Free DISA STIG and SRG Library | Vaulted

Akamai KSD Service Impact Level 2 ALG Security Technical Implementation Guide

Version 1 Release 1
2017-09-12
U_Akamai_KSD_Service_IL2_ALG_STIG_V1R1_Manual-xccdf.xml
This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Vulnerabilities (33)

Kona Site Defender must immediately use updates made to policy enforcement mechanisms to enforce that all traffic flows over HTTPS port 443.

Finding ID
AKSD-WF-000001
Rule ID
SV-91087r1_rule
Severity
Cat I
CCE
(None)
Group Title
SRG-NET-000019-ALG-000018
CCI
CCI-001414
Target Key
(None)
Documentable
No
Discussion

Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events. Changes to the ALG must take effect when made by an authorized administrator and the new configuration is put in place or committed, including upon restart of the application or reboot of the system. With some devices, the changes take effect as the configuration is changed, while with others, the new configuration must be submitted to the device. In any case, the behavior of the ALG must immediately be affected to reflect the configuration change.

Fix Text

Configure Kona Site Defender to enforce all traffic flows over HTTPS port 443: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Select Group or Property" button. 3. Select the configuration that is being reviewed. 4. Under the "Active Production" section, click on the active version. 5. On the "Property Manager Editor" screen, click the "Edit New Version" button. 6. In the "Property Version Information" section, enable the "Security Options" check box. 7. Click the "Save" button. 8. Select the "Activate" tab and push the configuration to production.

Check Content

Confirm Kona Site Defender is configured to enforce all traffic flows over HTTPS port 443: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Select Group or Property" button. 3. Select the configuration that is being reviewed. 4. Under the "Active Production" section, click on the active version. 5. In the "Property Version Information" section, verify the "Security Options" check box is checked. If the "Security Options" check box in "Property Manager" is not configured to enforce all traffic flows over HTTPS port 443, this is a finding.

Kona Site Defender must immediately apply updates to the Kona Rule Set to block designated traffic of interest in response to new or emerging threats.

Finding ID
AKSD-WF-000002
Rule ID
SV-91089r1_rule
Severity
Cat I
CCE
(None)
Group Title
SRG-NET-000019-ALG-000019
CCI
CCI-001414
Target Key
(None)
Documentable
No
Discussion

Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events. Changes to the ALG must take effect when made by an authorized administrator and the new configuration is put in place or committed, including upon restart of the application or reboot of the system. With some devices, the changes take effect as the configuration is changed, while with others, the new configuration must be submitted to the device. In any case, the behavior of the ALG must immediately be affected to reflect the configuration change.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules. The Akamai Professional Services team should be consulted to implement this Fix content due to the complexities involved. In most cases, this should be included in the SLA. 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed and click the "Edit" button. 8. Enable the "Application Layer Controls" box and the "Slow POST Protection" box. 9. Click the "Next" button and set each of the following "KRS Rule Set" rules to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Score (Inbound) - Total Response Score (Outbound) - DDOS 10. Click the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Application Layer Controls" checkbox is enabled. 9. Verify the following "KRS Rule Set" rules are set to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Scor4e (Inbound) - Total Response Score (Outbound) - DDOS 10. Verify the "Enabled Slow POST Protection" section appears. If the application layer controls are not set to "Deny" mode or slow POST protection does not appear, this is a finding.

Kona Site Defender must immediately use updates made to policy enforcement mechanisms to block traffic from organizationally defined geographic regions.

Finding ID
AKSD-WF-000003
Rule ID
SV-91091r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000019-ALG-000019
CCI
CCI-001414
Target Key
(None)
Documentable
No
Discussion

Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events. Changes to the ALG must take effect when made by an authorized administrator and the new configuration is put in place or committed, including upon restart of the application or reboot of the system. With some devices, the changes take effect as the configuration is changed, while with others, the new configuration must be submitted to the device. In any case, the behavior of the ALG must immediately be affected to reflect the configuration change.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined geographic regions: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed, click the "Edit" button, and enable the "Network Layer Controls" box. 8. Select the "Geographical Controls" tab and add the blocked geographic regions. 9. Click the "Save" button and the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined geographic regions: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Network Layer Controls" checkbox is enabled. 9. Within the "Network Layer Controls Configuration" section, verify the organizationally defined geographic regions appear in the "Blocked GEOs" list. If the Network Layer Controls are not enabled and the organizationally defined geographic regions do not appear in the list, this is a finding.

Kona Site Defender must immediately use updates made to policy enforcement mechanisms to block traffic from organizationally defined IP addresses (i.e., IP blacklist).

Finding ID
AKSD-WF-000004
Rule ID
SV-91093r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000019-ALG-000019
CCI
CCI-001414
Target Key
(None)
Documentable
No
Discussion

Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events. Changes to the ALG must take effect when made by an authorized administrator and the new configuration is put in place or committed, including upon restart of the application or reboot of the system. With some devices, the changes take effect as the configuration is changed, while with others, the new configuration must be submitted to the device. In any case, the behavior of the ALG must immediately be affected to reflect the configuration change.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined IP addresses: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" sections, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed, click the "Edit" button, and enable the "Network Layer Controls" box. 8. Select the "IP Controls" tab and add the blocked IP addresses. 9. Select the "Network Lists" tab and add/select the blocked network lists. 10. Click the "Save" button and the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined IP addresses: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Network Layer Controls" checkbox is enabled. 9. Within the "Network Layer Controls Configuration" section, verify the organizationally defined IP address appear in the "Blocked IPs" area, and the applicable predefined network lists appear in the "Blocked IP Network Lists" area. If the Network Layer Controls are not enabled and the organizationally defined IP addresses/network lists do not appear in the lists area, this is a finding.

Kona Site Defender must immediately use updates made to policy enforcement mechanisms to allow traffic from organizationally defined IP addresses (i.e., IP whitelist).

Finding ID
AKSD-WF-000005
Rule ID
SV-91095r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000019-ALG-000019
CCI
CCI-001414
Target Key
(None)
Documentable
No
Discussion

Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events. Changes to the ALG must take effect when made by an authorized administrator and the new configuration is put in place or committed, including upon restart of the application or reboot of the system. With some devices, the changes take effect as the configuration is changed, while with others, the new configuration must be submitted to the device. In any case, the behavior of the ALG must immediately be affected to reflect the configuration change.

