Check: NET0168
Network Infrastructure Policy STIG:
NET0168
(in versions v10 r6 through v10 r1)
Title
If the site has a non-DoD external connection (i.e. Approved Gateway), an Intrusion Detection and Prevention System (IDPS) must be located between the sites Approved Gateway and the perimeter router. (Cat II impact)
Discussion
The incorrect placement of the external IDPS may allow unauthorized access to go undetected and limit the ability of security personnel to stop malicious or unauthorized use of the network. In order to ensure that an attempted or existing attack goes unnoticed, the data from the sensors must be monitored continuously.
Check Content
Inspect the network topology and physical connectivity to verify compliance. If the site has a non-DoD external connection and does not have an IDPS located between the site's Approved Gateway and the perimeter router, this is a finding. Note: An Approved Gateway (AG) is any external connection from a DoD NIPRNet enclave to an Internet Service Provider, or network owned by a contractor, or non-DoD federal agency that has been approved by either the DoD CIO or the DoD Component CIO. This AG requirement does not apply to commercial cloud connections when the Cloud Service Provider (CSP) network is connected via the NIPRNet Boundary Cloud Access Point (BCAP).
Fix Text
Install and configure an IDPS between the site's Approved Gateway and the premise router.
Additional Identifiers
Rule ID: SV-251357r806026_rule
Vulnerability ID: V-251357
Group Title: NET0168
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001101 |
The organization limits the number of external network connections to the information system. |
CCI-001121 |
The organization protects against unauthorized physical connections at organization-defined managed interfaces. |