Firewall Security Requirements Guide

V1R1 2018-03-21       U_Firewall_SRG_V1R1_Manual-xccdf.xml
V1R3 2018-12-24       U_Firewall_SRG_V1R3_Manual-xccdf.xml
This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: [email protected]
Comparison
All 41
No Change 39
Updated 1
Added 1
Removed 0
V-79409 No Change
Findings ID: SRG-NET-000019-FW-000003 Rule ID: SV-94115r1_rule Severity: high CCI: CCI-001414

Discussion

Information flow control regulates where information is allowed to travel within a network and between interconnected networks. Blocking or restricting detected harmful or suspicious communications between interconnected networks enforces approved authorizations for controlling the flow of traffic.

The firewall that filters traffic outbound to interconnected networks with different security policies must be configured with filters (i.e., rules, access control lists [ACLs], screens, and policies) that permit, restrict, or block traffic based on organization-defined traffic authorizations. Filtering must include packet header and packet attribute information, such as IP addresses and port numbers.

Configure filters to perform certain actions when packets match specified attributes, including the following actions:

- Apply a policy
- Accept, reject, or discard the packets
- Classify the packets based on their source address
- Evaluate the next term in the filter
- Increment a packet counter
- Set the packets’ loss priority
- Specify an IPsec SA (if IPsec is used in the implementation)
- Specify the forwarding path
- Write an alert or message to the system log

Checks

Verify the firewall is configured to use filters to restrict or block information system services based on best practices, known threats, and guidance in the Ports, Protocols, Services Management (PPSM) database regarding restrictions for boundary crossing for ports, protocols, and services.

If the firewall cannot be configured with filters that employ packet header and packet attributes, including source and destination IP addresses and ports, to prevent the flow of unauthorized or suspicious traffic between interconnected networks with different security policies, this is a finding.

Fix

Configure filters in the firewall to examine characteristics of incoming and outgoing packets, including but not limited to the following:

- Bit fields in the packet header, including IP fragmentation flags, IP options, and TCP flags

- IP version 4 (IPv4) numeric range, including destination port, DiffServ code point (DSCP) value, fragment offset, Internet Control Message Protocol (ICMP) code, ICMP packet type, interface group, IP precedence, packet length, protocol, and TCP and UDP source and destination port

- IP version 6 (IPv6) numeric range, including class of service (CoS) priority, destination address, destination port, ICMP code, ICMP packet type, interface group, IP address, next header, packet length, source address, source port, and TCP and UDP source and destination port

- Source and destination address and prefix list
V-79411 No Change
Findings ID: SRG-NET-000235-FW-000160 Rule ID: SV-94117r1_rule Severity: medium CCI: CCI-001190

Discussion

While failure to an open state may ensure users are not inconvenienced, it also circumvents a critical security network function that guards against direct and indirect network attacks. Allow traffic to flow without filtering or inspection puts the entire network and DoD critical assets at immediate risk. An example is a network element that blocks all traffic rather than allowing all traffic when a network element component fails (e.g., fail closed and do not forward traffic). This prevents an attacker from forcing a failure of the system in order to obtain access.

Checks

Review the firewall configuration to verify traffic flow defaults to closed when the firewall filtering function aborts or is nonfunctional.

If the firewall is configured to allow traffic flow to attached interfaces when the firewall filtering function is non-functional, this is a finding.

Fix

Configure the firewall to fail closed. The firewall must block all traffic rather than allowing all traffic when a network element component fails (e.g., fail closed and do not forward traffic).

The recommended architecture is to implement load balancing so that the failure of the firewall redirects traffic to another filtering device. Obtain a risk acceptance in order to fail open.
V-79413 No Change
Findings ID: SRG-NET-000362-FW-000028 Rule ID: SV-94119r1_rule Severity: high CCI: CCI-002385

Discussion

Not configuring a key boundary security protection device such as the firewall against commonly known attacks is an immediate threat to the protected enclave because they are easily implemented by those with little skill. Directions for the attack are obtainable on the Internet and in hacker groups. Without filtering enabled for these attacks, the firewall will allow these attacks beyond the protected boundary.

Configure the perimeter and internal boundary firewall to guard against the three general methods of well-known DoS attacks: flooding attacks, protocol sweeping attacks, and unauthorized port scanning.

Flood attacks occur when the host receives too much traffic to buffer and slows down or crashes. Popular flood attacks include ICMP flood and SYN flood. A TCP flood attack of SYN packets initiating connection requests can overwhelm the device until it can no longer process legitimate connection requests, resulting in denial of service. An ICMP flood can overload the device with so many echo requests (ping requests) that it expends all its resources responding and can no longer process valid network traffic, also resulting in denial of service. An attacker might use session table floods and SYN-ACK-ACK proxy floods to fill up the session table of a host.

In an IP address sweep attack, an attacker sends ICMP echo requests (pings) to multiple destination addresses. If a target host replies, the reply reveals the target’s IP address to the attacker. In a TCP sweep attack, an attacker sends TCP SYN packets to the target device as part of the TCP handshake. If the device responds to those packets, the attacker gets an indication that a port in the target device is open, which makes the port vulnerable to attack. In a UDP sweep attack, an attacker sends UDP packets to the target device. If the device responds to those packets, the attacker gets an indication that a port in the target device is open, which makes the port vulnerable to attack.

In a port scanning attack, an unauthorized application is used to scan the host devices for available services and open ports for subsequent use in an attack. This type of scanning can be used as a DoS attack when the probing packets are sent excessively.

Checks

View the security filters for each interface or security zone.