Fix Text

Configure the Kona Site Defender to allow traffic for organizationally defined IP addresses: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" sections, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed, click the "Edit" button, and enable the "Network Layer Controls" box. 8. Select the "IP Controls" tab and add the blocked IP addresses to the "Allowed IPs" area. 9. Select the "Network Lists" tab and add/select the allowed network lists to the "Reputation Whitelist" area. 10. Click the "Save" button and the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to allow traffic for organizationally defined IP addresses: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Network Layer Controls" checkbox is enabled. 9. Within the "Network Layer Controls Configuration" section, verify the organizationally defined IP addresses appear in the "Allowed IPs" area and the applicable predefined network lists appear in the "Allowed IP Network Lists" area. If the Network Layer Controls are not enabled and the organizationally defined IP addresses/network lists do not appear in the lists area, this is a finding. NOTE: Not all sites will implement organizationally defined white lists.

Kona Site Defender that provides intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52.

Finding ID
AKSD-WF-000007
Rule ID
SV-91097r1_rule
Severity
Cat I
CCE
(None)
Group Title
SRG-NET-000062-ALG-000150
CCI
CCI-000068
Target Key
(None)
Documentable
No
Discussion

NIST SP 800-52 provides guidance on using the most secure version and configuration of the TLS/SSL protocol. Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol. This requirement applies to TLS gateways (also known as SSL gateways) and is not applicable to VPN devices. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and therefore are in scope for this requirement. NIST SP 800-52 provides guidance. NIST SP 800-52 sets TLS version 1.1 as a minimum version; thus, no versions of SSL are allowed (including for client negotiation) on either DoD only or public-facing servers.

Fix Text

Configure Kona Site Defender to only allow NIST SP 800-52 TLS settings: Contact the Akamai Professional Services team to implement the changes at 1-877-4-AKATEC (1-877-425-2832).

Check Content

Confirm Kona Site Defender allows only NIST SP 800-52 TLS settings: 1. Navigate to the Qualys SSL Scanner: https://www.ssllabs.com/ssltest/analyze.html 2. Enter into the scanner the Hostname being tested. 3. Under the "Configurations" and then "Protocol" section, verify that communications are restricted to TLS versions 1.2 and above for government-only services or TLS versions 1.0 and above for citizen or business-facing applications. If Kona Site Defender does not allow only NIST SP 800-52 TLS settings, this is a finding.

To protect against data mining, Kona Site Defender providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

Finding ID
AKSD-WF-000009
Rule ID
SV-91099r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000318-ALG-000014
CCI
CCI-002346
Target Key
(None)
Documentable
No
Discussion

Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of information. Injection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database or change data on a website. Web applications frequently access databases to store, retrieve, and update information. An attacker can construct inputs that the database will execute. This is most commonly referred to as a code injection attack. This type of attack includes XPath and LDAP injections. Compliance requires the ALG to have the capability to prevent code injections. Examples include web application firewalls (WAFs) or database application gateways.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules. The Akamai Professional Services team should be consulted to implement this Fix content due to the complexities involved. In most cases, this should be included in the SLA. 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed and click the "Edit" button. 8. Enable the "Application Layer Controls" box and the "Slow POST Protection" box. 9. Click the "Next" button and set each of the following "KRS Rule Set" rules to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Score (Inbound) - Total Response Score (Outbound) - DDOS 10. Click the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Application Layer Controls" checkbox is enabled. 9. Verify the following "KRS Rule Set" rules are set to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Scor4e (Inbound) - Total Response Score (Outbound) - DDOS 10. Verify the "Enabled Slow POST Protection" section appears. If the application layer controls are not set to "Deny" mode or slow POST protection does not appear, this is a finding.

To protect against data mining, Kona Site Defender providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.

Finding ID
AKSD-WF-000010
Rule ID
SV-91101r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000318-ALG-000151
CCI
CCI-002346
Target Key
(None)
Documentable
No
Discussion

Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of information. Injection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database or change data on a website. These attacks include buffer overrun, XML, JavaScript, and HTML injections. Compliance requires the ALG to have the capability to prevent code injections. Examples include web application firewalls (WAFs) or database application gateways.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules. The Akamai Professional Services team should be consulted to implement this Fix content due to the complexities involved. In most cases, this should be included in the SLA. 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed and click the "Edit" button. 8. Enable the "Application Layer Controls" box and the "Slow POST Protection" box. 9. Click the "Next" button and set each of the following "KRS Rule Set" rules to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Score (Inbound) - Total Response Score (Outbound) - DDOS 10. Click the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Application Layer Controls" checkbox is enabled. 9. Verify the following "KRS Rule Set" rules are set to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Scor4e (Inbound) - Total Response Score (Outbound) - DDOS 10. Verify the "Enabled Slow POST Protection" section appears. If the application layer controls are not set to "Deny" mode or slow POST protection does not appear, this is a finding.

To protect against data mining, Kona Site Defender providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.

Finding ID
AKSD-WF-000011
Rule ID
SV-91103r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000318-ALG-000152
CCI
CCI-002346
Target Key
(None)
Documentable
No
Discussion

Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of information. SQL injection attacks are the most prevalent attacks against web applications and databases. These attacks inject SQL commands that can read, modify, or compromise the meaning of the original SQL query. An attacker can spoof identity; expose, tamper, destroy, or make existing data unavailable; or gain unauthorized privileges on the database server. Compliance requires the ALG to have the capability to prevent SQL code injections. Examples include a web application firewalls (WAFs) or database application gateways.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules. The Akamai Professional Services team should be consulted to implement this Fix content due to the complexities involved. In most cases, this should be included in the SLA. 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed and click the "Edit" button. 8. Enable the "Application Layer Controls" box and the "Slow POST Protection" box. 9. Click the "Next" button and set each of the following "KRS Rule Set" rules to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Score (Inbound) - Total Response Score (Outbound) - DDOS 10. Click the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Application Layer Controls" checkbox is enabled. 9. Verify the following "KRS Rule Set" rules are set to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Scor4e (Inbound) - Total Response Score (Outbound) - DDOS 10. Verify the "Enabled Slow POST Protection" section appears. If the application layer controls are not set to "Deny" mode or slow POST protection does not appear, this is a finding.

