Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

ForeScout CounterACT ALG Security Technical Implementation Guide

V1R3 · · · Released 24 Jul 2024 · 13 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Supporting documents DISA companion ZIP · 1.0 MB 3 PDFs

Bundled by DISA alongside this STIG release: overview, revision history, and readme files. Download the full archive or open an individual PDF.

Download full ZIP U_ForeScout_CounterACT_ALG_V1R3_STIG.zip
Digest of Updates vs. V1R2 · 26 Jan 2018 +13 −12

Comparison against the immediately-prior release (V1R2). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Added rules 13

  • V-237572 Medium CounterACT, when providing user access control intermediary services, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.
  • V-237573 Low CounterACT, when providing user access control intermediary services, must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.
  • V-237574 Medium CounterACT, when providing user access control intermediary services for publicly accessible applications, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.
  • V-237575 Medium CounterACT must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.
  • V-237576 Medium If user authentication services are provided, CounterACT must be configured with a pre-established trust relationship and mechanisms with a central directory service that validates user account access authorizations and privileges.
  • V-237577 Medium If user authentication services are provided, CounterACT must restrict user authentication traffic to specific authentication server(s).
  • V-237578 Medium CounterACT, when providing user authentication intermediary services, must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
  • V-237579 Medium CounterACT must off-load audit records onto a centralized log server.
  • V-237580 Medium CounterACT, when providing user authentication intermediary services, must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.
  • V-237581 Medium CounterACT, when providing user authentication intermediary services, must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
  • V-237582 Medium CounterACT must off-load audit records onto a centralized log server in real time.
  • V-237583 Medium CounterACT must use an Enterprise Manager or other high availability solution to ensure redundancy in case of audit failure in this critical network access control and security service.
  • V-265638 High The version of ForeScout CounterAct must be a supported version.

Removed rules 12

  • V-75913 Medium CounterACT, when providing user access control intermediary services, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.
  • V-75931 Low CounterACT, when providing user access control intermediary services, must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.
  • V-75933 Medium CounterACT, when providing user access control intermediary services for publicly accessible applications, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.
  • V-75935 Medium CounterACT must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.
  • V-75937 Medium If user authentication services are provided, CounterACT must be configured with a pre-established trust relationship and mechanisms with a central directory service that validates user account access authorizations and privileges.
  • V-75939 Medium If user authentication services are provided, CounterACT must restrict user authentication traffic to specific authentication server(s).
  • V-75941 Medium CounterACT, when providing user authentication intermediary services, must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
  • V-75943 Medium CounterACT must off-load audit records onto a centralized log server.
  • V-76185 Medium CounterACT, when providing user authentication intermediary services, must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.
  • V-76187 Medium CounterACT, when providing user authentication intermediary services, must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
  • V-76189 Medium CounterACT must off-load audit records onto a centralized log server in real time.
  • V-76191 Medium CounterACT must use an Enterprise Manager or other high availability solution to ensure redundancy in case of audit failure in this critical network access control and security service.
Sort by
b
CounterACT, when providing user access control intermediary services, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.
AC-8 - Medium - CCI-000048 - V-237572 - SV-237572r645654_rule
RMF Control
AC-8
Severity
M
CCI
CCI-000048
Version
CACT-AG-000001
Vuln IDs
  • V-237572
  • V-75913
Rule IDs
  • SV-237572r645654_rule
  • SV-90593
Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with DoD requirements. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist, for example, with CounterACT guest access function. This requirement applies to network elements that have the concept of a user account and have the logon function residing on the network element. This requirement is not for access to the device itself, such as with system administrators of CounterACT, but rather is related to the network access control function provided to the users. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for network elements that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
Checks: C-40791r645652_chk

If CounterACT does not provide user access control intermediary services, this is not applicable. Verify CounterACT displays the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network. 1. Log on to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Enable the "Display this Notice and Consent Message after login" and complete the provided text input area to have the Standard Mandatory DoD and Consent Banner before granting access to the device. This banner must include the following text: By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If CounterACT does not display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network, this is a finding.

