Firewall Security Requirements Guide
| Version 1 Release |
| U_Firewall_SRG_V1R |
| This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil. |
- All
- Updated 4
- Added 11
- Removed 3
Vulnerabilities (44)
V-79411
The firewall must fail closed if the firewall filtering function is nonfunctional.
Discussion
While failure to an open state may ensure users are not inconvenienced, it also circumvents a critical security network function that guards against direct and indirect network attacks. Allow traffic to flow without filtering or inspection puts the entire network and DoD critical assets at immediate risk. An example is a network element that blocks all traffic rather than allowing all traffic when a network element component fails (e.g., fail closed and do not forward traffic). This prevents an attacker from forcing a failure of the system in order to obtain access.
Fix Text
Configure the firewall to fail closed. The firewall must block all traffic rather than allowing all traffic when a network element component fails (e.g., fail closed and do not forward traffic). The recommended architecture is to implement load balancing so that the failure of the firewall redirects traffic to another filtering device. Obtain a risk acceptance in order to fail open.
Check Content
Review the firewall configuration to verify traffic flow defaults to closed when the firewall filtering function aborts or is nonfunctional. If the firewall is configured to allow traffic flow to attached interfaces when the firewall filtering function is non-functional, this is a finding.
V-79417
The firewall must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services on the network segment in accordance as defined in the Ports, Protocols, and Services Management (PPSM) CAL and vulnerability assessments.
Discussion
Some ports, protocols, or services have well-known exploits or security weaknesses that can be leveraged in an attack against the enclave and put it at immediate risk. These ports, protocols, and services must be prohibited or restricted in the packet or stateful filtering firewall configuration in accordance with DoD policy. Policy filters restrict traffic destined to the enclave perimeter as defined in the PPSM CAL and vulnerability assessments.
Fix Text
SCAs must review the vulnerability assessment for each port, protocol, and service allowed into the enclave and apply all appropriate mitigations defined in the Vulnerability Assessment report. Register only ports, protocols, and functions allowed into the enclave in the PPSM database. The enclave owner must register the applications used in the PPSM database. Consult the packet/stateful firewall knowledge base and configuration guides to determine the commands for disabling each port, protocol, service, or function that is not in compliance.
Check Content
Verify the firewall is configured to disable or restrict the use of functions, ports, protocols, and/or services on the network segment that are not allowed by the PPSM CAL and vulnerability assessments. Verify all applications used in the enclave are registered in the PPSM database. Review the vulnerability assessment for each port, protocol, and service allowed into the enclave and apply all appropriate mitigations defined in the Vulnerability Assessment report for that port, protocol, and service. Compare enabled functions, ports, and services with the PPSM requirements. If prohibited functions, ports, protocols, and services are enabled, this is a finding.
V-79425
The firewall that filters traffic from the wireless access points must be configured with organization-defined filtering rules that apply to the monitoring of remote access traffic.
Discussion
Remote access devices (such as those providing remote access to network devices and information systems) that lack automated capabilities increase risk and make remote user access management difficult at best. Remote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Automated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).
Fix Text
Configure a group policy for wireless clients and apply to the interface that is connected to allow ingress and egress to the wireless access points.
Check Content
Review the firewall configuration statements used to create a group policy with filtering rules for wireless clients accessing the network using a wireless access point. Verify both ingress and egress traffic on this interface is subject to the remote access policy and filtering rules required by the organization. If the firewall is used to filter traffic from the wireless access points but is not configured with filtering rules that apply to the monitoring of wireless access traffic, this is a finding.
V-79449
The firewall must be configured to send a real-time alert to the ISSO and SA (at a minimum) in the event of an audit processing failure on the firewall itself.
Discussion
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process traffic logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Most firewalls use User Datagram Protocol (UDP) to send audit records to the server and cannot tell if the server has received the transmission. Thus, when the event daemon stops working, messages and notifications cannot be sent to the event monitor (e.g., Network Management System [NMS], Security Information and Event Management [SIEM], Syslog) or to the Simple Network Management Protocol (SNMP) server. Another method such as a keep-alive with the central audit server may be required. This requirement applies to each audit data storage repository (i.e., distinct information system component where traffic log records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both. Note that CCI-001858 requires that audit failure alerts be in real time; thus, simply sending a log event to the central audit server is not sufficient.
Fix Text
Configure the firewall (or another network device) to send an alert via instant message, email, or another authorized method to the ISSO, SA, and other identified personnel when an audit processing failure that prevents the device from generating, storing or sending events occurs on the device itself (e.g., a failure of the event daemon).
Check Content
If a network device such as the events, network management, or SNMP server are configured to send an alert when an audit processing failure occurs, this is not a finding. Verify the firewall is configured to send an alert via instant message, email, SNMP or another authorized method to the ISSO, SA, and other identified personnel when an audit processing failure occurs. If the firewall is not configured to send an alert via an approved and immediate method when an audit processing failure occurs, this is a finding.
V-79455
The firewall must protect traffic log records from unauthorized read access while stored locally.
Discussion
Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or identify an improperly configured firewall. Thus, it is imperative that the collected log data be secured and can only be accessed by authorized personnel. This does not apply to traffic logs generated on behalf of the device itself (management). Some devices store traffic logs separately from the system logs.
Fix Text
Validate the firewall includes a baseline cryptographic module that provides confidentiality and integrity services for authentication and for protecting communications with adjacent systems. Configure role-based, fine-grained permissions management for controlling access.
Check Content
Verify the firewall's fine-grained permissions are configured to control access to the log store where the traffic log is located. If the firewall does not protect traffic log records from unauthorized read access while stored locally, this is a finding.
V-79467
The perimeter firewall must be configured for service redundancy, load balancing, or other organization-defined safeguards to limit the effects of types of denial-of-service (DoS) attacks on the network.