To protect against data mining, Kona Site Defender providing content filtering must detect code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

Finding ID
AKSD-WF-000012
Rule ID
SV-91105r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000319-ALG-000015
CCI
CCI-002347
Target Key
(None)
Documentable
No
Discussion

Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks launched against organizational databases may result in the compromise of information. Injection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database or change data on a website. Web applications frequently access databases to store, retrieve, and update information. An attacker can construct inputs that the database will execute. This is most commonly referred to as a code injection attack. This type of attack includes XPath and LDAP injections. ALGs with anomaly detection must be configured to protect against unauthorized code injections. These devices must include rules and anomaly detection algorithms to monitor for atypical database queries or accesses. Examples include web application firewalls (WAFs) or database application gateways.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules. The Akamai Professional Services team should be consulted to implement this Fix content due to the complexities involved. In most cases, this should be included in the SLA. 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed and click the "Edit" button. 8. Enable the "Application Layer Controls" box and the "Slow POST Protection" box. 9. Click the "Next" button and set each of the following "KRS Rule Set" rules to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Score (Inbound) - Total Response Score (Outbound) - DDOS 10. Click the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Application Layer Controls" checkbox is enabled. 9. Verify the following "KRS Rule Set" rules are set to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Scor4e (Inbound) - Total Response Score (Outbound) - DDOS 10. Verify the "Enabled Slow POST Protection" section appears. If the application layer controls are not set to "Deny" mode or slow POST protection does not appear, this is a finding.

To protect against data mining, Kona Site Defender providing content filtering must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.

Finding ID
AKSD-WF-000013
Rule ID
SV-91107r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000319-ALG-000020
CCI
CCI-002347
Target Key
(None)
Documentable
No
Discussion

Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks launched against organizational databases may result in the compromise of information. SQL injection attacks are the most prevalent attacks against web applications and databases. These attacks inject SQL commands that can read, modify, or compromise the meaning of the original SQL query. An attacker can spoof identity; expose, tamper, destroy, or make existing data unavailable; or gain unauthorized privileges on the database server. ALGs with anomaly detection must be configured to protect against unauthorized data mining attacks. These devices must include rules and anomaly detection algorithms to monitor for atypical database queries or accesses. Examples include web application firewalls (WAFs) or database application gateways.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules. The Akamai Professional Services team should be consulted to implement this Fix content due to the complexities involved. In most cases, this should be included in the SLA. 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed and click the "Edit" button. 8. Enable the "Application Layer Controls" box and the "Slow POST Protection" box. 9. Click the "Next" button and set each of the following "KRS Rule Set" rules to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Score (Inbound) - Total Response Score (Outbound) - DDOS 10. Click the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Application Layer Controls" checkbox is enabled. 9. Verify the following "KRS Rule Set" rules are set to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Scor4e (Inbound) - Total Response Score (Outbound) - DDOS 10. Verify the "Enabled Slow POST Protection" section appears. If the application layer controls are not set to "Deny" mode or slow POST protection does not appear, this is a finding.

To protect against data mining, Kona Site Defender providing content filtering as part of its intermediary services must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code.

Finding ID
AKSD-WF-000014
Rule ID
SV-91109r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000319-ALG-000153
CCI
CCI-002347
Target Key
(None)
Documentable
No
Discussion

Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks launched against organizational applications may result in the compromise of information. Injection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database or change data on a website. These attacks include buffer overrun, XML, JavaScript, and HTML injections. ALGs with anomaly detection must be configured to protect against unauthorized code injections. These devices must include rules and anomaly detection algorithms to monitor for atypical database queries or accesses. Examples include web application firewalls (WAFs) or database application gateways.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules. The Akamai Professional Services team should be consulted to implement this Fix content due to the complexities involved. In most cases, this should be included in the SLA. 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed and click the "Edit" button. 8. Enable the "Application Layer Controls" box and the "Slow POST Protection" box. 9. Click the "Next" button and set each of the following "KRS Rule Set" rules to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Score (Inbound) - Total Response Score (Outbound) - DDOS 10. Click the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Application Layer Controls" checkbox is enabled. 9. Verify the following "KRS Rule Set" rules are set to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Scor4e (Inbound) - Total Response Score (Outbound) - DDOS 10. Verify the "Enabled Slow POST Protection" section appears. If the application layer controls are not set to "Deny" mode or slow POST protection does not appear, this is a finding.

Kona Site Defender must off-load audit records onto a centralized log server.

Finding ID
AKSD-WF-000015
Rule ID
SV-91111r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000334-ALG-000050
CCI
CCI-001851
Target Key
(None)
Documentable
No
Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. This does not apply to audit logs generated on behalf of the device itself (management).

Fix Text

Configure Kona Site Defender to deliver web logs via the Log Delivery Service (LDS): 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Select Group or Property" button. 3. Select the configuration that is being reviewed. 4. Under the "Active Production" section, click on the active version. 5. Click the "Edit" button (if not already selected). 6. Under the "Log Request Details" section, enable "Log Host Header", "Log Referrer Header", and "Log User-Agent Header". 7. Under the "Log Request Details" section, set "Cookie Mode" is set to "Log all cookies" or "Log some cookies" with the applicable cookies specified in the box below. 8. Click the "Save" button. 9. Activate the configuration by clicking the "Activate" tab and the activate buttons for the proper network (either staging or production). 10. Once the configuration has been propagated to the proper network, click the "Configure" tab. 11. Select "Log Delivery". 12. In the same row as the applicable object ID, click the gear icon under the "Action" column. 13. Select "Begin Log Delivery" and then either "New" or ""Copy" 14. Proceed through the prompts to select the log format and location to send the logs.

Check Content

Confirm Kona Site Defender is configured to deliver web logs via the Log Delivery Service (LDS): 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Select Group or Property" button. 3. Select the configuration that is being reviewed. 4. Under the "Active Production" section, click on the active version. 5. Under the "Log Request Details" section, verify that "Log Host Header", "Log Referrer Header", and "Log User-Agent Header" are all enabled. 6. Under the "Log Request Details" section, confirm that "Cookie Mode" is set to "Log all cookies" or "Log some cookies" with the applicable cookies specified in the box below. 7. Click the "Configure" tab. 8. Select "Log Delivery". 9. Verify the status is "Active" for the applicable object ID. If log delivery is not configured properly, this is a finding.

Kona Site Defender must off-load audit records onto a centralized log server in real time.

Finding ID
AKSD-WF-000016
Rule ID
SV-91113r1_rule
Severity
Cat III
CCE
(None)
Group Title
SRG-NET-000511-ALG-000051
CCI
CCI-001851
Target Key
(None)
Documentable
No
Discussion

Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. Off-loading is a common process in information systems with limited audit storage capacity. The audit storage on the ALG is used only in a transitory fashion until the system can communicate with the centralized log server designated for storing the audit records, at which point the information is transferred. However, DoD requires that the log be transferred in real time, which indicates that the time from event detection to off-loading is seconds or less. This does not apply to audit logs generated on behalf of the device itself (management).