Verify DoS filters are configured to detect and prevent known DoS attacks such as IP sweeps, TCP sweeps, buffer overflows, unauthorized port scanning, SYN floods, UDP floods, and UDP sweeps.

If filters are not configured or if the security zone is not configured with filters that guard against common DoS attacks, this is a finding.

Fix

Configure the firewall to detect and prevent DoS attacks. Implement filters with thresholds that are customized for the specific environment where applicable. DoS filters are based on NIST 800-53 requirements and vendor recommendations.

The following sample commands show filters that implement this requirement (these are examples only):

set filter1 icmp ip-sweep threshold 1000
set filter2 tcp port-scan threshold 1000
set filter3 tcp syn-flood alarm-threshold 1000
set filter3 tcp syn-flood attack-threshold 1100
set filter4 tcp syn-flood source-threshold 100
set filter5 tcp syn-flood destination-threshold 2048
set filter6 tcp syn-flood timeout 20
set filter7 tcp tcp-sweep threshold 1000
set filter8 udp flood threshold 5000
set filter9 udp udp-sweep threshold 1000
V-79415 No Change
Findings ID: SRG-NET-000202-FW-000039 Rule ID: SV-94121r1_rule Severity: high CCI: CCI-001109

Discussion

To prevent malicious or accidental leakage of traffic, organizations must implement a deny-by-default security posture at the network perimeter. Such rulesets prevent many malicious exploits or accidental leakage by restricting the traffic to only known sources and only those ports, protocols, or services that are permitted and operationally necessary.

As a managed boundary interface, the firewall must block all inbound and outbound network traffic unless a filter is installed to explicitly allow it. The allow filters must comply with the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and Vulnerability Assessment (VA).

Checks

Determine the default security policies on the firewall for traffic from one zone to another zone (inter-zone).

This should be a "Deny" policy that blocks all inter-zone traffic by default. Ensure no policy that circumvents the default "Deny" inter-zone policy is allowed. Traffic through the firewall is filtered so that only the specific traffic that is approved and registered in the PPSM CAL and VAs for the enclave. Verify rules or access control statements containing "any" for either the host, destination, protocol, or port are not used.

If the firewall does not deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception), this is a finding.

Fix

Configure the firewall with a "Deny" inter-zone policy which, by default, blocks traffic between zones and allows network communications traffic by exception (i.e., deny all, permit by exception) in accordance with PPSM CAL and VAs for the enclave.

Protocols, TCP/UDP ports, and endpoints (specific hosts or networks) must be identified and used to develop rulesets to restrict traffic to and from an enclave and across protected internal boundaries. Rules or access control statements containing "any" for either the host, destination, protocol, or port are prohibited.
V-79417 No Change
Findings ID: SRG-NET-000132-FW-000026 Rule ID: SV-94123r1_rule Severity: medium CCI: CCI-000382

Discussion

Some ports, protocols, or services have well-known exploits or security weaknesses that can be leveraged in an attack against the enclave and put it at immediate risk. These ports, protocols, and services must be prohibited or restricted in the packet or stateful filtering firewall configuration in accordance with DoD policy.

Policy filters restrict traffic destined to the enclave perimeter as defined in the PPSM CAL and vulnerability assessments.

Checks

Verify the firewall is configured to disable or restrict the use of functions, ports, protocols, and/or services on the network segment that are not allowed by the PPSM CAL and vulnerability assessments.

Verify all applications used in the enclave are registered in the PPSM database.

Review the vulnerability assessment for each port, protocol, and service allowed into the enclave and apply all appropriate mitigations defined in the Vulnerability Assessment report for that port, protocol, and service.

Compare enabled functions, ports, and services with the PPSM requirements.

If prohibited functions, ports, protocols, and services are enabled, this is a finding.

Fix

SCAs must review the vulnerability assessment for each port, protocol, and service allowed into the enclave and apply all appropriate mitigations defined in the Vulnerability Assessment report. Register only ports, protocols, and functions allowed into the enclave in the PPSM database. The enclave owner must register the applications used in the PPSM database.

Consult the packet/stateful firewall knowledge base and configuration guides to determine the commands for disabling each port, protocol, service, or function that is not in compliance.
V-79419 No Change
Findings ID: SRG-NET-000192-FW-000029 Rule ID: SV-94125r1_rule Severity: medium CCI: CCI-001094

Discussion

DoS attacks can take multiple forms but have the common objective of overloading or blocking a network or host to deny or seriously degrade performance. If the network does not provide safeguards against DoS attacks, network resources will be unavailable to users.

Installation of a firewall at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume/type.

The firewall must include protection against DoS attacks that originate from inside the enclave that can affect either internal or external systems. These attacks may use legitimate or rogue endpoints from inside the enclave. These attacks can be simple "floods" of traffic to saturate circuits or devices, malware that consumes CPU and memory on a device or causes it to crash, or a configuration issue that disables or impairs the proper function of a device. For example, an accidental or deliberate misconfiguration of a routing table can misdirect traffic for multiple networks.

Checks

Obtain and review the list of outbound interfaces and zones from site personnel.

Review each of the configured outbound interfaces and zones. Verify zones that communicate outbound have been configured with the DoS firewall filter (i.e., rules, access control lists [ACLs], screens, or policies) such as IP sweeps, TCP sweeps, buffer overflows, unauthorized port scanning, SYN floods, UDP floods, and UDP sweeps.

If all outbound interfaces are not configured to block DoS attacks, this is a finding.