Fix: F-40754r645653_fix

If user network access control intermediary services are provided, configure CounterACT to display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network. 1. Log in to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Enable the "Display this Notice and Consent Message after login" and complete the provided text input area to have the Standard Mandatory DoD and Consent Banner before granting access to the device. This banner must include the following text: By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

a
CounterACT, when providing user access control intermediary services, must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.
AC-8 - Low - CCI-000050 - V-237573 - SV-237573r645657_rule
RMF Control
AC-8
Severity
L
CCI
CCI-000050
Version
CACT-AG-000002
Vuln IDs
  • V-237573
  • V-75931
Rule IDs
  • SV-237573r645657_rule
  • SV-90619
The banner must be acknowledged by the user prior to allowing the user access to the network. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoD will not be in compliance with system use notifications required by law. To establish acceptance of the application usage policy, a click-through banner at application logon is required. The network element must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating "OK". This policy only applies to gateways (e.g., identity management or authentication gateways) that provide user account services as part of the intermediary services.
Checks: C-40792r645655_chk

If CounterACT does not provide user access control intermediary services, this is not applicable. Verify CounterACT retains the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and takes explicit actions to log on for further access. 1. Log in to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Verify the options for logon banner "require confirmation" is selected. If CounterACT does not retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access, this is a finding.

Fix: F-40755r645656_fix

If user access control intermediary services are provided, configure CounterACT to retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access. 1. Log on to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Ensure the options for the logon banner "require confirmation" is selected.

b
CounterACT, when providing user access control intermediary services for publicly accessible applications, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.
AC-8 - Medium - CCI-001384 - V-237574 - SV-237574r645660_rule
RMF Control
AC-8
Severity
M
CCI
CCI-001384
Version
CACT-AG-000003
Vuln IDs
  • V-237574
  • V-75933
Rule IDs
  • SV-237574r645660_rule
  • SV-90621
Display of a standardized and approved use notification before granting access to the publicly accessible network element ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to network elements that have the concept of a user account and have the logon function residing on the network element. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for network elements that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following:
Checks: C-40793r645658_chk

If CounterACT does not provide user access control intermediary services, this is not applicable. Verify CounterACT displays the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system. 1. Log on to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Enable the "Display this Notice and Consent Message after login" and complete the provided text input area to have the Standard Mandatory DoD and Consent Banner before granting access to the device. This banner must include the following text: By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If CounterACT does not display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system, this is a finding.

Fix: F-40756r645659_fix

If user access control intermediary services are provided, configure CounterACT to display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system. 1. Log on to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Enable the "Display this Notice and Consent Message after login" and complete the provided text input area to have the Standard Mandatory DoD and Consent Banner before granting access to the device. This banner must include the following text: By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

b
CounterACT must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.
AU-5 - Medium - CCI-000139 - V-237575 - SV-237575r645663_rule
RMF Control
AU-5
Severity
M
CCI
CCI-000139
Version
CACT-AG-000004
Vuln IDs
  • V-237575
  • V-75935
Rule IDs
  • SV-237575r645663_rule
  • SV-90623
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Possible audit processing failures also include the inability of ALG to write to the central audit log. While this requirement also applies to the event monitoring system (e.g., Syslog, Security Information and Event Management [SIEM], or SNMP servers), CounterACT can also be configured to send notifications.
Checks: C-40794r645661_chk

Verify CounterACT sends an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs. 1. Log in to the CounterACT Administrator interface. 2. Select Tools >> Options. 3. Select General. 4. Select the "+" next to general to open the submenu. Select email Preferences. 5. Ensure that the ISSO/SCA email address is configuration for notifications. If CounterACT does not send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs, this is a finding.