Discussion
As a critical security system, perimeter firewalls must be safeguarded with redundancy measures. If the network does not provide safeguards against DoS attacks, network resources will be unavailable to users. Service redundancy techniques reduce the susceptibility of the firewall to many DoS attacks. A firewall experiencing a DoS attack will not be able to handle the traffic load. The high CPU utilization caused by a DoS attack will also have impact control keep-alives and timers used for neighbor peering, resulting in route flapping and eventually black hole traffic. Though redundant hardware is the primary means of compliance, there are a number of ways to meet this requirement. The firewall can also be configured for filter-based forwarding, per-flow load balancing, and/or per-packet load balancing.
Fix Text
Consult vendor configuration guides and knowledge base. Implement one or more methods of service redundancy and/or load balancing (e.g., filter-based forwarding, per-flow load balancing, per-packet load balancing, or hardware redundancy options). The implementation must be tested prior to placing into production.
Check Content
Since Service redundancy and load balancing can be a highly complex configuration that can be implemented using a wide variety of configurations, ask the site representative to demonstrate the method used and the configuration. If the perimeter firewall is not configured for service redundancy, load balancing, or other organization-defined safeguards to limit the effects of types of DoS attacks on the network, this is a finding.
V-79473
The firewall must establish ingress filters that block inbound packets where the destination is an IP address assigned to the management or loopback addresses of the enclave protection devices unless the packet has a source address assigned to the management network or network infrastructure.
Discussion
The firewall must reject requests for access or services where the source address received by the firewall specifies a loopback address. The loopback address is used by an Inter-Processor Control (IPC) mechanism that enables the client and server portion of an application running on the same machine to communicate, and so it is trusted. It should never be used as the source IP address of an inbound or outbound transmission. It is a best practice for the management network to use the loopback addresses.
Fix Text
Establish ingress filters to block any attempt from the firewall or any network to pass any packets claiming to be from a loopback address.
Check Content
Review the device configuration to determine if filters are in place to block loopback addresses. Verify packets with a destination IP address assigned to the management or loopback address range are blocked (unless the packet has a source address assigned to the management network or network infrastructure). If loopback addresses are not being blocked by an ingress firewall filter, this is a finding.
V-79475
The firewall must block or restrict inbound IP packets destined to the control plane of the firewall itself.
Discussion
As a critical security system, perimeter firewalls must be safeguarded against direct attacks to the device. The firewall must have a filter that rejects requests for access or services where the source address received by the firewall specifies an external address and the destination address specifies the control plane of the firewall.
Fix Text
Establish ingress filters to block or restrict inbound IP packets destined to the control plane of the firewall itself.
Check Content
Review the device configuration to determine if filters are in place to block loopback addresses. Verify packets with a destination IP address assigned to the management or loopback address range are blocked (unless the packet has a source address assigned to the management network or network infrastructure). If inbound IP packets destined to the control plane of the firewall itself are not blocked or restricted by an ingress firewall filter, this is a finding.
V-79481
The firewall must block outbound IP packets that contain illegitimate packet attributes including, at a minimum, invalid source address or packets that fail minimum length tests (TCP length, UDP length, IP data length) that have undefined protocol numbers, improper use of hop-by-hop header, or IPv6 RH0 header.
Discussion
If outbound communications traffic is not filtered, hostile activity intended to harm other networks may not be detected and prevented.
Fix Text
Configure the firewall to block outbound IP packets that that contain illegitimate packet attributes.
Check Content
Review the configuration and verify the firewall blocks outbound IP packets that contain an illegitimate attributes. At a minimum, rules must exist to filter based on invalid source address or packets that fail minimum length tests (TCP length, UDP length, IP data length) that have undefined protocol numbers, improper use of hop-by-hop header, or IPv6 RH0 header. If the firewall does not block outbound IP packets that that contain illegitimate packet attributes, this is a finding.
V-79483
The firewall must be configured to fail securely in the event of an operational failure of the firewall filtering or boundary protection function.
Discussion
If a boundary protection device fails in an unsecure manner (open), information external to the boundary protection device may enter, or the device may permit unauthorized information release. Secure failure ensures that when a boundary control device fails, all traffic will be subsequently denied. Fail secure is a condition achieved by employing information system mechanisms to ensure that in the event of operational failures of boundary protection devices at managed interfaces (e.g., routers, firewalls, guards, and application gateways residing on protected subnetworks commonly referred to as demilitarized zones), information systems do not enter into unsecure states where intended security properties no longer hold.
Fix Text
Configure the firewall to fail securely in the event of an operational failure of the firewall filtering or boundary protection function. This is not the same as a hardware failure, which is covered by the NDM STIG. This involves such items as ensuring the filters and security policy are not corrupted and cannot be accessed. Most importantly, it should not be possible to fail to a state where firewall filtering functions no longer hold.
Check Content
Review the configuration and verify the firewall fails securely in the event of an operational failure. This involves such items as ensuring the Access Control Lists (filters) and security policy are not corrupted and cannot be accessed. Most importantly, it should not be possible to fail to a state where firewall filtering functions no longer hold. If the firewall does not fail securely in the event of an operational failure, this is a finding.
V-79487
The firewall must be configured to allow the system administrator to select a subset of DoD-required auditable events.
Discussion
The generation of logs with a subset of criteria aide the system administrator, maintainers, and auditors when troubleshooting issues or reviewing the log for trends or security breaches. Traffic log records can be generated from various components within the information system (e.g., network interface, access control list, or filter). The DoD list of auditable events include the logging and audit requirements required by this document and any additional local requirements.
Fix Text
Configure the firewall audit management functions to allow the authorized system administrator to select from a list of auditable events, to include the firewall's network interfaces, rules, and policies.