Fix

Associate a properly configured DoS firewall filter (e.g., rules, access control lists [ACLs], screens, or policies) to outbound interfaces and security zones.

Apply a firewall filter to each outbound interface example:

set security zones security-zone untrust interfaces <OUTBOUND-INTERFACE>
set security zones security-zone trust screen untrust-screen
V-79421 No Change
Findings ID: SRG-NET-000193-FW-000030 Rule ID: SV-94127r1_rule Severity: medium CCI: CCI-001095

Discussion

A firewall experiencing a DoS attack will not be able to handle production traffic load. The high utilization and CPU caused by a DoS attack will also have an effect on control keep-alives and timers used for neighbor peering resulting in route flapping and will eventually black hole production traffic.

The device must be configured to contain and limit a DoS attack's effect on the device's resource utilization. The use of redundant components and load balancing are examples of mitigating "flood-type" DoS attacks through increased capacity.

Checks

Use the "show" command to verify that all inbound interfaces have a stateless firewall filter to set rate limits based on a destination.

If the firewall does not have a stateless firewall filter that sets rate limits based on a destination, this is a finding.

Fix

Configure a stateless firewall filter to set rate limits based on a destination of the packets. Apply the stateless firewall filter to all inbound interfaces.
V-79423 No Change
Findings ID: SRG-NET-000061-FW-000001 Rule ID: SV-94129r1_rule Severity: medium CCI: CCI-000067

Discussion

Remote access devices (such as those providing remote access to network devices and information systems) that lack automated capabilities increase risk and make remote user access management difficult at best.

Remote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.

Automated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).

Checks

Review the firewall configuration statements used to create a group policy with filtering rules for remote clients accessing the network using a VPN.

Verify both ingress and egress traffic on this interface is subject to the remote access policy and filtering rules required by the organization.

If the firewall is used to filter traffic from the VPN access points but is not configured with filtering rules that apply to the monitoring of remote access traffic, this is a finding.

Fix

Configure a group policy for remote clients and apply to the interface that is connected to allow ingress and egress to the VPN access points.
V-79425 No Change
Findings ID: SRG-NET-000061-FW-000002 Rule ID: SV-94131r1_rule Severity: medium CCI: CCI-000067

Discussion

Remote access devices (such as those providing remote access to network devices and information systems) that lack automated capabilities increase risk and make remote user access management difficult at best.

Remote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.

Automated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).

Checks

Review the firewall configuration statements used to create a group policy with filtering rules for wireless clients accessing the network using a wireless access point.

Verify both ingress and egress traffic on this interface is subject to the remote access policy and filtering rules required by the organization.

If the firewall is used to filter traffic from the wireless access points but is not configured with filtering rules that apply to the monitoring of wireless access traffic, this is a finding.

Fix

Configure a group policy for wireless clients and apply to the interface that is connected to allow ingress and egress to the wireless access points.
V-79427 No Change
Findings ID: SRG-NET-000019-FW-000004 Rule ID: SV-94133r1_rule Severity: medium CCI: CCI-001414

Discussion

Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events.

Checks

Verify the firewall immediately uses updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones. For example, there is no need to reinitialize or reboot or the action to commit the changes is prompted.

If the firewall does not immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones, this is a finding.

Fix

Require system administrators to commit and test changes upon configuration of the firewall.
V-79429 No Change
Findings ID: SRG-NET-000492-FW-000006 Rule ID: SV-94135r1_rule Severity: medium CCI: CCI-000172

Discussion

Without generating log records that log usage of objects by subjects and other objects, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

Security objects are data objects that are controlled by security policy and bound to security attributes.

The firewall must not forward traffic unless it is explicitly permitted via security policy. Logging for firewall security-related sources such as screens and security policies must be configured separately. To ensure security objects such as firewall filters (i.e., rules, access control lists [ACLs], screens, and policies) send events to a syslog server and local logs, security logging must be configured one each firewall term.

Checks

View the configuration of the firewall or the central audit server log records.

Verify the firewall generates traffic log records when traffic is denied, restricted, or discarded.

If the firewall does not generate traffic log records for events when traffic is denied, restricted, or discarded, this is a finding.

Fix

Configure the firewall central audit server stanza to generate traffic log records for events when traffic is denied, restricted, or discarded.
V-79431 No Change
Findings ID: SRG-NET-000493-FW-000007 Rule ID: SV-94137r1_rule Severity: medium CCI: CCI-000172

Discussion

Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

Access for different security levels maintains separation between resources (particularly stored data) of different security domains.

The firewall can be configured to use security zones that are configured with different security policies based on risk and trust levels. These zones can be leveraged to prevent traffic from one zone from sending packets to another zone. For example, information from certain IP sources will be rejected if the destination matches specified security zones that are not authorized.

Checks

View the configuration of the firewall or the central audit server log records.

Verify the firewall generates traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.

If the firewall does not generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate, this is a finding.

Fix

Configure the firewall central audit server stanza to generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.
V-79433 No Change
Findings ID: SRG-NET-000399-FW-000008 Rule ID: SV-94139r1_rule Severity: medium CCI: CCI-001462

Discussion

Without the ability to capture, record, and log content related to a user session, investigations into suspicious user activity would be hampered.

This configuration ensures the ability to select specific sessions to capture in order to support general auditing/incident investigation or to validate suspected misuse.

Checks

View the documented process for packet capture.

Verify the firewall allows authorized users to perform a packet capture based on IP, traffic type (TCP, UDP, or ICMP), or protocol.

If the firewall is not configured to allow authorized users to capture, record, and log all content related to a user session, this is a finding.

