Cisco ASA Firewall STIG Version Comparison

There are 4 differences between versions v1 r2 (April 27, 2022) (the "left" version) and v1 r4 (April 27, 2023) (the "right" version).

Check CASA-FW-000150 was changed between these two versions. Green, underlined text was added, red, struck-out text was removed.

The regular view of the left check and right check may be easier to read.

Title

The Cisco ASA must be configured to enable threat detection to mitigate risks of denial-of-service (DoS) attacks.

Check Content

Review NOTE: When operating the ASA in multi-context mode with a separate IDPS, threat detection cannot be enabled, and this check is Not Applicable. Review the ASA configuration to determine if threat detection has been enabled. threat-detection basic-threat If the ASA has not been configured to enable threat detection to mitigate risks of DoS attacks, this is a finding.

Discussion

A firewall experiencing a DoS attack will not be able to handle production traffic load. The high utilization and CPU caused by a DoS attack will also have an effect on control keep-alives and timers used for neighbor peering, resulting in route flapping and will eventually black-hole production traffic. The device must be configured to contain and limit a DoS attack's effect on the device's resource utilization. The use of redundant components and load balancing are examples of mitigating "flood-type" DoS attacks through increased capacity.

Fix

Configure threat detection as shown in the example below. ASA(config)# threat-detection basic-threat