Check Content
Obtain a list of required auditable events from the site representative or the System Security Plan (SSP). View the firewall configuration. Verify the firewall allows the system administrator to select a subset of DoD-required auditable events. If the firewall is not configured to allow the system administrator to select a subset of DoD-required events, this is a finding.
V-101103
The firewall must be configured to inspect all inbound and outbound traffic at the application layer.
Discussion
Application inspection enables the firewall to control traffic based on different parameters that exist within the packets such as enforcing application-specific message and field length. Inspection provides improved protection against application-based attacks by restricting the types of commands allowed for the applications. Application inspection all enforces conformance against published RFCs. Some applications embed an IP address in the packet that needs to match the source address that is normally translated when it goes through the firewall. Enabling application inspection for a service that embeds IP addresses, the firewall translates embedded addresses and updates any checksum or other fields that are affected by the translation. Enabling application inspection for a service that uses dynamically assigned ports, the firewall monitors sessions to identify the dynamic port assignments, and permits data exchange on these ports for the duration of the specific session.
Fix Text
Configure the firewall to inspect all inbound and outbound traffic at the application layer.
Check Content
Review the firewall configuration to verify that inspection for applications deployed within the network is being performed on all interfaces. If the firewall is not configured to inspect all inbound and outbound traffic at the application layer, this is a finding.
V-101105
The firewall must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.
Discussion
IPv6 packets with unknown extension headers as well as out-of-order headers can create Denial-of-Service attacks for other networking components as well as host devices. IPv6 inspection can check conformance to RFC 2460 enforcing the order extension headers. While routers only need to examine the IPv6 destination address and the Hop-by-Hop Options header, firewalls must recognize and parse through all existing extension headers since the upper-layer protocol information resides in the last header. An attacker is able to chain many extension headers in order to pass firewall and intrusion detections. An attacker can cause a denial of service if an intermediary device or destination host is not capable of processing an extensive or out-of-order chain of extension headers. Hence, it is imperative the firewall is configured to drop packets with unknown or out-of-order headers.
Fix Text
Configure the firewall to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.
Check Content
Review the firewall configuration to verify that IPv6 inspection is being performed on all interfaces. If the firewall is not configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers, this is a finding.
V-101107
The firewall must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).
Discussion
A compromised host in an enclave can be used by a malicious platform to launch cyberattacks on third parties. This is a common practice in "botnets", which are a collection of compromised computers using malware to attack other computers or networks. Denial-of-Service attacks frequently leverage IP source address spoofing to send packets to multiple hosts that, in turn, will then send return traffic to the hosts with the IP addresses that were forged. This can generate significant amounts of traffic. Therefore, protection measures to counteract IP source address spoofing must be taken. When uRPF is enabled in strict mode, the packet must be received on the interface that the device would use to forward the return packet, thereby mitigating IP source address spoofing.
Fix Text
Configure the firewall with an egress filter or uRPF on all internal interfaces to restrict the firewall from accepting any outbound packet that contains an illegitimate address in the source field.
Check Content
Review the firewall configuration to verify uRPF or an egress filter has been configured on all internal interfaces to restrict the firewall from accepting outbound packets that contain an illegitimate address in the source address field. If uRPF or an egress ACL to restrict the firewall from accepting outbound IP packets that contain an illegitimate address in the source address field has not been configured on all internal interfaces, this is a finding.
The firewall must denybe networkconfigured communicationsto trafficuse byfilters defaultthat andprevent allowor networklimit communicationsthe trafficeffects byof exceptionall types of commonly known denial-of-service (i.e.,DoS) denyattacks, allincluding flooding, permitpacket bysweeps, exception)and unauthorized port scanning.
Discussion
To prevent malicious or accidental leakage of traffic, organizations must implement a deny-by-default security posture at the network perimeter. Such rulesets prevent many malicious exploits or accidental leakage by restricting the traffic to only known sources and only those ports, protocols, or services that are permitted and operationally necessary. As a managed boundary interface, the firewall must block all inbound and outbound network traffic unless a filter is installed to explicitly allow it. The allow filters must comply with the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and Vulnerability Assessment (VA).
Fix Text
Configure the firewall with a "Deny" inter-zone policy which, by default, blocks traffic between zones and allows network communications traffic by exception (i.e., deny all, permit by exception) in accordance with PPSM CAL and VAs for the enclave. Protocols, TCP/UDP ports, and endpoints (specific hosts or networks) must be identified and used to develop rulesets to restrict traffic to and from an enclave and across protected internal boundaries. Rules or access control statements containing "any" for either the host, destination, protocol, or port are prohibited.
Check Content
Determine the default security policies on the firewall for traffic from one zone to another zone (inter-zone).
TheThis defaultshould policy must be a "Deny" policy that blocks all inter-zone traffic by default. Ensure no policy that circumvents the default "Deny" inter-zone policy is allowed. Traffic through the firewall is filtered so that only the specific traffic that is approved and registered in the PPSM CAL and VAs for the enclave. Verify rules or access control statements containing "any" for either the host, destination, protocol, or port are not used.
If the firewall does not deny all network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception), this is a finding.
The firewall must beprotect configuredtraffic tolog userecords TCPfrom whenunauthorized sendingaccess logwhile recordsin transit to the central audit server.
Discussion
IfAuditing theand defaultlogging UDPare protocolkey iscomponents usedof forany communicationsecurity betweenarchitecture. Logging the hostsactions andof devicesspecific events provides a means to theinvestigate Centralan Logattack, Serverrecognize resource utilization or capacity thresholds, thenor logidentify recordsan thatimproperly doconfigured notfirewall. reachThus, it is imperative that the collected log serverdata arebe notsecured detectedand asaccess abe datarestricted lossto authorized personnel. TheMethods use of TCPprotection tomay transportinclude logencryption recordsor logical separation.