Fix

Document a process for authorized users to capture, record, and log all content based on IP, traffic type (TCP, UDP, or ICMP), or protocol.
V-79435 No Change
Findings ID: SRG-NET-000074-FW-000009 Rule ID: SV-94141r1_rule Severity: medium CCI: CCI-000130

Discussion

Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.

Audit event content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.

Associating event types with detected events in the network element logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.

Checks

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server.

Verify the entries sent to the traffic log include sufficient information to determine the type or category for each event in the traffic log.

If the traffic log entries do not include enough information to determine what type of event occurred, this is a finding.

Fix

Configure the firewall to ensure entries sent to the traffic log include sufficient information to determine the type or category for each event in the traffic log.
V-79437 No Change
Findings ID: SRG-NET-000075-FW-000010 Rule ID: SV-94143r1_rule Severity: medium CCI: CCI-000131

Discussion

Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.

In order to compile an accurate risk assessment, and provide forensic analysis of network traffic patterns, it is essential for security personnel to know when flow control events occurred (date and time) within the infrastructure.

Associating event types with detected events in the network traffic logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.

Checks

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server.

Verify the entries sent to the traffic log include the date and time of each event.

If the traffic log entries do not include the date and time the event occurred, this is a finding.

Fix

Configure the firewall to ensure entries sent to the traffic log include the date and time of the event.
V-79439 No Change
Findings ID: SRG-NET-000076-FW-000011 Rule ID: SV-94145r1_rule Severity: medium CCI: CCI-000132

Discussion

Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.

In order to compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know where events occurred, such as network element components, modules, device identifiers, node names, and functionality.

Associating information about where the event occurred within the network provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.

Checks

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server.

Verify the entries sent to the traffic log include the location of each event (e.g., network name, network subnet, port, or network segment).

If the traffic log entries do not include the event location, this is a finding.

Fix

Configure the firewall to ensure entries sent to the traffic log include the location of each event (e.g., network name, network subnet, network segment, or port).
V-79441 No Change
Findings ID: SRG-NET-000077-FW-000012 Rule ID: SV-94147r1_rule Severity: low CCI: CCI-000133

Discussion

Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event.

In addition to logging where events occur within the network, the traffic log events must also identify sources of events, such as IP addresses, processes, and node or device names.

Checks

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server.

Verify the entries sent to the traffic log include sufficient information to ascertain the source of the events (e.g., IP address, session, or packet ID).

If the traffic log entries do not include sufficient information to ascertain the source of the events, this is a finding.

Fix

Configure the firewall implementation to ensure entries sent to the traffic log include sufficient information to ascertain the source of each event (e.g., IP address, session, or packet ID).
V-79443 No Change
Findings ID: SRG-NET-000078-FW-000013 Rule ID: SV-94149r1_rule Severity: medium CCI: CCI-000134

Discussion

Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network.

Event outcomes can include indicators of event success or failure and event-specific results. They also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.

Checks

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server.

Verify the entries sent to the traffic log include sufficient information to ascertain the outcome of the firewall rules. Verify that, at a minimum, the success or failure of the event is evented.

If the traffic log entries do not include sufficient information to ascertain the outcome of the application of the firewall rules, this is a finding.

If the traffic log entries do not include the success or failure of the application of the firewall rules, this is a finding.

Fix

Configure the firewall to generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.
V-79445 No Change
Findings ID: SRG-NET-000333-FW-000014 Rule ID: SV-94151r1_rule Severity: medium CCI: CCI-001844

Discussion

Without the ability to centrally manage the content captured in the traffic log entries, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack.

The DoD requires centralized management of all network component audit record content. Network components requiring centralized traffic log management must have the ability to support centralized management. The content captured in traffic log entries must be managed from a central location (necessitating automation). Centralized management of traffic log records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records.

Ensure at least one syslog server is configured on the firewall.

If the product inherently has the ability to store log records locally, the local log must also be secured. However, this requirement is not met since it calls for a use of a central audit server.

Checks

Examine the traffic log configuration on the firewall.

Verify the firewall is configured to send traffic log entries to the organization's central audit server.

If the firewall is not configured to send traffic log entries to the organization's central audit server, this is a finding.

Fix

Configure the firewall to ensure traffic log entries are transmitted to the organization's central audit server (e.g., syslog server).
V-79447 No Change
Findings ID: SRG-NET-000335-FW-000017 Rule ID: SV-94153r1_rule Severity: medium CCI: CCI-001858

Discussion

Without a real-time alert (less than a second), security personnel may be unaware of an impending failure of the audit functions and system operation may be adversely impacted. Alerts provide organizations with urgent messages. Automated alerts can be conveyed in a variety of ways, including via a regularly monitored console, telephonically, via electronic mail, via text message, or via websites.

Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded. Most firewalls use UDP to send audit records to the server and cannot tell if the server has received the transmission, thus the site should either implement a connection-oriented communications solution (e.g., TCP) or implement a heartbeat with the central audit server and send an alert if it is unreachable.

Checks

If a network device such as the events, network management, or SNMP server is configured to send an alert when communication is lost with the central audit server, this is not a finding.

Verify the firewall is configured to send an alert via instant message, email, SNMP, or another authorized method to the SCA, ISSO, and other identified personnel when communication is lost with the central audit server.

If the firewall is not configured to send an immediate alert via an approved method when communication is lost with the central audit server, this is a finding.