Fix Text

Configure Kona Site Defender to deliver security event traffic to the SIEM: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted, select the product with which you would like to work and click "Continue". 5. Open the security configuration for which you want SIEM data. 6. Scroll down to the SIEM Integration section. 7. In the "Allow data collection for SIEM" field, click "Yes". 8. Choose the firewall policies for which you want to export data. Enable SIEM integration for: - ALL Firewall policies if you want to send SIEM data for events that violate any/all firewall policies within the security configuration. - The following firewall policies if you want data regarding one or more specific firewall policies. In the drop down list, choose the policies you want. 9. Skip the SIEM Event Version field for now. 10. Copy the number in the Security Config ID field. You’ll need it in a minute. 11. Push security configuration changes to the production network. - On the upper right of the Security Configuration page, click the Activate button. Under Network, choose Production and click Activate

Check Content

If the SIEM delivery option has been purchased, confirm that the Kona Site Defender SIEM integration is enabled: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted, select "Site Defender" and then "Continue". 5. Open the security configuration for which SIEM data is required. 6. Scroll down to the SIEM Integration section and verify that "Allow data collection for SIEM" is enabled. If "Allow data collection for SIEM field" is not enabled, this is a finding.

Kona Site Defender must not strip origin-defined HTTP session headers.

Finding ID
AKSD-WF-000018
Rule ID
SV-91115r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000169-ALG-000102
CCI
CCI-000804
Target Key
(None)
Documentable
No
Discussion

Lack of authentication enables anyone to gain access to the network or possibly a network element that provides the opportunity for intruders to compromise resources within the network infrastructure. By identifying and authenticating non-organizational users, their access to network resources can be restricted accordingly. Non-organizational users will be uniquely identified and authenticated for all accesses other than accesses explicitly identified and documented by the organization when related to the use of anonymous access. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multifactor authentication, some combination thereof. This control applies to application layer gateways that provide content filtering and proxy services on network segments (e.g., DMZ) that allow access by non-organizational users. It focuses on authentication requests to the proxied application for access to destination resources and policy filtering decisions rather than administrator and management functions.

Fix Text

Configure Kona Site Defender to not modify origin-defined HTTP session headers: 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Configure" tab and select "Site" under the "Property" section. 3. If prompted for which product to use, select "Site Defender" and then "Continue". 4. Click on the applicable configuration. 5. Click on the applicable version of the configuration. 6. Search the "Property Configuration Settings" and remove any of the following behaviors that are modifying origin-defined HTTP session headers: "Modify Incoming Request Header" "Modify Incoming Response Header" "Modify Outgoing Request Header" "Modify Outgoing Response Header" OR Contact the Akamai Professional Services team to implement the changes at 1-877-4-AKATEC (1-877-425-2832).

Check Content

Confirm Kona Site Defender is not stripping origin-defined HTTP session headers: 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Configure" tab and select "Site" under the "Property" section. 3. If prompted for which product to use, select "Site Defender" and then "Continue". 4. Click on the applicable configuration. 5. Click on the applicable version of the configuration. 6. Click the "View XML" button. 7. Search the XML text for the following fields and confirm that no origin session headers are being added or removed: "edgeservices:modify-incoming-request.remove-header" "edgeservices:modify-incoming-request.add-header" "edgeservices:modify-incoming-response.remove-header" "edgeservices:modify-incoming-response.add-header" "edgeservices:modify-outgoing-request.remove-header" "edgeservices:modify-outgoing-request.add-header" "edgeservices:modify-outgoing-response.remove-header" "edgeservices:modify-outgoing-response.add-header" If Kona Site Defender is stripping origin-defined HTTP session headers, this is a finding.

Kona Site Defender providing content filtering must protect against known and unknown types of denial-of-service (DoS) attacks by employing rate-based attack prevention behavior analysis.

Finding ID
AKSD-WF-000019
Rule ID
SV-91117r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000362-ALG-000112
CCI
CCI-002385
Target Key
(None)
Documentable
No
Discussion

If the network does not provide safeguards against DoS attacks, network resources may not be available to users during an attack. Installation of content filtering gateways and application layer firewalls at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume/type. Detection components that use rate-based behavior analysis can detect attacks when signatures for the attack do not exist or are not installed. These attacks include zero-day attacks, which are new attacks for which vendors have not yet developed signatures. Rate-based behavior analysis can detect sophisticated, Distributed DoS (DDoS) attacks by correlating traffic information from multiple network segments or components. This requirement applies to the communications traffic functionality of the ALG as it pertains to handling communications traffic, rather than to the ALG device itself.

Fix Text

Configure the Kona Site Defender to enable rate controls. The Akamai Professional Services team should be consulted to implement this Fix content due to the complexities involved. In most cases, this should be included in the SLA. 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Click on the "Shared Resources" link. 8. Click on the "Rate Policies" link in the left hand column. 9. Click the plus shaped "+" icon to add a new Rate Policy. 10. Follow the prompts to complete the process and click the "Save" button to complete the process. OR Contact the Akamai Professional Services team to implement the changes at 1-877-4-AKATEC (1-877-425-2832).

Check Content

Confirm Kona Site Defender has rate controls enabled: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Within the "Policy Details" section, verify the "Rate Controls" check box is selected. 9. Within the "Rate Controls" section, verify the action is set to "Deny" for each Adaptive Rule ID. If "Rate Controls" is not selected, this is a finding.

Kona Site Defender providing content filtering must protect against known types of denial-of-service (DoS) attacks by employing signatures.

Finding ID
AKSD-WF-000020
Rule ID
SV-91119r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000362-ALG-000126
CCI
CCI-002385
Target Key
(None)
Documentable
No
Discussion

If the network does not provide safeguards against DoS attacks, network resources may not be available to users during an attack. Installation of content filtering gateways and application layer firewalls at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume, type, or protocol usage. Detection components that use signatures can detect known attacks by using known attack signatures. Signatures are usually obtained from and updated by the ALG component vendor. This requirement applies to the communications traffic functionality of the ALG as it pertains to handling communications traffic, rather than to the ALG device itself.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules. The Akamai Professional Services team should be consulted to implement this Fix content due to the complexities involved. In most cases, this should be included in the SLA. 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed and click the "Edit" button. 8. Enable the "Application Layer Controls" box and the "Slow POST Protection" box. 9. Click the "Next" button and set each of the following "KRS Rule Set" rules to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Score (Inbound) - Total Response Score (Outbound) - DDOS 10. Click the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Application Layer Controls" checkbox is enabled. 9. Verify the following "KRS Rule Set" rules are set to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Scor4e (Inbound) - Total Response Score (Outbound) - DDOS 10. Verify the "Enabled Slow POST Protection" section appears. If the application layer controls are not set to "Deny" mode or slow POST protection does not appear, this is a finding.

Kona Site Defender that provides intermediary services for HTTP must inspect inbound and outbound HTTP traffic for protocol compliance and protocol anomalies.