This does not apply to traffic logs generated on behalf of the logdevice serversitself improves(management). deliverySome reliabilitydevices store traffic logs separately from the system logs.
Fix Text
Configure the firewall to use TCPeither whenencryption sendingor logical separation to protect transmitted traffic log records while in transit to the central audit server. The preferred solution is for all communication with the central audit server to egress via the management network interface and be protected by the management network's VPN.
Check Content
ReviewVerify that all communication with the firewallcentral configurationaudit andserver verifyis going out the interface that it is configureconnected to usethe TCPmanagement network and is protected by an encryption solution such as the management network's VPN.
If the firewall isdoes not configureduse either encryption or logical separation to useprotect TCPtransmitted whentraffic sending log records while in transit to the central audit server, this is a finding.
The firewall must fail to a secure state uponif the failurefirewall offiltering thefunctions following:fail system initialization, shutdown, or system abortunexpectedly.
Discussion
Firewalls that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection. Failure to a known safe state helps prevent systems from failing to a state that may cause loss of data or unauthorized access to systemmake resources.changes Networkto elementsthe thatfirewall failfiltering suddenlyfunctions.
andThis withapplies noto incorporatedthe failureconfiguration stateof planning may leave the hostinggateway systemor availablenetwork buttraffic withsecurity afunction reducedof securitythe protection capabilitydevice. PreservingAbort therefers informationto systemstopping statethe informationfirewall alsofiltering facilitatesfunction systembefore restartit andhas returnfinished tonaturally. theThe operationalterm modeabort ofrefers theto organizationboth withrequested lessand disruptionunexpected to mission-essential processesterminations.
Fix Text
Configure the firewall to stopfail forwardingto traffica orsecure maintainstate theif configured security policies upon the failurefirewall offiltering thefunctions followingfail actions: system initialization, shutdown, or system abortunexpectedly.
Check Content
VerifyReview the firewall stopsconfiguration forwardingto trafficverify orit maintainsfails theto configureda securitysecure policiesstate uponif the failurefirewall offiltering thefunctions following:fail system initialization, shutdown, or system abortunexpectedly.
If the firewall does not stopfail forwardingto traffica orsecure maintainstate theif configured security policies upon the failurefirewall offiltering systemfunctions initialization,fail shutdownunexpectedly, or system abort, this is a finding.
The firewall must apply egress filters to traffic that is outbound from the network through any internal interface.
Discussion
If outbound communications traffic is not filtered, hostile activity intended to harm other networks or packets from networks destined to unauthorized networks may not be detected and prevented.
Access control policies and access control lists implemented on devices, such as firewalls, that control the flow of network traffic ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet) must be kept separated.
This requirement addresses the binding of the egressingress filter to the interface/zone rather than the content of the egressingress filter.
Fix Text
Configure a security policy to each outbound zone and/or interface to implement continuous filtering of outbound traffic. Apply security policy zones/interfaces (including the management interface) through which outbound traffic flows to untrusted external networks or subnetworks.
Check Content
Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification, Accreditation or Authorization Package, ports, protocols, and services documentation, and Ports, Protocols, and Services Management (PPSM) database. If the list of authorized sources and destinations is not available, this is a finding. Review the firewall configuration for each of the configured outbound zones and interfaces. Verify a security policy is applied to each outbound zone/interface, including the management interface. If an egress filter is not configured for each active outbound zone or interface, this is a finding.
The firewall must be configured to use filters that use packet headers and packet attributes, including source and destination IP addresses and ports, to prevent the flow of unauthorized or suspicious traffic between interconnected networks with different security policies (including perimeter firewalls and server VLANs).
Discussion
Information flow control regulates where information is allowed to travel within a network and between interconnected networks. Blocking or restricting detected harmful or suspicious communications between interconnected networks enforces approved authorizations for controlling the flow of traffic. The firewall that filters traffic outbound to interconnected networks with different security policies must be configured with filters (i.e., rules, access control lists [ACLs], screens, and policies) that permit, restrict, or block traffic based on organization-defined traffic authorizations. Filtering must include packet header and packet attribute information, such as IP addresses and port numbers. Configure filters to perform certain actions when packets match specified attributes, including the following actions: - Apply a policy - Accept, reject, or discard the packets - Classify the packets based on their source address - Evaluate the next term in the filter - Increment a packet counter - Set the packets’ loss priority - Specify an IPsec SA (if IPsec is used in the implementation) - Specify the forwarding path - Write an alert or message to the system log
Fix Text
Configure filters in the firewall to examine characteristics of incoming and outgoing packets, including but not limited to the following: - Bit fields in the packet header, including IP fragmentation flags, IP options, and TCP flags - IP version 4 (IPv4) numeric range, including destination port, DiffServ code point (DSCP) value, fragment offset, Internet Control Message Protocol (ICMP) code, ICMP packet type, interface group, IP precedence, packet length, protocol, and TCP and UDP source and destination port - IP version 6 (IPv6) numeric range, including class of service (CoS) priority, destination address, destination port, ICMP code, ICMP packet type, interface group, IP address, next header, packet length, source address, source port, and TCP and UDP source and destination port - Source and destination address and prefix list
Check Content
Verify the firewall is configured to use filters to restrict or block information system services based on best practices, known threats, and guidance in the Ports, Protocols, Services Management (PPSM) database regarding restrictions for boundary crossing for ports, protocols, and services. If the firewall cannot be configured with filters that employ packet header and packet attributes, including source and destination IP addresses and ports, to prevent the flow of unauthorized or suspicious traffic between interconnected networks with different security policies, this is a finding.