Fix: F-40757r645662_fix

Configure CounterACT to send all alert notifications to, at a minimum, the ISSO and SCA when an audit processing failure occurs. 1. Log in to CounterACT’s Administrator interface. 2. Select Tools >> Options. 3. Select General. 4. Select the "+" next to general to open the submenu. Select email Preferences. 5. Ensure that the ISSO/SCA email address is configuration for notifications.

b
If user authentication services are provided, CounterACT must be configured with a pre-established trust relationship and mechanisms with a central directory service that validates user account access authorizations and privileges.
IA-2 - Medium - CCI-000764 - V-237576 - SV-237576r645666_rule
RMF Control
IA-2
Severity
M
CCI
CCI-000764
Version
CACT-AG-000006
Vuln IDs
  • V-237576
  • V-75937
Rule IDs
  • SV-237576r645666_rule
  • SV-90625
User account and privilege validation must be centralized in order to prevent unauthorized access using changed or revoked privileges. CounterACT can implement functions such as traffic filtering, authentication, access, and authorization functions based on computer and user privileges. However, the directory service (e.g., Active Directory or LDAP) must not be installed on CounterACT, particularly if the gateway resides on the untrusted zone of the Enclave.
Checks: C-40795r645664_chk

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT is configured for NAC services authentication. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory configured for Authentication. Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected. Verify with site representatives that the directory service validates user account access authorizations and privileges. If CounterACT does not use a central directory service to validate user account access authorizations and privileges, this is a finding.

Fix: F-40758r645665_fix

If user authentication service is provided by CounterACT, configure the use of a central directory service for user authentication. Obtain configuration information for a directory service (e.g., Active Directory or LDAP) that validates user account access authorizations and privileges. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory configured for Authentication. Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected.

b
If user authentication services are provided, CounterACT must restrict user authentication traffic to specific authentication server(s).
IA-2 - Medium - CCI-000764 - V-237577 - SV-237577r645669_rule
RMF Control
IA-2
Severity
M
CCI
CCI-000764
Version
CACT-AG-000007
Vuln IDs
  • V-237577
  • V-75939
Rule IDs
  • SV-237577r645669_rule
  • SV-90627
User authentication can be used as part of the policy filtering rule sets. Some URLs or network resources can be restricted to authenticated users only. Users are prompted by the application or browser for credentials. Authentication service may be provided by CounterACT as an intermediary for the application; however, the authentication credential must be stored in the site's directory services server. This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).
Checks: C-40796r645667_chk

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT is configured to use a specific authentication server(s). 1. Connect to the CounterACT Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory is configured for Authentication. Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected. 4. Verify the Hostname is correct for the assigned directory and then select "OK". (Select "Apply" if changes were made.) 5. Select the directory and then select test. Verify both tests past. If CounterACT does not restrict user authentication traffic to a specific authentication server(s), this is a finding.

Fix: F-40759r645668_fix

If user authentication service is provided by CounterACT, configure the use of a central directory service for user authentication. 1. Connect to the CounterACT Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Ensure the User Directory configured for Authentication. Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected. 4. Ensure the Hostname is correct for the assigned directory and then select "OK". (Select "Apply" if changes were made.) 5. Select the directory and then select test. Ensure both tests passed.

b
CounterACT, when providing user authentication intermediary services, must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
IA-2 - Medium - CCI-001942 - V-237578 - SV-237578r981631_rule
RMF Control
IA-2
Severity
M
CCI
CCI-001942
Version
CACT-AG-000009
Vuln IDs
  • V-237578
  • V-75941
Rule IDs
  • SV-237578r981631_rule
  • SV-90629
A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack. An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. A non-privileged account is any account with the authorizations of a non-privileged user. Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. Security relevant roles include key management, account management, network and system administration, database administration, and web administration. Techniques used to address this include protocols using nonces (e.g., numbers generated for a specific one time use) or challenges (e.g., TLS). Additional techniques include time-synchronous or challenge-response one-time authenticators. This requirement applies to ALGs that provide user authentication intermediary services.
Checks: C-40797r645670_chk

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT is configured to implement replay-resistant authentication mechanisms for network access to non-privileged accounts. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory is configured for secure methods of communication. On the Settings TAB ensure the "Use TLS" radio button is selected. If CounterACT does not implement replay-resistant authentication mechanisms for network access to non-privileged accounts, this is a finding.

