accidentally or intentionally deleted, altered, or corrupted.
Checks: C-40785r645524_chk

Audit records are automatically backed up on a real-time basis via syslog when enabled. Verify the DBN-6300 is connected to the syslog server. Navigate to Settings >> Advanced >> Syslog. Verify that the syslog services are set to "on", the syslog server information is valid, and the syslog server has connected. Navigate to Settings >> Advanced >> Audit Log. Verify that the Audit Syslog, "Use System Syslog" button is set to "Yes" and that the Audit Configuration Categories are all checked for Audit Log, Syslog, and Audit Console. Following this verification, process an account action. Confirm the presence of a syslog message on the syslog server containing the details of this account action. If the DBN-6300 is not connected to the syslog server, or if the syslog server is connected but the message containing the information with the details of this account action is not there, this is a finding.

Fix: F-40748r645525_fix

Configure the DBN-6300 to be connected to the syslog server. Also configure the DBN-6300 to include audit records in the syslog message feed. Navigate to Settings >> Advanced >> Syslog. Enter the syslog connection information (port and IP address) and push the "enabled" button for both "TCP" and "enable". Navigate to Settings >> Advanced >> Audit Log. Verify that the Audit Syslog, "Use System Syslog" button is set to "Yes" and that the Audit Configuration Categories are all checked for Audit Log, Syslog, and Audit Console. If the "Use System Syslog" button is not set to "Yes", press the "Yes" button. Click on "Commit".

b
The DBN-6300 must integrate with a network-wide monitoring capability.
SI-4 - Medium - CCI-002656 - V-237567 - SV-237567r856503_rule
RMF Control
SI-4
Severity
M
CCI
CCI-002656
Version
DBNW-IP-000046
Vuln IDs
  • V-237567
  • V-65019
Rule IDs
  • SV-237567r856503_rule
  • SV-79509
An integrated, network-wide intrusion detection capability increases the ability to detect and prevent sophisticated distributed attacks based on access patterns and characteristics of access. Integration is more than centralized logging and a centralized management console. The enclave's monitoring capability may include multiple sensors, IPS, sensor event databases, behavior-based monitoring devices, application-level content inspection systems, malicious code protection software, scanning tools, audit record monitoring software, and network monitoring software. Some tools may monitor external traffic while others monitor internal traffic at key boundaries. These capabilities may be implemented using different devices and therefore can have different security policies and severity-level schema. This is valuable because content filtering, monitoring, and prevention can become a bottleneck on the network if not carefully configured.
Checks: C-40786r645527_chk

Verify integration with a network-wide monitoring capability. Obtain the IP address and port number for the centralized event management system (e.g., SIEM) from site personnel. Navigate to the "Admin" tab. Click on the "External Service Settings" button. Verify the IP address and port number for the centralized event management system are implemented. If the DBN-6300 is not configured to send syslog information to a centralized event management system that manages the DBN-6300 network-wide monitoring capability, this is a finding.

Fix: F-40749r645528_fix

Configure the DBN-6300 with syslog output to the SIEM. Navigate to the "Admin" tab. Click on the "External Service Settings" button. Enter the centralized event management system IP address and port number. Click on the "Commit" button to start the process.

b
The DBN-6300 must continuously monitor inbound communications traffic between the application tier and the database tier for unusual/unauthorized activities or conditions at the SQL level.
SI-4 - Medium - CCI-002661 - V-237568 - SV-237568r856504_rule
RMF Control
SI-4
Severity
M
CCI
CCI-002661
Version
DBNW-IP-000050
Vuln IDs
  • V-237568
  • V-65021
Rule IDs
  • SV-237568r856504_rule
  • SV-79511
If inbound communications traffic is not continuously monitored for unusual/unauthorized activities or conditions, there will be times when hostile activity may not be noticed and defended against. Although some of the components in the site's content scanning solution may be used for periodic scanning assessment, the IDPS sensors and other components must provide continuous, 24 hours a day, 7 days a week monitoring. Unusual/unauthorized activities or conditions related to information system inbound communications traffic include, for example, internal traffic that indicates the presence of malicious code within organizational information systems or propagating among system components, the unauthorized exporting of information, or signaling to external information systems. Anomalies within organizational information systems include, for example, large file transfers, long-time persistent connections, use of unusual protocols and ports, and communications with suspected or known malicious external entities.
Checks: C-40787r645530_chk

View the organization's documentation to determine which databases are required to be protected. Ask the site representative if the device is used continuously or if periodic monitoring is performed. Navigate to Learning >> Time Regions and view the table of detected databases. For each database requiring protection, view the "State". Unprotected databases show a red shield. Protected databases show a green shield. If continuous monitoring is not performed by the organization, this is a finding.

Fix: F-40750r645531_fix

Configure the DBN-6300 with syslog output to the SIEM. Navigate to the "Admin" tab. Click on "External Service Settings" button. Enter the centralized event management system IP address and port number. Click on the "Commit" button to start the process. Configure a database for SQL injection protection for continuous protection. Enable the SQL injection detection capabilities on the applicable interface for the database to be protected. Navigate to Admin >> Capture >> Capture Sources. Select the interface connected the network that contains the database traffic. Click on the "Enable" button and ensure the Link up indicator turns green.

b
The DBN-6300 must off-load log records to a centralized log server in real time.
AU-4 - Medium - CCI-001851 - V-237569 - SV-237569r856505_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
DBNW-IP-000059
Vuln IDs
  • V-237569
  • V-65023
Rule IDs
  • SV-237569r856505_rule
  • SV-79513
Off-loading ensures audit information is not overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. Off-loading is a common process in information systems with limited audit storage capacity. The audit storage on the IDPS is used only in a transitory fashion until the system can communicate with the centralized log server designated for storing the audit records, at which point the information is transferred. However, DoD requires that the log be transferred in real time, which indicates that the time from event detection to off-loading is seconds or less. This does not apply to audit logs generated on behalf of the device itself (management).
Checks: C-40788r645533_chk