The firewall must employ filters that prevent or limit the effects of all types of commonly known denial-of-service (DoS) attacks, including flooding, packet sweeps, and unauthorized port scanning.
Discussion
Not configuring a key boundary security protection device such as the firewall against commonly known attacks is an immediate threat to the protected enclave because they are easily implemented by those with little skill. Directions for the attack are obtainable on the Internet and in hacker groups. Without filtering enabled for these attacks, the firewall will allow these attacks beyond the protected boundary. Configure the perimeter and internal boundary firewall to guard against the three general methods of well-known DoS attacks: flooding attacks, protocol sweeping attacks, and unauthorized port scanning. Flood attacks occur when the host receives too much traffic to buffer and slows down or crashes. Popular flood attacks include ICMP flood and SYN flood. A TCP flood attack of SYN packets initiating connection requests can overwhelm the device until it can no longer process legitimate connection requests, resulting in denial of service. An ICMP flood can overload the device with so many echo requests (ping requests) that it expends all its resources responding and can no longer process valid network traffic, also resulting in denial of service. An attacker might use session table floods and SYN-ACK-ACK proxy floods to fill up the session table of a host. In an IP address sweep attack, an attacker sends ICMP echo requests (pings) to multiple destination addresses. If a target host replies, the reply reveals the target’s IP address to the attacker. In a TCP sweep attack, an attacker sends TCP SYN packets to the target device as part of the TCP handshake. If the device responds to those packets, the attacker gets an indication that a port in the target device is open, which makes the port vulnerable to attack. In a UDP sweep attack, an attacker sends UDP packets to the target device. If the device responds to those packets, the attacker gets an indication that a port in the target device is open, which makes the port vulnerable to attack. In a port scanning attack, an unauthorized application is used to scan the host devices for available services and open ports for subsequent use in an attack. This type of scanning can be used as a DoS attack when the probing packets are sent excessively.
Fix Text
Configure the firewall to detect and prevent DoS attacks. Implement filters with thresholds that are customized for the specific environment where applicable. DoS filters are based on NIST 800-53 requirements and vendor recommendations. The following sample commands show filters that implement this requirement (these are examples only): set filter1 icmp ip-sweep threshold 1000 set filter2 tcp port-scan threshold 1000 set filter3 tcp syn-flood alarm-threshold 1000 set filter3 tcp syn-flood attack-threshold 1100 set filter4 tcp syn-flood source-threshold 100 set filter5 tcp syn-flood destination-threshold 2048 set filter6 tcp syn-flood timeout 20 set filter7 tcp tcp-sweep threshold 1000 set filter8 udp flood threshold 5000 set filter9 udp udp-sweep threshold 1000
Check Content
View the security filters for each interface or security zone. Verify DoS filters are configured to detect and prevent known DoS attacks such as IP sweeps, TCP sweeps, buffer overflows, unauthorized port scanning, SYN floods, UDP floods, and UDP sweeps. If filters are not configured or if the security zone is not configured with filters that guard against common DoS attacks, this is a finding.
The firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.
Discussion
DoS attacks can take multiple forms but have the common objective of overloading or blocking a network or host to deny or seriously degrade performance. If the network does not provide safeguards against DoS attacks, network resources will be unavailable to users. Installation of a firewall at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume/type. The firewall must include protection against DoS attacks that originate from inside the enclave that can affect either internal or external systems. These attacks may use legitimate or rogue endpoints from inside the enclave. These attacks can be simple "floods" of traffic to saturate circuits or devices, malware that consumes CPU and memory on a device or causes it to crash, or a configuration issue that disables or impairs the proper function of a device. For example, an accidental or deliberate misconfiguration of a routing table can misdirect traffic for multiple networks.
Fix Text
Associate a properly configured DoS firewall filter (e.g., rules, access control lists [ACLs], screens, or policies) to outbound interfaces and security zones. Apply a firewall filter to each outbound interface example: set security zones security-zone untrust interfaces <OUTBOUND-INTERFACE> set security zones security-zone trust screen untrust-screen
Check Content
Obtain and review the list of outbound interfaces and zones from site personnel. Review each of the configured outbound interfaces and zones. Verify zones that communicate outbound have been configured with the DoS firewall filter (i.e., rules, access control lists [ACLs], screens, or policies) such as IP sweeps, TCP sweeps, buffer overflows, unauthorized port scanning, SYN floods, UDP floods, and UDP sweeps. If all outbound interfaces are not configured to block DoS attacks, this is a finding.
The firewall implementation must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.
Discussion
A firewall experiencing a DoS attack will not be able to handle production traffic load. The high utilization and CPU caused by a DoS attack will also have an effect on control keep-alives and timers used for neighbor peering resulting in route flapping and will eventually black hole production traffic. The device must be configured to contain and limit a DoS attack's effect on the device's resource utilization. The use of redundant components and load balancing are examples of mitigating "flood-type" DoS attacks through increased capacity.
Fix Text
Configure a stateless firewall filter to set rate limits based on a destination of the packets. Apply the stateless firewall filter to all inbound interfaces.
Check Content
Use the "show" command to verify that all inbound interfaces have a stateless firewall filter to set rate limits based on a destination. If the firewall does not have a stateless firewall filter that sets rate limits based on a destination, this is a finding.
The firewall that filters traffic from the VPN access points must be configured with organization-defined filtering rules that apply to the monitoring of remote access traffic.
Discussion
Remote access devices (such as those providing remote access to network devices and information systems) that lack automated capabilities increase risk and make remote user access management difficult at best. Remote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Automated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).
Fix Text
Configure a group policy for remote clients and apply to the interface that is connected to allow ingress and egress to the VPN access points.