Fix

Configure the firewall (or another network device) to send an alert via instant message, email, or another authorized method to the SCA, ISSO, and other identified personnel for any log failure event where the filtering functions are unable to write events to the central audit server.
V-79449 No Change
Findings ID: SRG-NET-000088-FW-000018 Rule ID: SV-94155r1_rule Severity: medium CCI: CCI-000139

Discussion

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process traffic logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.

Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Most firewalls use User Datagram Protocol (UDP) to send audit records to the server and cannot tell if the server has received the transmission. Thus, when the event daemon stops working, messages and notifications cannot be sent to the event monitor (e.g., Network Management System [NMS], Security Information and Event Management [SIEM], Syslog) or to the Simple Network Management Protocol (SNMP) server. Another method such as a keep-alive with the central audit server may be required.

This requirement applies to each audit data storage repository (i.e., distinct information system component where traffic log records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.

Note that CCI-001858 requires that audit failure alerts be in real time; thus, simply sending a log event to the central audit server is not sufficient.

Checks

If a network device such as the events, network management, or SNMP server are configured to send an alert when an audit processing failure occurs, this is not a finding.

Verify the firewall is configured to send an alert via instant message, email, SNMP or another authorized method to the ISSO, SA, and other identified personnel when an audit processing failure occurs.

If the firewall is not configured to send an alert via an approved and immediate method when an audit processing failure occurs, this is a finding.

Fix

Configure the firewall (or another network device) to send an alert via instant message, email, or another authorized method to the ISSO, SA, and other identified personnel when an audit processing failure that prevents the device from generating, storing or sending events occurs on the device itself (e.g., a failure of the event daemon).
V-79451 No Change
Findings ID: SRG-NET-000089-FW-000019 Rule ID: SV-94157r1_rule Severity: medium CCI: CCI-000140

Discussion

It is critical that when the network element is at risk of failing to process traffic logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend on the nature of the failure mode.

In accordance with DoD policy, the traffic log must be sent to a central audit server. When logging functions are lost, system processing cannot be shut down because firewall availability is an overriding concern given the role of the firewall in the enterprise. The system should either be configured to log events to an alternative server or queue log records locally. Upon restoration of the connection to the central audit server, action should be taken to synchronize the local log data with the central audit server.

If the central audit server uses User Datagram Protocol (UDP) communications instead of a connection oriented protocol such as TCP, a method for detecting a lost connection must be implemented.

Checks

Verify logging has been enabled and configured for local queuing of the traffic log.

If a local log file (or files) is not configured to capture events locally if communication with the central audit server is lost, this is a finding.

Fix

Configure local backup events files to capture DoD-defined auditable events either consistently or, if possible, in the event communication with the central audit server is lost.
V-79453 No Change
Findings ID: SRG-NET-000098-FW-000021 Rule ID: SV-94159r1_rule Severity: medium CCI: CCI-000162

Discussion

Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or identify an improperly configured firewall. Thus, it is imperative that the collected log data be secured and access be restricted to authorized personnel. Methods of protection may include encryption or logical separation.

This does not apply to traffic logs generated on behalf of the device itself (management). Some devices store traffic logs separately from the system logs.

Checks

Verify that all communication with the central audit server is going out the interface that is connected to the management network and is protected by an encryption solution such as the management network's VPN.

If the firewall does not use either encryption or logical separation to protect transmitted traffic log records while in transit to the central audit server, this is a finding.

Fix

Configure the firewall to use either encryption or logical separation to protect transmitted traffic log records while in transit to the central audit server. The preferred solution is for all communication with the central audit server to egress via the management network interface and be protected by the management network's VPN.
V-79455 No Change
Findings ID: SRG-NET-000098-FW-000022 Rule ID: SV-94161r1_rule Severity: medium CCI: CCI-000162

Discussion

Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or identify an improperly configured firewall. Thus, it is imperative that the collected log data be secured and can only be accessed by authorized personnel.

This does not apply to traffic logs generated on behalf of the device itself (management). Some devices store traffic logs separately from the system logs.

Checks

Verify the firewall's fine-grained permissions are configured to control access to the log store where the traffic log is located.

If the firewall does not protect traffic log records from unauthorized read access while stored locally, this is a finding.

Fix

Validate the firewall includes a baseline cryptographic module that provides confidentiality and integrity services for authentication and for protecting communications with adjacent systems. Configure role-based, fine-grained permissions management for controlling access.
V-79457 No Change
Findings ID: SRG-NET-000099-FW-000161 Rule ID: SV-94163r1_rule Severity: medium CCI: CCI-000163

Discussion

If audit data were to become compromised, forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve.

To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification. This can be achieved through multiple methods, which will depend on system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions and limiting log data locations.

Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.

This does not apply to traffic logs generated on behalf of the device itself (management).

Checks

Verify the firewall's fine-grained permissions are configured to prevent unauthorized modification of local log records.

If the firewall does not protect traffic log records from unauthorized modification while stored locally, this is a finding.

Fix

Validate the firewall includes a baseline cryptographic module that provides confidentiality and integrity services for authentication and for protecting communications with adjacent systems.

Configure role-based, fine-grained permissions management for controlling commands needed to modify log records.
V-79459 No Change
Findings ID: SRG-NET-000100-FW-000023 Rule ID: SV-94165r1_rule Severity: medium CCI: CCI-000164

Discussion

If audit data were to become compromised, forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve.

To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification. This can be achieved through multiple methods, which will depend on system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions and limiting log data locations.

Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.

This requirement does not apply to traffic logs generated on behalf of the device itself (device management).

Checks

Verify the firewall's fine-grained permissions are configured to prevent unauthorized deletion of local log files or log records.

