Title

The network devices must be configured to alert the administrator of a potential attack or system failure. (Cat II impact)

Discussion

The IDS or firewall is the first device that is under the sites control that has the possibility to alarm the local staff of an ongoing attack. An alert from either of these devices can be the first indication of an attack or system failure.

Check Content

The SA shall define clipping levels / thresholds as a baseline to display alert messages on specific attacks identifying the potential security violation or attack. Review the IDS or firewall configuration to determine what alerts have been defined and how the notifications are performed. If the device is not configured to alert the administrator of potential failures, this is a finding.

Fix Text

Configure the IDS or firewall to alarm the SA of potential attacks or system failure.

Additional Identifiers

Rule ID:

Vulnerability ID: V-3176

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.