ForeScout CounterACT ALG Security Technical Implementation Guide

  • Version/Release: V1R2
  • Published: 2018-01-03
  • Expand All:
  • Severity:
  • Sort:
Compare

Select any two versions of this STIG to compare the individual requirements

View

Select any old version/release of this STIG to view the previous requirements

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
b
CounterACT, when providing user access control intermediary services, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.
AC-8 - Medium - CCI-000048 - V-75913 - SV-90593r1_rule
RMF Control
AC-8
Severity
Medium
CCI
CCI-000048
Version
CACT-AG-000001
Vuln IDs
  • V-75913
Rule IDs
  • SV-90593r1_rule
Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with DoD requirements. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist, for example, with CounterACT guest access function. This requirement applies to network elements that have the concept of a user account and have the logon function residing on the network element. This requirement is not for access to the device itself, such as with system administrators of CounterACT, but rather is related to the network access control function provided to the users. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for network elements that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
Checks: C-75601r1_chk

If CounterACT does not provide user access control intermediary services, this is not applicable. Verify CounterACT displays the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network. 1. Log on to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Enable the "Display this Notice and Consent Message after login" and complete the provided text input area to have the Standard Mandatory DoD and Consent Banner before granting access to the device. This banner must include the following text: By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If CounterACT does not display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network, this is a finding.

Fix: F-82543r1_fix

If user network access control intermediary services are provided, configure CounterACT to display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network. 1. Log in to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Enable the "Display this Notice and Consent Message after login" and complete the provided text input area to have the Standard Mandatory DoD and Consent Banner before granting access to the device. This banner must include the following text: By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

a
CounterACT, when providing user access control intermediary services, must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.
AC-8 - Low - CCI-000050 - V-75931 - SV-90619r1_rule
RMF Control
AC-8
Severity
Low
CCI
CCI-000050
Version
CACT-AG-000002
Vuln IDs
  • V-75931
Rule IDs
  • SV-90619r1_rule
The banner must be acknowledged by the user prior to allowing the user access to the network. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoD will not be in compliance with system use notifications required by law. To establish acceptance of the application usage policy, a click-through banner at application logon is required. The network element must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating "OK". This policy only applies to gateways (e.g., identity management or authentication gateways) that provide user account services as part of the intermediary services.
Checks: C-75613r1_chk

If CounterACT does not provide user access control intermediary services, this is not applicable. Verify CounterACT retains the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and takes explicit actions to log on for further access. 1. Log in to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Verify the options for logon banner "require confirmation" is selected. If CounterACT does not retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access, this is a finding.

Fix: F-82569r1_fix

If user access control intermediary services are provided, configure CounterACT to retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access. 1. Log on to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Ensure the options for the logon banner "require confirmation" is selected.

b
CounterACT, when providing user access control intermediary services for publicly accessible applications, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.
AC-8 - Medium - CCI-001384 - V-75933 - SV-90621r1_rule
RMF Control
AC-8
Severity
Medium
CCI
CCI-001384
Version
CACT-AG-000003
Vuln IDs
  • V-75933
Rule IDs
  • SV-90621r1_rule
Display of a standardized and approved use notification before granting access to the publicly accessible network element ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to network elements that have the concept of a user account and have the logon function residing on the network element. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for network elements that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following:
Checks: C-75615r1_chk

If CounterACT does not provide user access control intermediary services, this is not applicable. Verify CounterACT displays the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system. 1. Log on to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Enable the "Display this Notice and Consent Message after login" and complete the provided text input area to have the Standard Mandatory DoD and Consent Banner before granting access to the device. This banner must include the following text: By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If CounterACT does not display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system, this is a finding.