Finding ID
AKSD-WF-000021
Rule ID
SV-91121r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000512-ALG-000066
CCI
CCI-001125
Target Key
(None)
Documentable
No
Discussion

Application protocol anomaly detection examines application layer protocols such as HTTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols. Since protocol anomaly analysis examines the application payload for patterns or anomalies, an HTTP proxy must be included in the ALG. This ALG will be configured to inspect inbound and outbound HTTP communications traffic to detect protocol anomalies such as malformed message and command insertion attacks. All inbound and outbound traffic, including HTTPS, must be inspected. However, the intention of this policy is not to mandate HTTPS inspection by the ALG. Typically, HTTPS traffic is inspected at the source or destination and/or is directed for inspection by an organizationally defined network termination point.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules. The Akamai Professional Services team should be consulted to implement this Fix content due to the complexities involved. In most cases, this should be included in the SLA. 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed and click the "Edit" button. 8. Enable the "Application Layer Controls" box and the "Slow POST Protection" box. 9. Click the "Next" button and set each of the following "KRS Rule Set" rules to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Score (Inbound) - Total Response Score (Outbound) - DDOS 10. Click the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Application Layer Controls" checkbox is enabled. 9. Verify the following "KRS Rule Set" rules are set to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Scor4e (Inbound) - Total Response Score (Outbound) - DDOS 10. Verify the "Enabled Slow POST Protection" section appears. If the application layer controls are not set to "Deny" mode or slow POST protection does not appear, this is a finding.

Kona Site Defender providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes.

Finding ID
AKSD-WF-000022
Rule ID
SV-91123r1_rule
Severity
Cat I
CCE
(None)
Group Title
SRG-NET-000510-ALG-000025
CCI
CCI-002450
Target Key
(None)
Documentable
No
Discussion

Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. This requirement applies only to ALGs that provide encryption intermediary services (e.g., HTTPS, TLS, or DNSSEC).

Fix Text

Configure Kona Site Defender to only allow NIST FIPS-validated cryptography to generate cryptographic hashes: Contact the Akamai Professional Services team to implement the changes at 1-877-4-AKATEC (1-877-425-2832).

Check Content

Confirm Kona Site Defender only allows NIST SP 800-52 TLS settings: 1. Navigate to the Qualys SSL Scanner: https://www.ssllabs.com/ssltest/analyze.html 2. Enter into the scanner the Hostname being tested. 3. Under the "Configurations" and then "Cipher Suites" section, verify that communications are restricted to NIST FIPS-validated cryptography to generate cryptographic hashes as defined at https://www.nist.gov/publications/guidelines-selection-configuration-and-use-transport-layer-security-tls-implementations?pub_id=915295. If the cipher suites include non-NIST FIPS-validated cryptography, this is a finding.

Kona Site Defender providing encryption intermediary services must implement NIST FIPS-validated cryptography for digital signatures.

Finding ID
AKSD-WF-000023
Rule ID
SV-91125r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000510-ALG-000040
CCI
CCI-002450
Target Key
(None)
Documentable
No
Discussion

Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. This requirement applies only to ALGs that provide encryption intermediary services (e.g., HTTPS, TLS, or DNSSEC).

Fix Text

Configure Kona Site Defender to only allow NIST FIPS-validated cryptography for digital signatures: Contact the Akamai Professional Services team to implement the changes at 1-877-4-AKATEC (1-877-425-2832).

Check Content

Confirm Kona Site Defender only allows NIST SP 800-52 TLS settings: 1. Navigate to the Qualys SSL Scanner: https://www.ssllabs.com/ssltest/analyze.html 2. Enter into the scanner the Hostname being tested. 3. Under the "Certificate" section, verify that the "Signature algorithm" is restricted to NIST FIPS-validated cryptography for digital signatures as defined at https://www.nist.gov/publications/guidelines-selection-configuration-and-use-transport-layer-security-tls-implementations?pub_id=915295. If the signature algorithm include non-NIST FIPS-validated cryptography, this is a finding.

Kona Site Defender providing encryption intermediary services must use NIST FIPS-validated cryptography to implement encryption services.

Finding ID
AKSD-WF-000024
Rule ID
SV-91127r1_rule
Severity
Cat I
CCE
(None)
Group Title
SRG-NET-000510-ALG-000111
CCI
CCI-002450
Target Key
(None)
Documentable
No
Discussion

Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. This requirement applies only to ALGs that provide encryption intermediary services (e.g., HTTPS, TLS, or DNSSEC).

Fix Text

Configure Kona Site Defender to only allow NIST FIPS-validated cryptography to implement encryption services: Contact the Akamai Professional Services team to implement the changes at 1-877-4-AKATEC (1-877-425-2832).

Check Content

Confirm Kona Site Defender only allows NIST SP 800-52 TLS settings: 1. Navigate to the Qualys SSL Scanner: https://www.ssllabs.com/ssltest/analyze.html 2. Enter into the scanner the Hostname being tested. 3. Under the "Configurations" and then "Cipher Suites" section, verify that communications are restricted to NIST FIPS-validated cryptography to implement encryption services as defined at https://www.nist.gov/publications/guidelines-selection-configuration-and-use-transport-layer-security-tls-implementations?pub_id=915295. If the cipher suites include non-NIST FIPS-validated cryptography, this is a finding.

Kona Site Defender providing user authentication intermediary services using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of protected sessions.

Finding ID
AKSD-WF-000025
Rule ID
SV-91129r1_rule
Severity
Cat I
CCE
(None)
Group Title
SRG-NET-000355-ALG-000117
CCI
CCI-002470
Target Key
(None)
Documentable
No
Discussion

Non-DoD approved PKIs have not been evaluated to ensure that they have security controls and identity vetting procedures in place that are sufficient for DoD systems to rely on the identity asserted in the certificate. PKIs lacking sufficient security controls and identity vetting procedures risk being compromised and issuing certificates that enable adversaries to impersonate legitimate users. The authoritative list of DoD-approved PKIs is published at http://iase.disa.mil/pki-pke/interoperability. DoD-approved PKI CAs may include Category I, II, and III certificates. Category I DoD-approved external PKIs are PIV issuers. Category II DoD-approved external PKIs are Non-Federal Agency PKIs cross-certified with the Federal Bridge Certification Authority (FBCA). Category III DoD-approved external PKIs are Foreign, Allied, or Coalition Partner PKIs. Deploying the ALG with TLS enabled will require the installation of DoD and/or DoD-approved CA certificates in the trusted root certificate store of each proxy to be used for TLS traffic. This requirement focuses on communications protection for the application session rather than for the network packet.