If the firewall does not protect traffic log records and log files from unauthorized deletion while stored locally, this is a finding.

Fix

Validate the firewall includes a baseline cryptographic module that provides confidentiality and integrity services for authentication and for protecting communications with adjacent systems.

Configure role-based, fine-grained permissions management for controlling commands needed to delete log files and records.
V-79461 No Change
Findings ID: SRG-NET-000131-FW-000025 Rule ID: SV-94167r1_rule Severity: medium CCI: CCI-000381

Discussion

Network devices are capable of providing a wide variety of functions (capabilities or processes) and services. Some of these functions and services are installed and enabled by default. The organization must determine which functions and services are required to perform the content filtering and other necessary core functionality for each component of the firewall. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

Some services may be security related but, based on the firewall’s role in the architecture, must not be installed on the same hardware. For example, the device may serve as a router, VPN, or other perimeter services. However, if these functions are not part of the documented role of the firewall in the enterprise or branch architecture, the software and licenses should not be installed on the device. This mitigates the risk of exploitation of unconfigured services or services that are not kept updated with security fixes. If left unsecured, these services may provide a threat vector.

Some services are not authorized for combination with the firewall and individual policy must be in place to instruct the administrator to remove these services. Examples of these services are Network Time Protocol (NTP), domain name server (DNS), email server, FTP server, web server, and Dynamic Host Configuration Protocol (DHCP).

Only remove unauthorized services. This control is not intended to restrict the use of firewalls with multiple authorized roles.

Checks

Review the documentation and architecture for the device or check the system-installed licenses or services.

Determine what services and functions are installed on the firewall. Compare installed services and functions to the documentation showing the approved services.

If unneeded services and functions are installed on the device but are not part of the documented role of the device, this is a finding.

Fix

Display and remove unnecessary licenses, services, and functions from the firewall. Examples include NTP, DNS, and DHCP.

Note: Only remove unauthorized services. This control is not intended to restrict the use of network devices with multiple authorized roles.
V-79463 No Change
Findings ID: SRG-NET-000235-FW-000133 Rule ID: SV-94169r1_rule Severity: medium CCI: CCI-001190

Discussion

Firewalls that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection. Failure to a known safe state helps prevent systems from failing to a state that may cause unauthorized access to make changes to the firewall filtering functions.

This applies to the configuration of the gateway or network traffic security function of the device. Abort refers to stopping the firewall filtering function before it has finished naturally. The term abort refers to both requested and unexpected terminations.

Checks

Review the firewall configuration to verify it fails to a secure state if the firewall filtering functions fail unexpectedly.

If the firewall does not fail to a secure state if the firewall filtering functions fail unexpectedly, this is a finding.

Fix

Configure the firewall to fail to a secure state if the firewall filtering functions fail unexpectedly.
V-79465 No Change
Findings ID: SRG-NET-000236-FW-000027 Rule ID: SV-94171r1_rule Severity: medium CCI: CCI-001665

Discussion

Failure to a secure state can address safety or security in accordance with the mission needs of the organization. Failure to a secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving state information helps to facilitate the restart of the firewall application and a return to the operational mode with less disruption.

This requirement applies to a failure of the firewall function rather than the device or operating system as a whole, which is addressed in the Network Device Management SRG.

Since it is usually not possible to test this functionality in a production environment, systems should be validated either in a testing environment or prior to installation. This requirement is usually a function of the design of the firewall. Compliance can be verified by acceptance/validation processes or vendor attestation.

Checks

View the firewall failover configuration or system documentation.

Verify that in the event of a system failure of the firewall function, the firewall saves diagnostic information, logs system messages, and loads the most current security policies, rules, and signatures. Testing of this functionality in a production environment is not recommended.

If in the event of a system failure of the firewall function the firewall does not save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted, this is a finding.

Fix

Configure the firewall to fail securely in the event of a transiently corrupt state or failure condition.

When the system restarts, the system boot process must not succeed without passing all self-tests for cryptographic algorithms, RNG tests, and software integrity tests.
V-79467 No Change
Findings ID: SRG-NET-000362-FW-000159 Rule ID: SV-94173r1_rule Severity: medium CCI: CCI-002385

Discussion

As a critical security system, perimeter firewalls must be safeguarded with redundancy measures. If the network does not provide safeguards against DoS attacks, network resources will be unavailable to users. Service redundancy techniques reduce the susceptibility of the firewall to many DoS attacks.

A firewall experiencing a DoS attack will not be able to handle the traffic load. The high CPU utilization caused by a DoS attack will also have impact control keep-alives and timers used for neighbor peering, resulting in route flapping and eventually black hole traffic.

Though redundant hardware is the primary means of compliance, there are a number of ways to meet this requirement. The firewall can also be configured for filter-based forwarding, per-flow load balancing, and/or per-packet load balancing.

Checks

Since Service redundancy and load balancing can be a highly complex configuration that can be implemented using a wide variety of configurations, ask the site representative to demonstrate the method used and the configuration.

If the perimeter firewall is not configured for service redundancy, load balancing, or other organization-defined safeguards to limit the effects of types of DoS attacks on the network, this is a finding.

Fix

Consult vendor configuration guides and knowledge base. Implement one or more methods of service redundancy and/or load balancing (e.g., filter-based forwarding, per-flow load balancing, per-packet load balancing, or hardware redundancy options).

The implementation must be tested prior to placing into production.
V-79469 No Change
Findings ID: SRG-NET-000364-FW-000031 Rule ID: SV-94175r1_rule Severity: medium CCI: CCI-002403

Discussion

Unrestricted traffic to the trusted networks may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.