Check Content
Review the firewall configuration statements used to create a group policy with filtering rules for remote clients accessing the network using a VPN. Verify both ingress and egress traffic on this interface is subject to the remote access policy and filtering rules required by the organization. If the firewall is used to filter traffic from the VPN access points but is not configured with filtering rules that apply to the monitoring of remote access traffic, this is a finding.
The firewall must immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones.
Discussion
Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events.
Fix Text
Require system administrators to commit and test changes upon configuration of the firewall.
Check Content
Verify the firewall immediately uses updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones. For example, there is no need to reinitialize or reboot or the action to commit the changes is prompted. If the firewall does not immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones, this is a finding.
The firewall must generate traffic log records when traffic is denied, restricted, or discarded.
Discussion
Without generating log records that log usage of objects by subjects and other objects, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Security objects are data objects that are controlled by security policy and bound to security attributes. The firewall must not forward traffic unless it is explicitly permitted via security policy. Logging for firewall security-related sources such as screens and security policies must be configured separately. To ensure security objects such as firewall filters (i.e., rules, access control lists [ACLs], screens, and policies) send events to a syslog server and local logs, security logging must be configured one each firewall term.
Fix Text
Configure the firewall central audit server stanza to generate traffic log records for events when traffic is denied, restricted, or discarded.
Check Content
View the configuration of the firewall or the central audit server log records. Verify the firewall generates traffic log records when traffic is denied, restricted, or discarded. If the firewall does not generate traffic log records for events when traffic is denied, restricted, or discarded, this is a finding.
The firewall must generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.
Discussion
Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Access for different security levels maintains separation between resources (particularly stored data) of different security domains. The firewall can be configured to use security zones that are configured with different security policies based on risk and trust levels. These zones can be leveraged to prevent traffic from one zone from sending packets to another zone. For example, information from certain IP sources will be rejected if the destination matches specified security zones that are not authorized.
Fix Text
Configure the firewall central audit server stanza to generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.
Check Content
View the configuration of the firewall or the central audit server log records. Verify the firewall generates traffic log records when attempts are made to send packets between security zones that are not authorized to communicate. If the firewall does not generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate, this is a finding.
The firewall must be configured to allow authorized users to record a packet capture based IP, traffic type (TCP, UDP, or ICMP), or protocol.
Discussion
Without the ability to capture, record, and log content related to a user session, investigations into suspicious user activity would be hampered. This configuration ensures the ability to select specific sessions to capture in order to support general auditing/incident investigation or to validate suspected misuse.
Fix Text
Document a process for authorized users to capture, record, and log all content based on IP, traffic type (TCP, UDP, or ICMP), or protocol.
Check Content
View the documented process for packet capture. Verify the firewall allows authorized users to perform a packet capture based on IP, traffic type (TCP, UDP, or ICMP), or protocol. If the firewall is not configured to allow authorized users to capture, record, and log all content related to a user session, this is a finding.
The firewall must generate traffic log entries containing information to establish what type of events occurred.
Discussion
Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit event content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in the network element logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.
Fix Text
Configure the firewall to ensure entries sent to the traffic log include sufficient information to determine the type or category for each event in the traffic log.
Check Content
Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include sufficient information to determine the type or category for each event in the traffic log. If the traffic log entries do not include enough information to determine what type of event occurred, this is a finding.
The firewall must generate traffic log entries containing information to establish when (date and time) the events occurred.
Discussion
Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment, and provide forensic analysis of network traffic patterns, it is essential for security personnel to know when flow control events occurred (date and time) within the infrastructure. Associating event types with detected events in the network traffic logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.
Fix Text
Configure the firewall to ensure entries sent to the traffic log include the date and time of the event.
Check Content
Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include the date and time of each event. If the traffic log entries do not include the date and time the event occurred, this is a finding.
The firewall must generate traffic log entries containing information to establish the location on the network where the events occurred.
Discussion
Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know where events occurred, such as network element components, modules, device identifiers, node names, and functionality. Associating information about where the event occurred within the network provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.
Fix Text
Configure the firewall to ensure entries sent to the traffic log include the location of each event (e.g., network name, network subnet, network segment, or port).
Check Content
Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include the location of each event (e.g., network name, network subnet, port, or network segment). If the traffic log entries do not include the event location, this is a finding.
The firewall must generate traffic log entries containing information to establish the source of the events, such as the source IP address at a minimum.
Discussion
Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event. In addition to logging where events occur within the network, the traffic log events must also identify sources of events, such as IP addresses, processes, and node or device names.
Fix Text
Configure the firewall implementation to ensure entries sent to the traffic log include sufficient information to ascertain the source of each event (e.g., IP address, session, or packet ID).
Check Content
Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include sufficient information to ascertain the source of the events (e.g., IP address, session, or packet ID). If the traffic log entries do not include sufficient information to ascertain the source of the events, this is a finding.
The firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.
Discussion
Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network. Event outcomes can include indicators of event success or failure and event-specific results. They also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.
Fix Text
Configure the firewall to generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.
Check Content
Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include sufficient information to ascertain the outcome of the firewall rules. Verify that, at a minimum, the success or failure of the event is evented. If the traffic log entries do not include sufficient information to ascertain the outcome of the application of the firewall rules, this is a finding. If the traffic log entries do not include the success or failure of the application of the firewall rules, this is a finding.
The firewall must be configured to send traffic log entries to a central audit server for management and configuration of the traffic log entries.
Discussion
Without the ability to centrally manage the content captured in the traffic log entries, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. The DoD requires centralized management of all network component audit record content. Network components requiring centralized traffic log management must have the ability to support centralized management. The content captured in traffic log entries must be managed from a central location (necessitating automation). Centralized management of traffic log records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Ensure at least one syslog server is configured on the firewall. If the product inherently has the ability to store log records locally, the local log must also be secured. However, this requirement is not met since it calls for a use of a central audit server.
