Free DISA STIG and SRG Library | Vaulted

ForeScout CounterACT ALG Security Technical Implementation Guide

Version 1 Release 1
2017-09-12
U_ForeScout_CounterACT_ALG_STIG_V1R1_Manual-xccdf.xml
This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Vulnerabilities (12)

CounterACT, when providing user access control intermediary services, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.

Finding ID
CACT-AG-000001
Rule ID
SV-90593r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000041-ALG-000022
CCI
CCI-000048
Target Key
(None)
Documentable
No
Discussion

Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with DoD requirements. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist, for example, with CounterACT guest access function. This requirement applies to network elements that have the concept of a user account and have the logon function residing on the network element. This requirement is not for access to the device itself, such as with system administrators of CounterACT, but rather is related to the network access control function provided to the users. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for network elements that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

Fix Text

If user network access control intermediary services are provided, configure CounterACT to display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network. 1. Log in to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Enable the "Display this Notice and Consent Message after login" and complete the provided text input area to have the Standard Mandatory DoD and Consent Banner before granting access to the device. This banner must include the following text: By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

Check Content

If CounterACT does not provide user access control intermediary services, this is not applicable. Verify CounterACT displays the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network. 1. Log on to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Enable the "Display this Notice and Consent Message after login" and complete the provided text input area to have the Standard Mandatory DoD and Consent Banner before granting access to the device. This banner must include the following text: By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If CounterACT does not display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network, this is a finding.

CounterACT, when providing user access control intermediary services, must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.

Finding ID
CACT-AG-000002
Rule ID
SV-90619r1_rule
Severity
Cat III
CCE
(None)
Group Title
SRG-NET-000042-ALG-000023
CCI
CCI-000050
Target Key
(None)
Documentable
No
Discussion

The banner must be acknowledged by the user prior to allowing the user access to the network. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoD will not be in compliance with system use notifications required by law. To establish acceptance of the application usage policy, a click-through banner at application logon is required. The network element must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating "OK". This policy only applies to gateways (e.g., identity management or authentication gateways) that provide user account services as part of the intermediary services.

Fix Text

If user access control intermediary services are provided, configure CounterACT to retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access. 1. Log on to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Ensure the options for the logon banner "require confirmation" is selected.

Check Content

If CounterACT does not provide user access control intermediary services, this is not applicable. Verify CounterACT retains the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and takes explicit actions to log on for further access. 1. Log in to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Verify the options for logon banner "require confirmation" is selected. If CounterACT does not retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access, this is a finding.

CounterACT, when providing user access control intermediary services for publicly accessible applications, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.

Finding ID
CACT-AG-000003
Rule ID
SV-90621r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000043-ALG-000024
CCI
CCI-001388
Target Key
(None)
Documentable
No
Discussion

Display of a standardized and approved use notification before granting access to the publicly accessible network element ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to network elements that have the concept of a user account and have the logon function residing on the network element. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for network elements that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following:

Fix Text

If user access control intermediary services are provided, configure CounterACT to display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system. 1. Log on to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Enable the "Display this Notice and Consent Message after login" and complete the provided text input area to have the Standard Mandatory DoD and Consent Banner before granting access to the device. This banner must include the following text: By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

Check Content

If CounterACT does not provide user access control intermediary services, this is not applicable. Verify CounterACT displays the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system. 1. Log on to CounterACT’s Administrator UI. 2. Go to Tools >> Options >> User Console and Options >> Password and Logon. 3. Enable the "Display this Notice and Consent Message after login" and complete the provided text input area to have the Standard Mandatory DoD and Consent Banner before granting access to the device. This banner must include the following text: By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If CounterACT does not display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system, this is a finding.

CounterACT must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.

Finding ID
CACT-AG-000004
Rule ID
SV-90623r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000088-ALG-000054
CCI
CCI-000139
Target Key
(None)
Documentable
No
Discussion

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Possible audit processing failures also include the inability of ALG to write to the central audit log. While this requirement also applies to the event monitoring system (e.g., Syslog, Security Information and Event Management [SIEM], or SNMP servers), CounterACT can also be configured to send notifications.

Fix Text

Configure CounterACT to send all alert notifications to, at a minimum, the ISSO and SCA when an audit processing failure occurs. 1. Log in to CounterACT’s Administrator interface. 2. Select Tools >> Options. 3. Select General. 4. Select the "+" next to general to open the submenu. Select email Preferences. 5. Ensure that the ISSO/SCA email address is configuration for notifications.

Check Content

Verify CounterACT sends an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs. 1. Log in to the CounterACT Administrator interface. 2. Select Tools >> Options. 3. Select General. 4. Select the "+" next to general to open the submenu. Select email Preferences. 5. Ensure that the ISSO/SCA email address is configuration for notifications. If CounterACT does not send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs, this is a finding.

If user authentication services are provided, CounterACT must be configured with a pre-established trust relationship and mechanisms with a central directory service that validates user account access authorizations and privileges.