Fix: F-40760r645671_fix

If user authentication intermediary services are provided, configure CounterACT to implement replay-resistant authentication mechanisms for network access to non-privileged accounts. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Ensure the User Directory is configured for secure methods of communication. On the Settings TAB ensure the "Use TLS" radio button is selected. 4. Select "OK". (Select "Apply" if changes were made.)

b
CounterACT must off-load audit records onto a centralized log server.
AU-4 - Medium - CCI-001851 - V-237579 - SV-237579r831486_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
CACT-AG-000010
Vuln IDs
  • V-237579
  • V-75943
Rule IDs
  • SV-237579r831486_rule
  • SV-90631
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. This does not apply to audit logs generated on behalf of the device itself (management).
Checks: C-40798r645673_chk

Verify CounterACT off-loads audit records onto a centralized log server. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> Plugins >> Syslog. 3. Verify a Syslog server is configured in the "Send To" tab. 4. On the Events Filtering Tab, ensure all radio buttons associated with NAC Events, Threat Protection, System Logs, User Operations, and Operating System messages are selected. If CounterACT does not off-load audit records onto a centralized log server, this is a finding.

Fix: F-40761r645674_fix

Configure CounterACT to off-load audit records onto a centralized log server. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> Plugins >> Syslog. 3. Ensure a Syslog server is configured in the "Send To" tab. 4. On the Events Filtering Tab, ensure all radio buttons associated with NAC Events, Threat Protection, System Logs, User Operations, and Operating System messages are selected. 5. Select "OK". (Select "Apply" if changes were made.)

b
CounterACT, when providing user authentication intermediary services, must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.
IA-11 - Medium - CCI-002038 - V-237580 - SV-237580r987783_rule
RMF Control
IA-11
Severity
M
CCI
CCI-002038
Version
CACT-AG-000011
Vuln IDs
  • V-237580
  • V-76185
Rule IDs
  • SV-237580r987783_rule
  • SV-90873
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. In addition to the reauthentication requirements associated with session locks, organizations may require reauthentication of individuals and/or devices in other situations, including (but not limited to) the following circumstances: 1. When authenticators change 2. When roles change 3. When security categories of information systems change 4. When the execution of privileged functions occurs 5. After a fixed period of time 6. Periodically Within the DoD, the minimum circumstances requiring reauthentication are privilege escalation and role changes. This requirement only applies to components where this is specific to the function of the device or has the concept of user authentication (e.g., VPN or ALG capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).
Checks: C-40799r645676_chk

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT is configured to require users to reauthenticate when organization-defined circumstances or situations require reauthentication. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> 802.1x. 3. Select the Pre-Admission Authorization tab. 4. On each Rule that "Accepts", verify there is an Attribute "Session-Timeout" configured to the maximum session configuration, typically 60 minutes, but not more than 120. If CounterACT does not require users to reauthenticate when organization-defined circumstances or situations require reauthentication, this is a finding.

Fix: F-40762r645677_fix

If user access control intermediary services are provided, configure CounterACT to require users to reauthenticate when organization-defined circumstances or situations require reauthentication. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> 802.1x. 3. Select the Pre-Admission Authorization tab. 4. On each Rule that "Accepts", ensure there is an Attribute "Session-Timeout" configured to the maximum session configuration, typically 60 minutes, but not more than 120.

b
CounterACT, when providing user authentication intermediary services, must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
IA-2 - Medium - CCI-001951 - V-237581 - SV-237581r981642_rule
RMF Control
IA-2
Severity
M
CCI
CCI-001951
Version
CACT-AG-000012
Vuln IDs
  • V-237581
  • V-76187
Rule IDs
  • SV-237581r981642_rule
  • SV-90875
For remote access to non-privileged accounts, the purpose of requiring a device that is separate from the information system gaining access for one of the factors during multifactor authentication is to reduce the likelihood of compromising authentication credentials stored on the system. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD common access card. A privileged account is defined as an information system account with authorizations of a privileged user. Remote access is access to DoD-nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. An example of compliance with this requirement is the use of a one-time password token and PIN coupled with a password; or the use of a CAC/PIV card and PIN coupled with a password.
Checks: C-40800r645679_chk

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT implements multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory configured for Authentication uses Multi-Factor credentials Select the configured directory (or directories) and on the General Tab verify the "Use for Authentication" radio button is selected. 4. Verify the Hostname is correct for the assigned directory then select "OK". (Select "Apply" if changes were made.) If CounterACT does not implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access, this is a finding.