Fix: F-82571r1_fix

If user access control intermediary services are provided, configure CounterACT to display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system. 1. Log on to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Enable the "Display this Notice and Consent Message after login" and complete the provided text input area to have the Standard Mandatory DoD and Consent Banner before granting access to the device. This banner must include the following text: By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

b
CounterACT must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.
AU-5 - Medium - CCI-000139 - V-75935 - SV-90623r1_rule
RMF Control
AU-5
Severity
Medium
CCI
CCI-000139
Version
CACT-AG-000004
Vuln IDs
  • V-75935
Rule IDs
  • SV-90623r1_rule
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Possible audit processing failures also include the inability of ALG to write to the central audit log. While this requirement also applies to the event monitoring system (e.g., Syslog, Security Information and Event Management [SIEM], or SNMP servers), CounterACT can also be configured to send notifications.
Checks: C-75617r1_chk

Verify CounterACT sends an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs. 1. Log in to the CounterACT Administrator interface. 2. Select Tools >> Options. 3. Select General. 4. Select the "+" next to general to open the submenu. Select email Preferences. 5. Ensure that the ISSO/SCA email address is configuration for notifications. If CounterACT does not send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs, this is a finding.

Fix: F-82573r1_fix

Configure CounterACT to send all alert notifications to, at a minimum, the ISSO and SCA when an audit processing failure occurs. 1. Log in to CounterACT’s Administrator interface. 2. Select Tools >> Options. 3. Select General. 4. Select the "+" next to general to open the submenu. Select email Preferences. 5. Ensure that the ISSO/SCA email address is configuration for notifications.

b
If user authentication services are provided, CounterACT must be configured with a pre-established trust relationship and mechanisms with a central directory service that validates user account access authorizations and privileges.
IA-2 - Medium - CCI-000764 - V-75937 - SV-90625r1_rule
RMF Control
IA-2
Severity
Medium
CCI
CCI-000764
Version
CACT-AG-000006
Vuln IDs
  • V-75937
Rule IDs
  • SV-90625r1_rule
User account and privilege validation must be centralized in order to prevent unauthorized access using changed or revoked privileges. CounterACT can implement functions such as traffic filtering, authentication, access, and authorization functions based on computer and user privileges. However, the directory service (e.g., Active Directory or LDAP) must not be installed on CounterACT, particularly if the gateway resides on the untrusted zone of the Enclave.
Checks: C-75619r1_chk

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT is configured for NAC services authentication. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory configured for Authentication. Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected. Verify with site representatives that the directory service validates user account access authorizations and privileges. If CounterACT does not use a central directory service to validate user account access authorizations and privileges, this is a finding.

Fix: F-82575r1_fix

If user authentication service is provided by CounterACT, configure the use of a central directory service for user authentication. Obtain configuration information for a directory service (e.g., Active Directory or LDAP) that validates user account access authorizations and privileges. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory configured for Authentication. Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected.

b
If user authentication services are provided, CounterACT must restrict user authentication traffic to specific authentication server(s).
IA-2 - Medium - CCI-000764 - V-75939 - SV-90627r1_rule
RMF Control
IA-2
Severity
Medium
CCI
CCI-000764
Version
CACT-AG-000007
Vuln IDs
  • V-75939
Rule IDs
  • SV-90627r1_rule
User authentication can be used as part of the policy filtering rule sets. Some URLs or network resources can be restricted to authenticated users only. Users are prompted by the application or browser for credentials. Authentication service may be provided by CounterACT as an intermediary for the application; however, the authentication credential must be stored in the site's directory services server. This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).
Checks: C-75621r1_chk

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT is configured to use a specific authentication server(s). 1. Connect to the CounterACT Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory is configured for Authentication. Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected. 4. Verify the Hostname is correct for the assigned directory and then select "OK". (Select "Apply" if changes were made.) 5. Select the directory and then select test. Verify both tests past. If CounterACT does not restrict user authentication traffic to a specific authentication server(s), this is a finding.

Fix: F-82577r1_fix

If user authentication service is provided by CounterACT, configure the use of a central directory service for user authentication. 1. Connect to the CounterACT Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Ensure the User Directory configured for Authentication. Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected. 4. Ensure the Hostname is correct for the assigned directory and then select "OK". (Select "Apply" if changes were made.) 5. Select the directory and then select test. Ensure both tests passed.

b
CounterACT, when providing user authentication intermediary services, must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
IA-2 - Medium - CCI-001942 - V-75941 - SV-90629r1_rule
RMF Control
IA-2
Severity
Medium
CCI
CCI-001942
Version
CACT-AG-000009
Vuln IDs
  • V-75941
Rule IDs
  • SV-90629r1_rule
A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack. An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. A non-privileged account is any account with the authorizations of a non-privileged user. Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. Security relevant roles include key management, account management, network and system administration, database administration, and web administration. Techniques used to address this include protocols using nonces (e.g., numbers generated for a specific one time use) or challenges (e.g., TLS). Additional techniques include time-synchronous or challenge-response one-time authenticators. This requirement applies to ALGs that provide user authentication intermediary services.
Checks: C-75623r1_chk

