STIGQter STIGQter: STIG Summary: Symantec ProxySG ALG Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Apr 2020:

Symantec ProxySG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected.

DISA Rule

SV-104301r1_rule

Vulnerability Number

V-94347

Group Title

SRG-NET-000392-ALG-000148

Rule Version

SYMP-AG-000670

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the ProxySG to email DoS attack detection/mitigation alerts to the ISSO and ISSM.

1. SSH into the ProxySG console and type "enable".
2. Enter the correct password and type "config".
3. Press "Enter" and type "attack-detection".
4. See the ProxySG Administration Guide, Chapter 73: Preventing Denial of Service Attacks, to understand the functionality before proceeding.
5. Type "client" and press "Enter". Type "enable-limits" and press "Enter".
6. Log on to the Web Management Console.
7. Browse to Maintenance >> Event Logging and click the "Mail" tab. Ensure that the ISSO and ISSM email addresses are specified.
8. Browse to Configuration >> Policy >> Visual Policy Manager. Click "Launch".
9. In one Web Access Layer, create a new rule. Right-click the "Action" of that rule and select "Set". Click "New" and select "Set Attack Detection". Provide a "Failure Weight" per local security policy requirements.
10. Click "OK" and click "OK" again.
11. Right-click the "Track" column for this rule and select "Set". Click "New" and select "Email".
12. Select "Custom Recipients" and click "Configure Custom Recipients Lists".
13. Click "New," provide a name for the list, and enter the ISSO and ISSM email addresses in the "List Members" field.
14. Click "OK" and click "OK" again. Create message text and click "OK".
15. Click "OK" and click "OK" again. Select File >> Install Policy on SG Appliance.

Check Contents

Verify that DoS events generate alerts to at least the ISSO and ISSM.

1. SSH into the ProxySG console and type "enable".
2. Enter the correct password and type "config".
3. Press "Enter" and type "show attack-detection configuration".
4. Verify that "client limits enabled" equals "true".
5. Log on to the Web Management Console.
6. Browse to Maintenance >> Event Logging and click the "Mail" tab. Verify that the ISSO and ISSM email addresses are specified.
7. Browse to Configuration >> Policy >> Visual Policy Manager. Click "Launch".
8. In each Web Access Layer, find rules that contain an "Action" of "Attack Detection".
9. Verify that the "Track" field of these rules is set to "Email" and that the "recipients" are set to at least the ISSO and ISSM.

If Symantec ProxySG providing content filtering does not generate an alert to, at a minimum, the ISSO and ISSM when DoS incidents are detected, this is a finding.

Vulnerability Number

V-94347

Documentable

False

Rule Version

SYMP-AG-000670

Severity Override Guidance

Verify that DoS events generate alerts to at least the ISSO and ISSM.

1. SSH into the ProxySG console and type "enable".
2. Enter the correct password and type "config".
3. Press "Enter" and type "show attack-detection configuration".
4. Verify that "client limits enabled" equals "true".
5. Log on to the Web Management Console.
6. Browse to Maintenance >> Event Logging and click the "Mail" tab. Verify that the ISSO and ISSM email addresses are specified.
7. Browse to Configuration >> Policy >> Visual Policy Manager. Click "Launch".
8. In each Web Access Layer, find rules that contain an "Action" of "Attack Detection".
9. Verify that the "Track" field of these rules is set to "Email" and that the "recipients" are set to at least the ISSO and ISSM.

If Symantec ProxySG providing content filtering does not generate an alert to, at a minimum, the ISSO and ISSM when DoS incidents are detected, this is a finding.

Check Content Reference

M

Target Key

3515

Comments