Check: BROM-00-000650
Bromium Secure Platform 4.x STIG:
BROM-00-000650
(in version v1 r1)
Title
The Bromium vSentry client must automatically capture and forward payloads (Malware Manifest) that were downloaded and determined to be malicious to the management console. (Cat II impact)
Discussion
Automatic session termination addresses the termination of user-initiated logical sessions in contrast to the termination of network connections that are associated with communications sessions (i.e., network disconnect). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational information system. Such user sessions can be terminated (and thus terminate user access) without terminating network sessions. Forensic analysis is essential in discovering the tools, tactics, and methodologies used by the attacker, which aids in the prevention of future attacks.
Check Content
Review base policy to ensure that the micro-virtual machine (VM) will capture the malware manifest upon the detection of malicious activity. 1. Using the management console, navigate to "Policies" and select the base policy. 2. Navigate to "Security". 3. Navigate to and inspect the "Generate isolated threat malware manifests?" policy setting. If the Bromium vSentry client is not configured to automatically capture and forward payloads that were downloaded and determined to be malicious to the management console, this is a finding.
Fix Text
Modify the base policy to ensure that the micro-VM will terminate the user session upon the detection of malicious activity. 1. Using the management console, navigate to "Policies" and select the base policy. 2. Navigate to "Security". 3. Navigate to and enable the check box and radio button for the "Generate isolated threat malware manifests?" policy setting. 4. Click "Save and Deploy".
Additional Identifiers
Rule ID: SV-95143r1_rule
Vulnerability ID: V-80439
Group Title: SRG-APP-000295
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-002361 |
The information system automatically terminates a user session after organization-defined conditions or trigger events requiring session disconnect. |
Controls
Number | Title |
---|---|
AC-12 |
Session Termination |