Fix Text

Configure Kona Site Defender to accept only end entity certificates issued by DoD PKI or DoD-approved PKI CAs for the establishment of protected sessions: Contact the Akamai Professional Services team to implement the changes at 1-877-4-AKATEC (1-877-425-2832).

Check Content

If Kona Site Defender is providing user authentication intermediary services, confirm that it accepts only end entity certificates issued by DoD PKI or DoD-approved PKI CAs for the establishment of protected sessions: Contact the Akamai Professional Services team to confirm accepted certificate authorities at 1-877-4-AKATEC (1-877-425-2832). If the Akamai Professional Services team confirms that the list of accepted certificate authorities is not issued by DoD-approved PKI certification authorities, this is a finding.

Kona Site Defender providing content filtering must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.

Finding ID
AKSD-WF-000026
Rule ID
SV-91131r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000246-ALG-000132
CCI
CCI-001240
Target Key
(None)
Documentable
No
Discussion

Malicious code protection mechanisms include but are not limited to anti-virus and malware detection software. To minimize any potential negative impact to the organization caused by malicious code, malicious code must be identified and eradicated. Malicious code includes viruses, worms, trojan horses, and spyware.

Fix Text

Configure Kona Site Defender to use the latest rule set to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: Contact the Akamai Professional Services team to implement the changes at 1-877-4-AKATEC (1-877-425-2832).

Check Content

Confirm Kona Site Defender is configured to use the latest rule set to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. For the applicable security configuration, click on the tuning status details link under the "Tuning Status" column. If the tuning status does not state "You are using the latest Kona Rule Set version and your security configuration is optimal", this is a finding.

Kona Site Defender providing content filtering must block malicious code upon detection.

Finding ID
AKSD-WF-000028
Rule ID
SV-91133r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000249-ALG-000134
CCI
CCI-001243
Target Key
(None)
Documentable
No
Discussion

Taking an appropriate action based on local organizational incident handling procedures minimizes the impact of malicious code on the network. This requirement is limited to ALGs, web content filters, and packet inspection firewalls that perform malicious code detection as part of their functionality.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules. The Akamai Professional Services team should be consulted to implement this Fix content due to the complexities involved. In most cases, this should be included in the SLA. 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed and click the "Edit" button. 8. Enable the "Application Layer Controls" box and the "Slow POST Protection" box. 9. Click the "Next" button and set each of the following "KRS Rule Set" rules to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Score (Inbound) - Total Response Score (Outbound) - DDOS 10. Click the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Application Layer Controls" checkbox is enabled. 9. Verify the following "KRS Rule Set" rules are set to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Scor4e (Inbound) - Total Response Score (Outbound) - DDOS 10. Verify the "Enabled Slow POST Protection" section appears. If the application layer controls are not set to "Deny" mode or slow POST protection does not appear, this is a finding.

Kona Site Defender providing content filtering must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection.

Finding ID
AKSD-WF-000030
Rule ID
SV-91135r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000249-ALG-000146
CCI
CCI-001243
Target Key
(None)
Documentable
No
Discussion

Without an alert, security personnel may be unaware of an impending failure of the audit capability. This will impede the ability to perform forensic analysis and detect rate-based and other anomalies. The ALG generates an immediate (within seconds) alert that notifies designated personnel of the incident. Sending a message to an unattended log or console does not meet this requirement since that will not be seen immediately. These messages should include a severity level indicator or code as an indicator of the criticality of the incident.

Fix Text

Configure Kona Site Defender to alert the ISSO, ISSM, and SA when detection events occur: 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Monitor" tab. 3. Under the "Security" section select "Security Monitor". 4. Click the "Notification" button (an icon shaped like a triangle with an exclamation point on the inside) 5. Click the "Configure Notification" button shaped like a plus sign. 6. Click the "Add Notification" button shaped like a plus sign. 7. Click the "Show Advanced View" link. 8. Set the "Notification Name" to "WAF Activity Mitigated" 9. Enter a more detailed description in the “Description” text box. 10. Set the priority to "high". 11. In the "Notify When:" section, set "Mitigated" to greater than (>) 1. 12. Set the “Apply Filter:” dropdowns to “Host Name” and “Contains”, and enter the applicable host name in the text box. 13. Set "During:" to "1 Minute". 14. Set "Notify After:" to "1" occurrences. 15. Select the "Host Name" check box in the "For:" area. 16. Add the ISSO and ISSM emails to the "Email to:" field. 17. Click the “Save” button.

Check Content

Confirm Kona Site Defender is configured to alert the ISSO, ISSM, and SA when detection events occur: 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Monitor" tab. 3. Under the "Security" section select "Security Monitor". 4. Click the "Notification" button (an icon shaped like a triangle with an exclamation point on the inside) 5. Click the "Configure Notification" button shaped like a plus sign. 6. Confirm that notifications are being sent when "Mitigated" is greater than (>) "1". If the alerts are not being sent, this is a finding.

Kona Site Defender providing content filtering must be configured to integrate with a system-wide intrusion detection system.

Finding ID
AKSD-WF-000032
Rule ID
SV-91137r1_rule
Severity
Cat III
CCE
(None)
Group Title
SRG-NET-000383-ALG-000135
CCI
CCI-002656
Target Key
(None)
Documentable
No
Discussion

Without coordinated reporting between separate devices, it is not possible to identify the true scale and possible target of an attack. Integration of the ALG with a system-wide intrusion detection system supports continuous monitoring and incident response programs. This requirement applies to monitoring at internal boundaries using TLS gateways, web content filters, email gateways, and other types of ALGs. ALGs can work as part of the network monitoring capabilities to off-load inspection functions from the external boundary IDPS by performing more granular content inspection of protocols at the upper layers of the OSI reference model.

Fix Text

Configure Kona Site Defender to deliver security event traffic to the SIEM: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted, select the product with which you would like to work and click "Continue". 5. Open the security configuration for which you want SIEM data. 6. Scroll down to the SIEM Integration section. 7. In the "Allow data collection for SIEM" field, click "Yes". 8. Choose the firewall policies for which you want to export data. Enable SIEM integration for: - ALL Firewall policies if you want to send SIEM data for events that violate any/all firewall policies within the security configuration. - The following firewall policies if you want data regarding one or more specific firewall policies. In the drop down list, choose the policies you want. 9. Skip the SIEM Event Version field for now. 10. Copy the number in the Security Config ID field. You’ll need it in a minute. 11. Push security configuration changes to the production network. - On the upper right of the Security Configuration page, click the Activate button. Under Network, choose Production and click Activate

Check Content

If the SIEM delivery option has been purchased, confirm that the Kona Site Defender SIEM integration is enabled: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted, select "Site Defender" and then "Continue". 5. Open the security configuration for which SIEM data is required. 6. Scroll down to the SIEM Integration section and verify that "Allow data collection for SIEM" is enabled. If "Allow data collection for SIEM field" is not enabled, this is a finding.