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT is configured to implement replay-resistant authentication mechanisms for network access to non-privileged accounts. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory is configured for secure methods of communication. On the Settings TAB ensure the "Use TLS" radio button is selected. If CounterACT does not implement replay-resistant authentication mechanisms for network access to non-privileged accounts, this is a finding.

Fix: F-82579r1_fix

If user authentication intermediary services are provided, configure CounterACT to implement replay-resistant authentication mechanisms for network access to non-privileged accounts. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Ensure the User Directory is configured for secure methods of communication. On the Settings TAB ensure the "Use TLS" radio button is selected. 4. Select "OK". (Select "Apply" if changes were made.)

b
CounterACT must off-load audit records onto a centralized log server.
AU-4 - Medium - CCI-001851 - V-75943 - SV-90631r1_rule
RMF Control
AU-4
Severity
Medium
CCI
CCI-001851
Version
CACT-AG-000010
Vuln IDs
  • V-75943
Rule IDs
  • SV-90631r1_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. This does not apply to audit logs generated on behalf of the device itself (management).
Checks: C-75625r1_chk

Verify CounterACT off-loads audit records onto a centralized log server. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> Plugins >> Syslog. 3. Verify a Syslog server is configured in the "Send To" tab. 4. On the Events Filtering Tab, ensure all radio buttons associated with NAC Events, Threat Protection, System Logs, User Operations, and Operating System messages are selected. If CounterACT does not off-load audit records onto a centralized log server, this is a finding.

Fix: F-82581r1_fix

Configure CounterACT to off-load audit records onto a centralized log server. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> Plugins >> Syslog. 3. Ensure a Syslog server is configured in the "Send To" tab. 4. On the Events Filtering Tab, ensure all radio buttons associated with NAC Events, Threat Protection, System Logs, User Operations, and Operating System messages are selected. 5. Select "OK". (Select "Apply" if changes were made.)

b
CounterACT, when providing user authentication intermediary services, must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.
IA-11 - Medium - CCI-002038 - V-76185 - SV-90873r1_rule
RMF Control
IA-11
Severity
Medium
CCI
CCI-002038
Version
CACT-AG-000011
Vuln IDs
  • V-76185
Rule IDs
  • SV-90873r1_rule
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. In addition to the reauthentication requirements associated with session locks, organizations may require reauthentication of individuals and/or devices in other situations, including (but not limited to) the following circumstances: 1. When authenticators change 2. When roles change 3. When security categories of information systems change 4. When the execution of privileged functions occurs 5. After a fixed period of time 6. Periodically Within the DoD, the minimum circumstances requiring reauthentication are privilege escalation and role changes. This requirement only applies to components where this is specific to the function of the device or has the concept of user authentication (e.g., VPN or ALG capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).
Checks: C-75871r1_chk

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT is configured to require users to reauthenticate when organization-defined circumstances or situations require reauthentication. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> 802.1x. 3. Select the Pre-Admission Authorization tab. 4. On each Rule that "Accepts", verify there is an Attribute "Session-Timeout" configured to the maximum session configuration, typically 60 minutes, but not more than 120. If CounterACT does not require users to reauthenticate when organization-defined circumstances or situations require reauthentication, this is a finding.