Firewall filters control the flow of network traffic, ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet) must be kept separated.

Checks

Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification, Accreditation or Authorization Package, ports, protocols, and services documentation, and Ports, Protocols, and Services Management (PPSM) database.

If the list of authorized sources and destinations is not available, this is a finding.

Review the firewall configuration for each of the configured inbound zones and interfaces.

Verify an ingress filter (e.g., Access Control List) is applied to each inbound zone/interface, including the management interface.

Verify ingress filters for the management interface to block all transit traffic (i.e., any traffic not destined to the firewall itself). Verify that traffic accessing the firewall originates from the Network Operations Center (NOC).

If an ingress filter is not configured for each active inbound zone or interface, this is a finding.

Fix

Configure a security policy to each inbound zone and/or interface to implement continuous filtering of outbound traffic.

Apply security policy zones/interfaces through which inbound traffic flows from untrusted external networks or subnetworks.

Configure the ingress filters for the management interface to block all transit traffic (i.e., any traffic not destined to the firewall itself) and so that traffic accessing the firewall originates from the NOC.
V-79471 Updated
Findings ID: SRG-NET-000364-FW-000032 Rule ID: SV-94177r21_rule Severity: medium CCI: CCI-002403

Discussion

If outbound communications traffic is not filtered, hostile activity intended to harm other networks or packets from networks destined to unauthorized networks may not be detected and prevented.

Access control policies and access control lists implemented on devices, such as firewalls, that control the flow of network traffic ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet) must be kept separated.

This requirement addresses the binding of the
eingress filter to the interface/zone rather than the content of the eingress filter.

Checks

Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification, Accreditation or Authorization Package, ports, protocols, and services documentation, and Ports, Protocols, and Services Management (PPSM) database.

If the list of authorized sources and destinations is not available, this is a finding.


Review the firewall configuration for each of the configured outbound zones and interfaces.


Verify a security policy is applied to each outbound zone/interface, including the management interface.

If an egress filter is not configured for each active outbound zone or interface, this is a finding.

Fix

Configure a security policy to each outbound zone and/or interface to implement continuous filtering of outbound traffic.

Apply security policy zones/interfaces (including the management interface) through which outbound traffic flows to untrusted external networks or subnetworks.
V-79473 Added
Findings ID: SRG-NET-000364-FW-000033 Rule ID: SV-94179r1_rule Severity: medium CCI: CCI-002403

Discussion

The firewall must reject requests for access or services where the source address received by the firewall specifies a loopback address. The loopback address is used by an Inter-Processor Control (IPC) mechanism that enables the client and server portion of an application running on the same machine to communicate, and so it is trusted. It should never be used as the source IP address of an inbound or outbound transmission. It is a best practice for the management network to use the loopback addresses.

Checks

Review the device configuration to determine if filters are in place to block loopback addresses. Verify packets with a destination IP address assigned to the management or loopback address range are blocked (unless the packet has a source address assigned to the management network or network infrastructure). If loopback addresses are not being blocked by an ingress firewall filter, this is a finding.

Fix

Establish ingress filters to block any attempt from the firewall or any network to pass any packets claiming to be from a loopback address.
V-79475 No Change
Findings ID: SRG-NET-000364-FW-000034 Rule ID: SV-94181r1_rule Severity: medium CCI: CCI-002403

Discussion

As a critical security system, perimeter firewalls must be safeguarded against direct attacks to the device. The firewall must have a filter that rejects requests for access or services where the source address received by the firewall specifies an external address and the destination address specifies the control plane of the firewall.

Checks

Review the device configuration to determine if filters are in place to block loopback addresses.

Verify packets with a destination IP address assigned to the management or loopback address range are blocked (unless the packet has a source address assigned to the management network or network infrastructure).

If inbound IP packets destined to the control plane of the firewall itself are not blocked or restricted by an ingress firewall filter, this is a finding.

Fix

Establish ingress filters to block or restrict inbound IP packets destined to the control plane of the firewall itself.
V-79477 No Change
Findings ID: SRG-NET-000364-FW-000035 Rule ID: SV-94183r1_rule Severity: medium CCI: CCI-002403

Discussion

The management network must still have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic.

Safeguards must be implemented to ensure that the management traffic does not leak past the managed network's premise equipment. If a firewall is located behind the premise router, all management traffic must be blocked at that point, with the exception of management traffic destined to premise equipment.

Checks

Review the firewall configuration to verify that it is blocking all outbound management traffic.

If the firewall is not blocking management network from leaking to outside networks, this is a finding.

Fix

With the exception of management traffic destined to perimeter equipment, configure a firewall located behind the premise router to block all outbound management traffic.
V-79479 No Change
Findings ID: SRG-NET-000364-FW-000036 Rule ID: SV-94185r1_rule Severity: medium CCI: CCI-002403

Discussion

Protect the management network with a filtering firewall configured to block unauthorized traffic. This requirement is similar to the out-of-band management (OOBM) model, when the production network is managed in-band. The management network could also be housed at a Network Operations Center (NOC) that is located locally or remotely at a single or multiple interconnected sites.

NOC interconnectivity, as well as connectivity between the NOC and the managed networks’ premise routers, would be enabled using either provisioned circuits or VPN technologies such as IPsec tunnels or MPLS VPN services.

Checks

Inspect the architecture diagrams. Inspect the NOC and the managed network. Note that the IPsec tunnel endpoints may be configured on the premise or gateway router, the VPN gateway firewall, or a VPN concentrator.