Kona Site Defender providing content filtering must continuously monitor inbound communications traffic crossing internal security boundaries for unusual or unauthorized activities or conditions.

Finding ID
AKSD-WF-000033
Rule ID
SV-91139r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000390-ALG-000139
CCI
CCI-002661
Target Key
(None)
Documentable
No
Discussion

If inbound communications traffic is not continuously monitored, hostile activity may not be detected and prevented. Output from application and traffic monitoring serves as input to continuous monitoring and incident response programs. Internal monitoring includes the observation of events occurring on the network that cross internal boundaries at managed interfaces such as web content filters. Depending on the type of ALG, organizations can monitor information systems by monitoring audit activities, application access patterns, characteristics of access, content filtering, or unauthorized exporting of information across boundaries. Unusual/unauthorized activities or conditions may include large file transfers, long-time persistent connections, unusual protocols and ports in use, and attempted communications with suspected malicious external addresses.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules. The Akamai Professional Services team should be consulted to implement this Fix content due to the complexities involved. In most cases, this should be included in the SLA. 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed and click the "Edit" button. 8. Enable the "Application Layer Controls" box and the "Slow POST Protection" box. 9. Click the "Next" button and set each of the following "KRS Rule Set" rules to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Score (Inbound) - Total Response Score (Outbound) - DDOS 10. Click the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Application Layer Controls" checkbox is enabled. 9. Verify the following "KRS Rule Set" rules are set to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Scor4e (Inbound) - Total Response Score (Outbound) - DDOS 10. Verify the "Enabled Slow POST Protection" section appears. If the application layer controls are not set to "Deny" mode or slow POST protection does not appear, this is a finding.

Kona Site Defender providing content filtering must send an alert to, at a minimum, the ISSO and ISSM when detection events occur.

Finding ID
AKSD-WF-000034
Rule ID
SV-91141r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000392-ALG-000141
CCI
CCI-002664
Target Key
(None)
Documentable
No
Discussion

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. Since these incidents require immediate action, these messages are assigned a critical or Level 1 priority/severity, depending on the system's priority schema. In accordance with CCI-001242, the ALG that provides content inspection services is a real-time intrusion detection system. These systems must generate an alert when detection events from real-time monitoring occur. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The ALG must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

Fix Text

Configure Kona Site Defender to alert the ISSO, ISSM, and SA when detection events occur: 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Monitor" tab. 3. Under the "Security" section select "Security Monitor". 4. Click the "Notification" button (an icon shaped like a triangle with an exclamation point on the inside) 5. Click the "Configure Notification" button shaped like a plus sign. 6. Click the "Add Notification" button shaped like a plus sign. 7. Click the "Show Advanced View" link. 8. Set the "Notification Name" to "WAF Activity Mitigated" 9. Enter a more detailed description in the “Description” text box. 10. Set the priority to "high". 11. In the "Notify When:" section, set "Mitigated" to greater than (>) 1. 12. Set the “Apply Filter:” dropdowns to “Host Name” and “Contains”, and enter the applicable host name in the text box. 13. Set "During:" to "1 Minute". 14. Set "Notify After:" to "1" occurrences. 15. Select the "Host Name" check box in the "For:" area. 16. Add the ISSO and ISSM emails to the "Email to:" field. 17. Click the “Save” button.

Check Content

Confirm Kona Site Defender is configured to alert the ISSO, ISSM, and SA when detection events occur: 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Monitor" tab. 3. Under the "Security" section select "Security Monitor". 4. Click the "Notification" button (an icon shaped like a triangle with an exclamation point on the inside) 5. Click the "Configure Notification" button shaped like a plus sign. 6. Confirm that notifications are being sent when "Mitigated" is greater than (>) "1". If the alerts are not being sent, this is a finding.

Kona Site Defender providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources (e.g., IAVMs or CTOs) are detected.

Finding ID
AKSD-WF-000035
Rule ID
SV-91143r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000392-ALG-000142
CCI
CCI-002664
Target Key
(None)
Documentable
No
Discussion

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The ALG generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or Level 1 priority/severity, depending on the system's priority schema. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The ALG must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

Fix Text

Configure Kona Site Defender to alert the ISSO, ISSM, and SA when detection events occur: 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Monitor" tab. 3. Under the "Security" section select "Security Monitor". 4. Click the "Notification" button (an icon shaped like a triangle with an exclamation point on the inside) 5. Click the "Configure Notification" button shaped like a plus sign. 6. Click the "Add Notification" button shaped like a plus sign. 7. Click the "Show Advanced View" link. 8. Set the "Notification Name" to "WAF Activity Mitigated" 9. Enter a more detailed description in the “Description” text box. 10. Set the priority to "high". 11. In the "Notify When:" section, set "Mitigated" to greater than (>) "1". 12. Set the “Apply Filter:” dropdowns to “Host Name” and “Contains”, and enter the applicable host name in the text box. 13. Set "During:" to "1 Minute". 14. Set "Notify After:" to "1" occurrences. 15. Select the "Host Name" check box in the "For:" area. 16. Add the ISSO and ISSM emails to the "Email to:" field. 17. Click the “Save” button.

Check Content

Confirm Kona Site Defender is configured to alert the ISSO, ISSM, and SA when detection events occur: 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Monitor" tab. 3. Under the "Security" section select "Security Monitor". 4. Click the "Notification" button (an icon shaped like a triangle with an exclamation point on the inside) 5. Click the "Configure Notification" button shaped like a plus sign. 6. Confirm that notifications are being sent when "Mitigated" is greater than (>) "1". If the alerts are not being sent, this is a finding.

Kona Site Defender providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected.

Finding ID
AKSD-WF-000036
Rule ID
SV-91145r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000392-ALG-000148
CCI
CCI-002664
Target Key
(None)
Documentable
No
Discussion

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The ALG generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or Level 1 priority/severity, depending on the system's priority schema. CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The ALG must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

Fix Text

Configure Kona Site Defender to alert the ISSO, ISSM, and SA when detection events occur: 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Monitor" tab. 3. Under the "Security" section select "Security Monitor". 4. Click the "Notification" button (an icon shaped like a triangle with an exclamation point on the inside) 5. Click the "Configure Notification" button shaped like a plus sign. 6. Click the "Add Notification" button shaped like a plus sign. 7. Click the "Show Advanced View" link. 8. Set the "Notification Name" to "WAF Activity Mitigated" 9. Enter a more detailed description in the “Description” text box. 10. Set the priority to "high". 11. In the "Notify When:" section, set "Mitigated" to greater than (>) "1". 12. Set the “Apply Filter:” dropdowns to “Host Name” and “Contains”, and enter the applicable host name in the text box. 13. Set "During:" to "1 Minute". 14. Set "Notify After:" to "1" occurrences. 15. Select the "Host Name" check box in the "For:" area. 16. Add the ISSO and ISSM emails to the "Email to:" field. 17. Click the “Save” button.