Fix: F-82823r1_fix

If user access control intermediary services are provided, configure CounterACT to require users to reauthenticate when organization-defined circumstances or situations require reauthentication. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> 802.1x. 3. Select the Pre-Admission Authorization tab. 4. On each Rule that "Accepts", ensure there is an Attribute "Session-Timeout" configured to the maximum session configuration, typically 60 minutes, but not more than 120.

b
CounterACT, when providing user authentication intermediary services, must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
IA-2 - Medium - CCI-001951 - V-76187 - SV-90875r1_rule
RMF Control
IA-2
Severity
Medium
CCI
CCI-001951
Version
CACT-AG-000012
Vuln IDs
  • V-76187
Rule IDs
  • SV-90875r1_rule
For remote access to non-privileged accounts, the purpose of requiring a device that is separate from the information system gaining access for one of the factors during multifactor authentication is to reduce the likelihood of compromising authentication credentials stored on the system. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD common access card. A privileged account is defined as an information system account with authorizations of a privileged user. Remote access is access to DoD-nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. An example of compliance with this requirement is the use of a one-time password token and PIN coupled with a password; or the use of a CAC/PIV card and PIN coupled with a password.
Checks: C-75873r1_chk

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT implements multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory configured for Authentication uses Multi-Factor credentials Select the configured directory (or directories) and on the General Tab verify the "Use for Authentication" radio button is selected. 4. Verify the Hostname is correct for the assigned directory then select "OK". (Select "Apply" if changes were made.) If CounterACT does not implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access, this is a finding.

Fix: F-82825r1_fix

If user authentication intermediary services are provided, configure CounterACT to implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Ensure the User Directory configured for Authentication uses Multi-Factor credentials Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected. 4. Ensure the Hostname is correct for the assigned directory then select "OK". (Select "Apply" if changes were made.)

b
CounterACT must off-load audit records onto a centralized log server in real time.
AU-4 - Medium - CCI-001851 - V-76189 - SV-90877r1_rule
RMF Control
AU-4
Severity
Medium
CCI
CCI-001851
Version
CACT-AG-000014
Vuln IDs
  • V-76189
Rule IDs
  • SV-90877r1_rule
Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. Off-loading is a common process in information systems with limited audit storage capacity. The audit storage on the ALG is used only in a transitory fashion until the system can communicate with the centralized log server designated for storing the audit records, at which point the information is transferred. However, DoD requires that the log be transferred in real time which indicates that the time from event detection to off-loading is seconds or less. This does not apply to audit logs generated on behalf of the device itself (management).
Checks: C-75875r1_chk

Verify CounterACT off-loads audit records onto a centralized log server in real time. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> Plugins >> Syslog. 3. Verify a Syslog server is configured in the "Send To" tab. 4. On the Events Filtering Tab, Verify all radio buttons associated with NAC Events, Threat Protection, System Logs, User Operations, and Operating systems messages are selected. If CounterACT does not off-load onto a centralized log server in real time, this is a finding.

Fix: F-82827r1_fix

Configure CounterACT to off-load onto a centralized log server in real time. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> Plugins >> Syslog. 3. Ensure a Syslog server is configured in the "Send To" tab. 4. On the Events Filtering Tab, ensure all radio buttons associated with NAC Events, Threat Protection, System Logs, User Operations, and Operating systems messages are selected.

b
CounterACT must use an Enterprise Manager or other high availability solution to ensure redundancy in case of audit failure in this critical network access control and security service.
AU-5 - Medium - CCI-000140 - V-76191 - SV-90879r2_rule
RMF Control
AU-5
Severity
Medium
CCI
CCI-000140
Version
CACT-AG-000026
Vuln IDs
  • V-76191
Rule IDs
  • SV-90879r2_rule
It is critical that when the network element is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include: software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. When availability is an overriding concern, other approved actions in response to an audit failure are as follows: 1. If the failure was caused by the lack of audit record storage capacity, the network element must continue generating audit records if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner. 2. If audit records are sent to a centralized collection server and communication with this server is lost or the server fails, the network element must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server. A NAC is an essential security service and should not be shut down in the event of an audit failure. Redundancy and rollover features of the CounterACT enterprise or a high availability solution should be leveraged. Load balancing and redundancy is a function of the CounterAct enterprise architecture by default.
Checks: C-75877r2_chk

Examine architecture documentation. Verify CounterACT implementation includes an Enterprise Manager combined with Appliances to ensure redundancy. It is also acceptable to have two appliances configured for redundancy. If CounterACT implementation does not include an Enterprise Manager combined with Appliances or a high availability solution to ensure redundancy, this is a finding.

Fix: F-82829r2_fix

Design and install CounterACT implementation to include an Enterprise Manager combined with one or more Appliances or a high availability solution. The Appliances will associate with the enterprise Manager or the high availability solution.