Verify that all traffic between the managed network and management network and vice-versa is secured via IPsec encapsulation.

If the firewall does not restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address, this is a finding.

Fix

Where IPsec technology is deployed to connect the managed network to the NOC, restrict the traffic entering the tunnels so that only the authorized management packets with authorized destination addresses are permitted.
V-79481 No Change
Findings ID: SRG-NET-000364-FW-000037 Rule ID: SV-94187r1_rule Severity: medium CCI: CCI-002403

Discussion

If outbound communications traffic is not filtered, hostile activity intended to harm other networks may not be detected and prevented.

Checks

Review the configuration and verify the firewall blocks outbound IP packets that contain an illegitimate attributes. At a minimum, rules must exist to filter based on invalid source address or packets that fail minimum length tests (TCP length, UDP length, IP data length) that have undefined protocol numbers, improper use of hop-by-hop header, or IPv6 RH0 header.

If the firewall does not block outbound IP packets that that contain illegitimate packet attributes, this is a finding.

Fix

Configure the firewall to block outbound IP packets that that contain illegitimate packet attributes.
V-79483 No Change
Findings ID: SRG-NET-000365-FW-000038 Rule ID: SV-94189r1_rule Severity: medium CCI: CCI-001126

Discussion

If a boundary protection device fails in an unsecure manner (open), information external to the boundary protection device may enter, or the device may permit unauthorized information release.

Secure failure ensures that when a boundary control device fails, all traffic will be subsequently denied.

Fail secure is a condition achieved by employing information system mechanisms to ensure that in the event of operational failures of boundary protection devices at managed interfaces (e.g., routers, firewalls, guards, and application gateways residing on protected subnetworks commonly referred to as demilitarized zones), information systems do not enter into unsecure states where intended security properties no longer hold.

Checks

Review the configuration and verify the firewall fails securely in the event of an operational failure. This involves such items as ensuring the Access Control Lists (filters) and security policy are not corrupted and cannot be accessed. Most importantly, it should not be possible to fail to a state where firewall filtering functions no longer hold.

If the firewall does not fail securely in the event of an operational failure, this is a finding.

Fix

Configure the firewall to fail securely in the event of an operational failure of the firewall filtering or boundary protection function. This is not the same as a hardware failure, which is covered by the NDM STIG. This involves such items as ensuring the filters and security policy are not corrupted and cannot be accessed. Most importantly, it should not be possible to fail to a state where firewall filtering functions no longer hold.
V-79485 No Change
Findings ID: SRG-NET-000205-FW-000040 Rule ID: SV-94191r1_rule Severity: medium CCI: CCI-001097

Discussion

The enclave's internal network contains the servers where mission-critical data and applications reside. Malicious traffic can enter from an external boundary or originate from a compromised host internally.

Vulnerability assessments must be reviewed by the SA and protocols must be approved by the IA staff before entering the enclave.

Firewall filters (e.g., rules, access control lists [ACLs], screens, and policies) are the first line of defense in a layered security approach. They permit authorized packets and deny unauthorized packets based on port or service type. They enhance the posture of the network by not allowing packets to even reach a potential target within the security domain. The filters provided are highly susceptible ports and services that should be blocked or limited as much as possible without adversely affecting customer requirements. Auditing packets attempting to penetrate the network but stopped by the firewall filters will allow network administrators to broaden their protective ring and more tightly define the scope of operation.

If the perimeter is in a Deny-by-Default posture and what is allowed through the filter is in accordance with the PPSM CAL and VAs for the enclave, and if the permit rule is explicitly defined with explicit ports and protocols allowed, then all requirements related to the database being blocked would be satisfied.

Checks

Review the perimeter firewall to verify it filters traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave.

If the perimeter firewall does not filter traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave, this is a finding.

Fix

Configure the perimeter firewall to filter traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave.
V-79487 No Change
Findings ID: SRG-NET-000113-FW-000005 Rule ID: SV-94193r1_rule Severity: low CCI: CCI-000169

Discussion

The generation of logs with a subset of criteria aide the system administrator, maintainers, and auditors when troubleshooting issues or reviewing the log for trends or security breaches.

Traffic log records can be generated from various components within the information system (e.g., network interface, access control list, or filter).

The DoD list of auditable events include the logging and audit requirements required by this document and any additional local requirements.

Checks

Obtain a list of required auditable events from the site representative or the System Security Plan (SSP). View the firewall configuration. Verify the firewall allows the system administrator to select a subset of DoD-required auditable events.

If the firewall is not configured to allow the system administrator to select a subset of DoD-required events, this is a finding.

Fix

Configure the firewall audit management functions to allow the authorized system administrator to select from a list of auditable events, to include the firewall's network interfaces, rules, and policies.
V-79489 No Change
Findings ID: SRG-NET-000392-FW-000042 Rule ID: SV-94195r1_rule Severity: low CCI: CCI-002664

Discussion

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.

The firewall generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs), which require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise.

Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema.

CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected.

Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The firewall must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

Checks

If a network device such as the events, network management, or SNMP server is configured to send an alert when DoS incidents are detected, this is not a finding.

Verify the firewall is configured to send an alert via instant message, email, SNMP, or another authorized method to the ISSO, ISSM, and other identified personnel when DoS incidents are detected.

If the firewall is not configured to send an alert via an approved and immediate method when DoS incidents are detected, this is a finding.

Fix

Configure the firewall (or another network device) to send an alert via instant message, email, or another authorized method to the ISSO and ISSM and other identified personnel when DoS incidents are detected.