Fix Text
Configure the firewall to ensure traffic log entries are transmitted to the organization's central audit server (e.g., syslog server).
Check Content
Examine the traffic log configuration on the firewall. Verify the firewall is configured to send traffic log entries to the organization's central audit server. If the firewall is not configured to send traffic log entries to the organization's central audit server, this is a finding.
If communication with the central audit server is lost, the firewall must generate a real-time alert to, at a minimum, the SCA and ISSO.
Discussion
Without a real-time alert (less than a second), security personnel may be unaware of an impending failure of the audit functions and system operation may be adversely impacted. Alerts provide organizations with urgent messages. Automated alerts can be conveyed in a variety of ways, including via a regularly monitored console, telephonically, via electronic mail, via text message, or via websites. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded. Most firewalls use UDP to send audit records to the server and cannot tell if the server has received the transmission, thus the site should either implement a connection-oriented communications solution (e.g., TCP) or implement a heartbeat with the central audit server and send an alert if it is unreachable.
Fix Text
Configure the firewall (or another network device) to send an alert via instant message, email, or another authorized method to the SCA, ISSO, and other identified personnel for any log failure event where the filtering functions are unable to write events to the central audit server.
Check Content
If a network device such as the events, network management, or SNMP server is configured to send an alert when communication is lost with the central audit server, this is not a finding. Verify the firewall is configured to send an alert via instant message, email, SNMP, or another authorized method to the SCA, ISSO, and other identified personnel when communication is lost with the central audit server. If the firewall is not configured to send an immediate alert via an approved method when communication is lost with the central audit server, this is a finding.
In the event that communication with the central audit server is lost, the firewall must continue to queue traffic log records locally.
Discussion
It is critical that when the network element is at risk of failing to process traffic logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend on the nature of the failure mode. In accordance with DoD policy, the traffic log must be sent to a central audit server. When logging functions are lost, system processing cannot be shut down because firewall availability is an overriding concern given the role of the firewall in the enterprise. The system should either be configured to log events to an alternative server or queue log records locally. Upon restoration of the connection to the central audit server, action should be taken to synchronize the local log data with the central audit server. If the central audit server uses User Datagram Protocol (UDP) communications instead of a connection oriented protocol such as TCP, a method for detecting a lost connection must be implemented.
Fix Text
Configure local backup events files to capture DoD-defined auditable events either consistently or, if possible, in the event communication with the central audit server is lost.
Check Content
Verify logging has been enabled and configured for local queuing of the traffic log. If a local log file (or files) is not configured to capture events locally if communication with the central audit server is lost, this is a finding.
The firewall must protect the traffic log from unauthorized modification of local log records.
Discussion
If audit data were to become compromised, forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve. To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification. This can be achieved through multiple methods, which will depend on system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions and limiting log data locations. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. This does not apply to traffic logs generated on behalf of the device itself (management).
Fix Text
Validate the firewall includes a baseline cryptographic module that provides confidentiality and integrity services for authentication and for protecting communications with adjacent systems. Configure role-based, fine-grained permissions management for controlling commands needed to modify log records.
Check Content
Verify the firewall's fine-grained permissions are configured to prevent unauthorized modification of local log records. If the firewall does not protect traffic log records from unauthorized modification while stored locally, this is a finding.
The firewall must protect the traffic log from unauthorized deletion of local log files and log records.
Discussion
If audit data were to become compromised, forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve. To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification. This can be achieved through multiple methods, which will depend on system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions and limiting log data locations. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. This requirement does not apply to traffic logs generated on behalf of the device itself (device management).
Fix Text
Validate the firewall includes a baseline cryptographic module that provides confidentiality and integrity services for authentication and for protecting communications with adjacent systems. Configure role-based, fine-grained permissions management for controlling commands needed to delete log files and records.
Check Content
Verify the firewall's fine-grained permissions are configured to prevent unauthorized deletion of local log files or log records. If the firewall does not protect traffic log records and log files from unauthorized deletion while stored locally, this is a finding.
The firewall must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.
Discussion
Network devices are capable of providing a wide variety of functions (capabilities or processes) and services. Some of these functions and services are installed and enabled by default. The organization must determine which functions and services are required to perform the content filtering and other necessary core functionality for each component of the firewall. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Some services may be security related but, based on the firewall’s role in the architecture, must not be installed on the same hardware. For example, the device may serve as a router, VPN, or other perimeter services. However, if these functions are not part of the documented role of the firewall in the enterprise or branch architecture, the software and licenses should not be installed on the device. This mitigates the risk of exploitation of unconfigured services or services that are not kept updated with security fixes. If left unsecured, these services may provide a threat vector. Some services are not authorized for combination with the firewall and individual policy must be in place to instruct the administrator to remove these services. Examples of these services are Network Time Protocol (NTP), domain name server (DNS), email server, FTP server, web server, and Dynamic Host Configuration Protocol (DHCP). Only remove unauthorized services. This control is not intended to restrict the use of firewalls with multiple authorized roles.
Fix Text
Display and remove unnecessary licenses, services, and functions from the firewall. Examples include NTP, DNS, and DHCP. Note: Only remove unauthorized services. This control is not intended to restrict the use of network devices with multiple authorized roles.
Check Content
Review the documentation and architecture for the device or check the system-installed licenses or services. Determine what services and functions are installed on the firewall. Compare installed services and functions to the documentation showing the approved services. If unneeded services and functions are installed on the device but are not part of the documented role of the device, this is a finding.
In the event of a system failure of the firewall function, the firewall must be configured to save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted.