Fix: F-40763r645680_fix

If user authentication intermediary services are provided, configure CounterACT to implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Ensure the User Directory configured for Authentication uses Multi-Factor credentials Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected. 4. Ensure the Hostname is correct for the assigned directory then select "OK". (Select "Apply" if changes were made.)

b
CounterACT must off-load audit records onto a centralized log server in real time.
AU-4 - Medium - CCI-001851 - V-237582 - SV-237582r831489_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
CACT-AG-000014
Vuln IDs
  • V-237582
  • V-76189
Rule IDs
  • SV-237582r831489_rule
  • SV-90877
Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. Off-loading is a common process in information systems with limited audit storage capacity. The audit storage on the ALG is used only in a transitory fashion until the system can communicate with the centralized log server designated for storing the audit records, at which point the information is transferred. However, DoD requires that the log be transferred in real time which indicates that the time from event detection to off-loading is seconds or less. This does not apply to audit logs generated on behalf of the device itself (management).
Checks: C-40801r645682_chk

Verify CounterACT off-loads audit records onto a centralized log server in real time. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> Plugins >> Syslog. 3. Verify a Syslog server is configured in the "Send To" tab. 4. On the Events Filtering Tab, Verify all radio buttons associated with NAC Events, Threat Protection, System Logs, User Operations, and Operating systems messages are selected. If CounterACT does not off-load onto a centralized log server in real time, this is a finding.

Fix: F-40764r645683_fix

Configure CounterACT to off-load onto a centralized log server in real time. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> Plugins >> Syslog. 3. Ensure a Syslog server is configured in the "Send To" tab. 4. On the Events Filtering Tab, ensure all radio buttons associated with NAC Events, Threat Protection, System Logs, User Operations, and Operating systems messages are selected.

b
CounterACT must use an Enterprise Manager or other high availability solution to ensure redundancy in case of audit failure in this critical network access control and security service.
AU-5 - Medium - CCI-000140 - V-237583 - SV-237583r645687_rule
RMF Control
AU-5
Severity
M
CCI
CCI-000140
Version
CACT-AG-000026
Vuln IDs
  • V-237583
  • V-76191
Rule IDs
  • SV-237583r645687_rule
  • SV-90879
It is critical that when the network element is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include: software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. When availability is an overriding concern, other approved actions in response to an audit failure are as follows: 1. If the failure was caused by the lack of audit record storage capacity, the network element must continue generating audit records if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner. 2. If audit records are sent to a centralized collection server and communication with this server is lost or the server fails, the network element must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server. A NAC is an essential security service and should not be shut down in the event of an audit failure. Redundancy and rollover features of the CounterACT enterprise or a high availability solution should be leveraged. Load balancing and redundancy is a function of the CounterAct enterprise architecture by default.
Checks: C-40802r645685_chk

Examine architecture documentation. Verify CounterACT implementation includes an Enterprise Manager combined with Appliances to ensure redundancy. It is also acceptable to have two appliances configured for redundancy. If CounterACT implementation does not include an Enterprise Manager combined with Appliances or a high availability solution to ensure redundancy, this is a finding.

Fix: F-40765r645686_fix

Design and install CounterACT implementation to include an Enterprise Manager combined with one or more Appliances or a high availability solution. The Appliances will associate with the enterprise Manager or the high availability solution.

c
The version of ForeScout CounterAct must be a supported version.
SC-7 - High - CCI-002409 - V-265638 - SV-265638r1001001_rule
RMF Control
SC-7
Severity
H
CCI
CCI-002409
Version
CACT-AG-999999
Vuln IDs
  • V-265638
Rule IDs
  • SV-265638r1001001_rule
Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). This requirement will apply to software patch management solutions that are used to install patches across the enclave and to applications themselves that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the period used must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process. The application will be configured to check for and install security-relevant software updates within an identified period from the availability of the update. The specific period will be defined by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).
Checks: C-69553r997798_chk

ForeScout CounterAct versions supported by this STIG (Version 8 and earlier) are no longer supported by the vendor. If the system is running any CounterAct version, this is a finding.

Fix: F-53958r798705_fix

Upgrade to a supported version.