STIGQter: STIG Summary: Forescout Network Device Management Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 20 Nov 2020:

Forescout must be configured to conduct backups of system-level information contained in the information system when changes occur.

DISA Rule

SV-230956r615886_rule

Vulnerability Number

V-230956

Group Title

SRG-APP-000516-NDM-000340

Rule Version

FORE-NM-000290

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.
• CCI-000537 - The organization conducts backups of system-level information contained in the information system per organization-defined frequency that is consistent with recovery time and recovery point objectives.

Weight

10

Fix Recommendation

Configure Forescout to conduct backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner.

Setup a backup server.
1. Open the Forescout Console and select Tools >> Advanced >> Backup >> Backup Server.
2. Click "SCP" or "SFTP" for the transfer protocol.
3. Add the IP address of the backup destination server.
4. Add the directory to receive the file.
5. Add PKI key (preferred) or add username and DoD compliant password for the backup account to be used.
6. Enable "Authenticate Destination Sever".
7. Test the file transfer.
8. Click "Apply".

Generate a backup job.
1. Click the "System Backup" tab.
2. Select "Enable System Backup".
3. Under Backup Schedule, add a "Generate backup at" and enter a time to run the backup in accordance with site procedures.
4. Select "Weekly" for Recurrence Pattern.

When changes to the configuration occur, the admin must immediately create a new backup by clicking "Backup Now" on the Backup screen.

Check Contents

Check Forescout to determine if the network device is configured to conduct backups of system-level information contained in the information system when changes occur or weekly, whichever is sooner.

1. Open the Forescout Console and select Tools >> Advanced >> Backup.
2. On the “System Backup” tab, verify the "Enable System Backup" radio button is selected.
3. Verify the Backup schedule is selected to at least "weekly".

If Forescout does not support the organizational requirement to conduct backups of system-level data according to the defined frequency, this is a finding.

Vulnerability Number

V-230956

Documentable

False

Rule Version

FORE-NM-000290

Severity Override Guidance

Check Forescout to determine if the network device is configured to conduct backups of system-level information contained in the information system when changes occur or weekly, whichever is sooner.

1. Open the Forescout Console and select Tools >> Advanced >> Backup.
2. On the “System Backup” tab, verify the "Enable System Backup" radio button is selected.
3. Verify the Backup schedule is selected to at least "weekly".

If Forescout does not support the organizational requirement to conduct backups of system-level data according to the defined frequency, this is a finding.

Check Content Reference

M

Target Key

5245

Comments