Audit records are automatically backed up on a real-time basis via syslog when enabled. Verify the DBN-6300 is connected to the syslog server. Navigate to Settings >> Advanced >> Syslog. Verify that the syslog services are set to "on", the syslog server information is valid, and the syslog server has connected. Navigate to Settings >> Advanced >> Audit Log. Verify that the Audit Syslog, "Use System Syslog" button is set to "Yes" and the Audit Configuration Categories are all checked for Audit Log, Syslog, and Audit Console. Following this verification, process an account action. Confirm the presence of a syslog message on the syslog server containing the details of this account action. If the DBN-6300 is not connected to the syslog server, or if the syslog server is connected but the message containing the information with the details of this account action is not there, this is a finding.

Fix: F-40751r645534_fix

Configure the DBN-6300 to be connected to the syslog server. Also configure the DBN-6300 to include audit records in the syslog message feed. Navigate to Settings >> Advanced >> Syslog. Enter the syslog connection information (port and IP address) and push the "enabled" button for both "TCP" and "enable". Navigate to Settings >> Advanced >> Audit Log. Verify that the Audit Syslog, "Use System Syslog" button is set to "Yes" and the Audit Configuration Categories are all checked for Audit Log, Syslog, and Audit Console. If the "Use System Syslog" button is not set to "Yes", press the "Yes" button. Click on "Commit".

b
When implemented for protection of the database tier, the DBN-6300 must be logically connected for maximum database traffic visibility.
CM-6 - Medium - CCI-000366 - V-237570 - SV-237570r645538_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
DBNW-IP-000060
Vuln IDs
  • V-237570
  • V-65025
Rule IDs
  • SV-237570r645538_rule
  • SV-79515
Configuring the IDPS to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements. Configuration settings are the set of parameters that can be changed that affect the security posture and/or functionality of the network element. Security-related parameters are those parameters impacting the security state of the network element, including the parameters required to satisfy other security control requirements. For the network element, security-related parameters include settings for communications traffic management configurations. If the DBN-6300 is installed incorrectly in the site's network architecture, vulnerable databases may not be detected and consequently may remain unprotected. To ensure optimum protection, the DBN-6300 must be logically installed between the application and database tiers of the network. The device has multiple interfaces that allow several connections to accommodate various network architectures. The device is installed as a passive listening device on all applicable subnetworks using the available ports. When placed correctly, the device monitors the "last mile" prior to database access, which is where SQL is optimally monitored.
Checks: C-40789r645536_chk

Ask the site representative if the DBN-6300 is used to protect the database tier. If the DBN-6300 is not used to protect the database tier, this is not a finding. Ask the site for documentation of which database tier is required to be protected. Verify connectivity of the capture ports to the correct database tier that is required to be protected. If the DBN-6300 is not connected to protect the database tier for maximum database traffic visibility of the organization's databases, this is a finding.

Fix: F-40752r645537_fix

Evaluate the site architecture to determine where the optimum logical connections would provide maximum database visibility. Disconnect the network taps from the incorrectly attached network ports. Reconnect the correctly identified taps. Navigate to the Admin >> Capture >> Port Configuration menu. Click on "Port Enabled", if it is not already enabled, to ensure that the DBN-6300 will see and capture traffic. Navigate to the "Database" tab and choose "Service Discovery". Verify that database services are beginning to appear on the page.

b
When implemented for discovery protection against unidentified or rogue databases, the DBN-6300 must provide a catalog of all visible databases and database services.
CM-6 - Medium - CCI-000366 - V-237571 - SV-237571r645541_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
DBNW-IP-000061
Vuln IDs
  • V-237571
  • V-65059
Rule IDs
  • SV-237571r645541_rule
  • SV-79549
If the DBN-6300 is installed incorrectly in the site's network architecture, vulnerable or unknown databases may not be detected and consequently may remain vulnerable and unprotected. For proper functionality of the DBN-6300, it is necessary to examine the discovered databases to see that an expected wide variety and number of them are covered. If the DBN-6300 is not able to see and detect database services, it will not be able to monitor the databases against threats.
Checks: C-40790r645539_chk

Ask the site representative if the DBN-6300 is used to provide discovery protection against unidentified or rogue databases. If the DBN-6300 is not used for discovery protection against unidentified or rogue databases, this is not a finding. Click on the "Database" tab and select the "Database Services" sub-menu. This will reveal all of the currently discovered database services. If the DBN-6300, which is used to provide protection against unidentified or rogue databases, does not provide a catalog of all visible databases and database services, this is a finding.

Fix: F-40753r645540_fix

Configure the system to view databases and database services. Click on the Database >> Service Discovery tab. This will reveal all of the currently visible database services that have been seen on the mirrored traffic connection.

c
The DBN-6300 IDPS must be using a version supported by the vendor.
CM-6 - High - CCI-000366 - V-264430 - SV-264430r992087_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
DBNW-IP-000100
Vuln IDs
  • V-264430
Rule IDs
  • SV-264430r992087_rule
Systems running an unsupported software/firmware version lack current security fixes required to mitigate the risks associated with recent vulnerabilities.
Checks: C-68344r992085_chk

This STIG is sunset and no longer updated. Compare the version running to the supported version by the vendor. If the system is using an unsupported version from the vendor, this is a finding.

Fix: F-68252r992086_fix

Upgrade to a version supported by the vendor.