Finding ID
CACT-AG-000006
Rule ID
SV-90625r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000138-ALG-000088
CCI
CCI-000764
Target Key
(None)
Documentable
No
Discussion

User account and privilege validation must be centralized in order to prevent unauthorized access using changed or revoked privileges. CounterACT can implement functions such as traffic filtering, authentication, access, and authorization functions based on computer and user privileges. However, the directory service (e.g., Active Directory or LDAP) must not be installed on CounterACT, particularly if the gateway resides on the untrusted zone of the Enclave.

Fix Text

If user authentication service is provided by CounterACT, configure the use of a central directory service for user authentication. Obtain configuration information for a directory service (e.g., Active Directory or LDAP) that validates user account access authorizations and privileges. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory configured for Authentication. Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected.

Check Content

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT is configured for NAC services authentication. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory configured for Authentication. Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected. Verify with site representatives that the directory service validates user account access authorizations and privileges. If CounterACT does not use a central directory service to validate user account access authorizations and privileges, this is a finding.

If user authentication services are provided, CounterACT must restrict user authentication traffic to specific authentication server(s).

Finding ID
CACT-AG-000007
Rule ID
SV-90627r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000138-ALG-000089
CCI
CCI-000764
Target Key
(None)
Documentable
No
Discussion

User authentication can be used as part of the policy filtering rule sets. Some URLs or network resources can be restricted to authenticated users only. Users are prompted by the application or browser for credentials. Authentication service may be provided by CounterACT as an intermediary for the application; however, the authentication credential must be stored in the site's directory services server. This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).

Fix Text

If user authentication service is provided by CounterACT, configure the use of a central directory service for user authentication. 1. Connect to the CounterACT Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Ensure the User Directory configured for Authentication. Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected. 4. Ensure the Hostname is correct for the assigned directory and then select "OK". (Select "Apply" if changes were made.) 5. Select the directory and then select test. Ensure both tests passed.

Check Content

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT is configured to use a specific authentication server(s). 1. Connect to the CounterACT Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory is configured for Authentication. Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected. 4. Verify the Hostname is correct for the assigned directory and then select "OK". (Select "Apply" if changes were made.) 5. Select the directory and then select test. Verify both tests past. If CounterACT does not restrict user authentication traffic to a specific authentication server(s), this is a finding.

CounterACT, when providing user authentication intermediary services, must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.

Finding ID
CACT-AG-000009
Rule ID
SV-90629r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000147-ALG-000095
CCI
CCI-001942
Target Key
(None)
Documentable
No
Discussion

A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack. An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. A non-privileged account is any account with the authorizations of a non-privileged user. Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. Security relevant roles include key management, account management, network and system administration, database administration, and web administration. Techniques used to address this include protocols using nonces (e.g., numbers generated for a specific one time use) or challenges (e.g., TLS). Additional techniques include time-synchronous or challenge-response one-time authenticators. This requirement applies to ALGs that provide user authentication intermediary services.

Fix Text

If user authentication intermediary services are provided, configure CounterACT to implement replay-resistant authentication mechanisms for network access to non-privileged accounts. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Ensure the User Directory is configured for secure methods of communication. On the Settings TAB ensure the "Use TLS" radio button is selected. 4. Select "OK". (Select "Apply" if changes were made.)

Check Content

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT is configured to implement replay-resistant authentication mechanisms for network access to non-privileged accounts. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory is configured for secure methods of communication. On the Settings TAB ensure the "Use TLS" radio button is selected. If CounterACT does not implement replay-resistant authentication mechanisms for network access to non-privileged accounts, this is a finding.

CounterACT must off-load audit records onto a centralized log server.

Finding ID
CACT-AG-000010
Rule ID
SV-90631r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000334-ALG-000050
CCI
CCI-001851
Target Key
(None)
Documentable
No
Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. This does not apply to audit logs generated on behalf of the device itself (management).

Fix Text

Configure CounterACT to off-load audit records onto a centralized log server. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> Plugins >> Syslog. 3. Ensure a Syslog server is configured in the "Send To" tab. 4. On the Events Filtering Tab, ensure all radio buttons associated with NAC Events, Threat Protection, System Logs, User Operations, and Operating System messages are selected. 5. Select "OK". (Select "Apply" if changes were made.)

Check Content

Verify CounterACT off-loads audit records onto a centralized log server. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> Plugins >> Syslog. 3. Verify a Syslog server is configured in the "Send To" tab. 4. On the Events Filtering Tab, ensure all radio buttons associated with NAC Events, Threat Protection, System Logs, User Operations, and Operating System messages are selected. If CounterACT does not off-load audit records onto a centralized log server, this is a finding.

CounterACT, when providing user authentication intermediary services, must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.

Finding ID
CACT-AG-000011
Rule ID
SV-90873r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000337-ALG-000096
CCI
CCI-002038
Target Key
(None)
Documentable
No
Discussion

Without reauthentication, users may access resources or perform tasks for which they do not have authorization. In addition to the reauthentication requirements associated with session locks, organizations may require reauthentication of individuals and/or devices in other situations, including (but not limited to) the following circumstances: 1. When authenticators change 2. When roles change 3. When security categories of information systems change 4. When the execution of privileged functions occurs 5. After a fixed period of time 6. Periodically Within the DoD, the minimum circumstances requiring reauthentication are privilege escalation and role changes. This requirement only applies to components where this is specific to the function of the device or has the concept of user authentication (e.g., VPN or ALG capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).