Check Content

Confirm Kona Site Defender is configured to alert the ISSO, ISSM, and SA when detection events occur: 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Monitor" tab. 3. Under the "Security" section select "Security Monitor". 4. Click the "Notification" button (an icon shaped like a triangle with an exclamation point on the inside) 5. Click the "Configure Notification" button shaped like a plus sign. 6. Confirm that notifications are being sent when "Mitigated" is greater than (>) "1". If the alerts are not being sent, this is a finding.

Kona Site Defender must check the validity of all data inputs except those specifically identified by the organization.

Finding ID
AKSD-WF-000037
Rule ID
SV-91147r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000401-ALG-000127
CCI
CCI-001310
Target Key
(None)
Documentable
No
Discussion

Invalid user input occurs when a user inserts data or characters into an application's data entry fields and the application is unprepared to process that data. This results in unanticipated application behavior, potentially leading to an application or information system compromise. Invalid input is one of the primary methods employed when attempting to compromise an application. Network devices with the functionality to perform application layer inspection may be leveraged to validate data content of network communications. Checking the valid syntax and semantics of information system inputs (e.g., character set, length, numerical range, and acceptable values) verifies that inputs match specified definitions for format and content. Software typically follows well-defined protocols that use structured messages (i.e., commands or queries) to communicate between software modules or system components. Structured messages can contain raw or unstructured data interspersed with metadata or control information. If network elements use attacker-supplied inputs to construct structured messages without properly encoding such messages, the attacker could insert malicious commands or special characters that can cause the data to be interpreted as control information or metadata. Consequently, the module or component that receives the tainted output will perform the wrong operations or otherwise interpret the data incorrectly. Pre-screening inputs prior to passing to interpreters prevents the content from being unintentionally interpreted as commands. Input validation helps to ensure accurate and correct inputs and prevent attacks such as cross-site scripting and a variety of injection attacks. This requirement applies to gateways and firewalls that perform content inspection or have higher-layer proxy functionality.

Fix Text

Configure the Kona Site Defender to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules. The Akamai Professional Services team should be consulted to implement this Fix content due to the complexities involved. In most cases, this should be included in the SLA. 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed and click the "Edit" button. 8. Enable the "Application Layer Controls" box and the "Slow POST Protection" box. 9. Click the "Next" button and set each of the following "KRS Rule Set" rules to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Score (Inbound) - Total Response Score (Outbound) - DDOS 10. Click the "Next" button and follow the prompts to complete the process.

Check Content

Confirm Kona Site Defender is configured to block traffic for organizationally defined HTTP protocol violations, HTTP policy violations, SQL injection, remote file inclusion, cross-site scripting, command injection attacks, and any applicable custom rules: 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Click the "Configure" tab. 3. Under the "Security" section, select "Security Configuration". 4. If prompted for which product to use, select "Site Defender" and then "Continue". 5. Under the "Security Configurations" section, click on the most recent version under the "Production" column for the security configuration being reviewed. 6. The detailed "Security Configuration" page will load listing the protected host names and applicable policies. 7. Select the policy being reviewed. 8. Verify the "Application Layer Controls" checkbox is enabled. 9. Verify the following "KRS Rule Set" rules are set to "Deny". - SQL Injection - Cross Site Scripting (XSS) - Command Injection - Invalid HTTP - Remote File Inclusion - PHP Injection (when PHP is used) - Trojan - Total Request Scor4e (Inbound) - Total Response Score (Outbound) - DDOS 10. Verify the "Enabled Slow POST Protection" section appears. If the application layer controls are not set to "Deny" mode or slow POST protection does not appear, this is a finding.

Kona Site Defender must reveal error messages only to the ISSO, ISSM, and SCA.

Finding ID
AKSD-WF-000039
Rule ID
SV-91149r1_rule
Severity
Cat I
CCE
(None)
Group Title
SRG-NET-000402-ALG-000130
CCI
CCI-001314
Target Key
(None)
Documentable
No
Discussion

Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can give configuration details about the network element. Limiting access to system logs and administrative consoles to authorized personnel will help to mitigate this risk. However, user feedback and error messages should also be restricted by type and content in accordance with security best practices (e.g., ICMP messages).

Fix Text

Ensure that only authorized personnel have access to the Kona Site Defender portal (Luna): 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Select "Configure" and then "Manage Users & Groups". 3. Select the "Users" tab. 4. Add the correct personnel by clicking the "Create a New User" button or remove existing users by clicking the gear icon next to their entry and selecting "Delete this user".

Check Content

Verify that only authorized personnel have access to the Kona Site Defender portal (Luna): 1. Log in to the Akamai Luna Portal (https://control.akamai.com). 2. Select "Configure" and then "Manage Users & Groups". 3. Select the "Roles" tab. 4. Review the personnel list and their current roles. If non-privileged users can perform privileged functions, this is a finding.

Kona Site Defender must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Finding ID
AKSD-WF-000055
Rule ID
SV-91151r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000364-ALG-000122
CCI
CCI-002403
Target Key
(None)
Documentable
No
Discussion

Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources. Access control policies and access control lists implemented on devices that control the flow of network traffic (e.g., application level firewalls and Web content filters), ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet or CDS) must be kept separate.

Fix Text

Configure Kona Site Defender to connect to the correct origin server: 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Select Group or Property" button. 3. Select the configuration that is being reviewed. 4. Under the "Active Production" section, click on the active version. 5. Click the "Edit" button (if not already selected). 6. In the "Origin Server" section, change the "Origin Server Hostname" to the correct hostname. 7. Click the "Save" button. 8. Activate the configuration by clicking the "Activate" tab and the activate buttons for the proper network (either staging or production).

Check Content

Confirm Kona Site Defender is configured to connect to the correct origin server: 1. Log in to the Akamai Luna Portal (Caution-https://control.akamai.com). 2. Click the "Select Group or Property" button. 3. Select the configuration that is being reviewed. 4. Under the "Active Production" section, click on the active version. 5. In the "Origin Server" section, verify the "Origin Server Hostname" is valid. If the "Origin Server Hostname" is not valid, then this is a finding.