Check: SRG-NET-000249-ALG-000134
Application Layer Gateway SRG:
SRG-NET-000249-ALG-000134
(in versions v2 r2 through v1 r2)
Title
The ALG providing content filtering must block malicious code upon detection. (Cat II impact)
Discussion
Taking an appropriate action based on local organizational incident handling procedures minimizes the impact of this code on the network. This requirement is limited to ALGs web content filters and packet inspection firewalls; that perform malicious code detection as part of their functionality.
Check Content
If the ALG does not perform content filtering as part of the traffic management functionality, this is not applicable. Verify the ALG blocks malicious code upon detection. If the ALG does not block malicious code when detected, this is a finding.
Fix Text
If the ALG performs content filtering as part of its traffic management functionality, configure the ALG to block malicious code upon detection.
Additional Identifiers
Rule ID: SV-204965r396030_rule
Vulnerability ID: V-204965
Group Title: SRG-NET-000249
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001243 |
Configure malicious code protection mechanisms to block malicious code; quarantine malicious code; and/or take organization-defined action(s) in response to malicious code detection. |
Controls
| Number | Title |
|---|---|
| SI-3 |
Malicious Code Protection |