Discussion
Failure to a secure state can address safety or security in accordance with the mission needs of the organization. Failure to a secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving state information helps to facilitate the restart of the firewall application and a return to the operational mode with less disruption. This requirement applies to a failure of the firewall function rather than the device or operating system as a whole, which is addressed in the Network Device Management SRG. Since it is usually not possible to test this functionality in a production environment, systems should be validated either in a testing environment or prior to installation. This requirement is usually a function of the design of the firewall. Compliance can be verified by acceptance/validation processes or vendor attestation.
Fix Text
Configure the firewall to fail securely in the event of a transiently corrupt state or failure condition. When the system restarts, the system boot process must not succeed without passing all self-tests for cryptographic algorithms, RNG tests, and software integrity tests.
Check Content
View the firewall failover configuration or system documentation. Verify that in the event of a system failure of the firewall function, the firewall saves diagnostic information, logs system messages, and loads the most current security policies, rules, and signatures. Testing of this functionality in a production environment is not recommended. If in the event of a system failure of the firewall function the firewall does not save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted, this is a finding.
The firewall must apply ingress filters to traffic that is inbound to the network through any active external interface.
Discussion
Unrestricted traffic to the trusted networks may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources. Firewall filters control the flow of network traffic, ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet) must be kept separated.
Fix Text
Configure a security policy to each inbound zone and/or interface to implement continuous filtering of outbound traffic. Apply security policy zones/interfaces through which inbound traffic flows from untrusted external networks or subnetworks. Configure the ingress filters for the management interface to block all transit traffic (i.e., any traffic not destined to the firewall itself) and so that traffic accessing the firewall originates from the NOC.
Check Content
Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification, Accreditation or Authorization Package, ports, protocols, and services documentation, and Ports, Protocols, and Services Management (PPSM) database. If the list of authorized sources and destinations is not available, this is a finding. Review the firewall configuration for each of the configured inbound zones and interfaces. Verify an ingress filter (e.g., Access Control List) is applied to each inbound zone/interface, including the management interface. Verify ingress filters for the management interface to block all transit traffic (i.e., any traffic not destined to the firewall itself). Verify that traffic accessing the firewall originates from the Network Operations Center (NOC). If an ingress filter is not configured for each active inbound zone or interface, this is a finding.
The premise firewall (located behind the premise router) must block all outbound management traffic.
Discussion
The management network must still have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the managed network's premise equipment. If a firewall is located behind the premise router, all management traffic must be blocked at that point, with the exception of management traffic destined to premise equipment.
Fix Text
With the exception of management traffic destined to perimeter equipment, configure a firewall located behind the premise router to block all outbound management traffic.
Check Content
Review the firewall configuration to verify that it is blocking all outbound management traffic. If the firewall is not blocking management network from leaking to outside networks, this is a finding.
The firewall must restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address.
Discussion
Protect the management network with a filtering firewall configured to block unauthorized traffic. This requirement is similar to the out-of-band management (OOBM) model, when the production network is managed in-band. The management network could also be housed at a Network Operations Center (NOC) that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity, as well as connectivity between the NOC and the managed networks’ premise routers, would be enabled using either provisioned circuits or VPN technologies such as IPsec tunnels or MPLS VPN services.
Fix Text
Where IPsec technology is deployed to connect the managed network to the NOC, restrict the traffic entering the tunnels so that only the authorized management packets with authorized destination addresses are permitted.
Check Content
Inspect the architecture diagrams. Inspect the NOC and the managed network. Note that the IPsec tunnel endpoints may be configured on the premise or gateway router, the VPN gateway firewall, or a VPN concentrator. Verify that all traffic between the managed network and management network and vice-versa is secured via IPsec encapsulation. If the firewall does not restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address, this is a finding.
The perimeter firewall must filter traffic destined to the internal enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL), Vulnerability Assessments (VAs) for that the enclave.
Discussion
The enclave's internal network contains the servers where mission-critical data and applications reside. Malicious traffic can enter from an external boundary or originate from a compromised host internally. Vulnerability assessments must be reviewed by the SA and protocols must be approved by the IA staff before entering the enclave. Firewall filters (e.g., rules, access control lists [ACLs], screens, and policies) are the first line of defense in a layered security approach. They permit authorized packets and deny unauthorized packets based on port or service type. They enhance the posture of the network by not allowing packets to even reach a potential target within the security domain. The filters provided are highly susceptible ports and services that should be blocked or limited as much as possible without adversely affecting customer requirements. Auditing packets attempting to penetrate the network but stopped by the firewall filters will allow network administrators to broaden their protective ring and more tightly define the scope of operation. If the perimeter is in a Deny-by-Default posture and what is allowed through the filter is in accordance with the PPSM CAL and VAs for the enclave, and if the permit rule is explicitly defined with explicit ports and protocols allowed, then all requirements related to the database being blocked would be satisfied.
Fix Text
Configure the perimeter firewall to filter traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave.
Check Content
Review the perimeter firewall to verify it filters traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave. If the perimeter firewall does not filter traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave, this is a finding.
The firewall must generate an alert that can be forwarded to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected.
Discussion
Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The firewall generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs), which require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema. CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The firewall must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.
Fix Text
Configure the firewall (or another network device) to send an alert via instant message, email, or another authorized method to the ISSO and ISSM and other identified personnel when DoS incidents are detected.
Check Content
If a network device such as the events, network management, or SNMP server is configured to send an alert when DoS incidents are detected, this is not a finding. Verify the firewall is configured to send an alert via instant message, email, SNMP, or another authorized method to the ISSO, ISSM, and other identified personnel when DoS incidents are detected. If the firewall is not configured to send an alert via an approved and immediate method when DoS incidents are detected, this is a finding.