Fix Text

If user access control intermediary services are provided, configure CounterACT to require users to reauthenticate when organization-defined circumstances or situations require reauthentication. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> 802.1x. 3. Select the Pre-Admission Authorization tab. 4. On each Rule that "Accepts", ensure there is an Attribute "Session-Timeout" configured to the maximum session configuration, typically 60 minutes, but not more than 120.

Check Content

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT is configured to require users to reauthenticate when organization-defined circumstances or situations require reauthentication. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> 802.1x. 3. Select the Pre-Admission Authorization tab. 4. On each Rule that "Accepts", verify there is an Attribute "Session-Timeout" configured to the maximum session configuration, typically 60 minutes, but not more than 120. If CounterACT does not require users to reauthenticate when organization-defined circumstances or situations require reauthentication, this is a finding.

CounterACT, when providing user authentication intermediary services, must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

Finding ID
CACT-AG-000012
Rule ID
SV-90875r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000339-ALG-000090
CCI
CCI-001951
Target Key
(None)
Documentable
No
Discussion

For remote access to non-privileged accounts, the purpose of requiring a device that is separate from the information system gaining access for one of the factors during multifactor authentication is to reduce the likelihood of compromising authentication credentials stored on the system. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD common access card. A privileged account is defined as an information system account with authorizations of a privileged user. Remote access is access to DoD-nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. An example of compliance with this requirement is the use of a one-time password token and PIN coupled with a password; or the use of a CAC/PIV card and PIN coupled with a password.

Fix Text

If user authentication intermediary services are provided, configure CounterACT to implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Ensure the User Directory configured for Authentication uses Multi-Factor credentials Select the configured directory (or directories) and on the General Tab ensure the "Use for Authentication" radio button is selected. 4. Ensure the Hostname is correct for the assigned directory then select "OK". (Select "Apply" if changes were made.)

Check Content

If CounterACT does not provide user authentication intermediary services, this is not applicable. Verify CounterACT implements multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> User Directory. 3. Verify the User Directory configured for Authentication uses Multi-Factor credentials Select the configured directory (or directories) and on the General Tab verify the "Use for Authentication" radio button is selected. 4. Verify the Hostname is correct for the assigned directory then select "OK". (Select "Apply" if changes were made.) If CounterACT does not implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access, this is a finding.

CounterACT must off-load audit records onto a centralized log server in real time.

Finding ID
CACT-AG-000014
Rule ID
SV-90877r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000511-ALG-000051
CCI
CCI-001851
Target Key
(None)
Documentable
No
Discussion

Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. Off-loading is a common process in information systems with limited audit storage capacity. The audit storage on the ALG is used only in a transitory fashion until the system can communicate with the centralized log server designated for storing the audit records, at which point the information is transferred. However, DoD requires that the log be transferred in real time which indicates that the time from event detection to off-loading is seconds or less. This does not apply to audit logs generated on behalf of the device itself (management).

Fix Text

Configure CounterACT to off-load onto a centralized log server in real time. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> Plugins >> Syslog. 3. Ensure a Syslog server is configured in the "Send To" tab. 4. On the Events Filtering Tab, ensure all radio buttons associated with NAC Events, Threat Protection, System Logs, User Operations, and Operating systems messages are selected.

Check Content

Verify CounterACT off-loads audit records onto a centralized log server in real time. 1. Connect to CounterACT’s Admin Console and log in. 2. Go to Tools >> Options >> Plugins >> Syslog. 3. Verify a Syslog server is configured in the "Send To" tab. 4. On the Events Filtering Tab, Verify all radio buttons associated with NAC Events, Threat Protection, System Logs, User Operations, and Operating systems messages are selected. If CounterACT does not off-load onto a centralized log server in real time, this is a finding.

CounterACT must use an Enterprise Manager combined with Appliances to ensure redundancy in case of audit failure in this critical network access control and security service.

Finding ID
CACT-AG-000026
Rule ID
SV-90879r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000089-ALG-000055
CCI
CCI-000140
Target Key
(None)
Documentable
No
Discussion

It is critical that when the network element is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include: software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. When availability is an overriding concern, other approved actions in response to an audit failure are as follows: 1. If the failure was caused by the lack of audit record storage capacity, the network element must continue generating audit records if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner. 2. If audit records are sent to a centralized collection server and communication with this server is lost or the server fails, the network element must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server. A NAC is an essential security service and should not be shut down in the event of an audit failure. Redundancy and rollover features of the CounterACT enterprise should be leveraged. CounterACT enterprise is required in DoD implementations and load balancing and redundancy is a function of this architecture by default.

Fix Text

Design and install CounterACT implementation to include an Enterprise Manager combined with one or more Appliances. The Appliances will associate with the enterprise Manager.

Check Content

Examine architecture documentation. Verify CounterACT implementation includes an Enterprise Manager combined with Appliances to ensure redundancy. If CounterACT implementation does not include an Enterprise Manager combined with Appliances to ensure redundancy, this is a finding.