STIGQter: STIG Summary: Forescout Network Device Management Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Forescout must use DOD-approved PKI rather than proprietary or self-signed device certificates.

DISA Rule

SV-230959r1043177_rule

Vulnerability Number

V-230959

Group Title

SRG-APP-000142-NDM-000245

Rule Version

FORE-NM-000330

Severity

CAT I

CCI(s)

• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.

Weight

10

Fix Recommendation

Replace the self-signed certificate with a CA-signed certificates for greater security. To obtain a CA-signed certificate:

Generate a certificate signing request (CSR) to obtain a CA-signed certificate for the nodes in your deployment.
1. Navigate to Tools >> Options >> Certificates >> System Certificates.
2. On the right of the screen click "Generate CSR".
3. Enter the values for generating a CSR.
- Key Length – <select an approved key length from the drop down list>
- Signature Algorithm – <select an approved algorithm from the drop down list>
Examples:
RSA: rsa size <512 | 1024 | 2048 | 4096>>
ECDSA: size <256 | 384>>
- Key Usages – < Checking all items that apply Client Authentication, Server Authentication and Email Signing>
- Validity – <years>
4. Click "Next".

To import the required trusted CA certificates by completing the following procedures:
1. Login to the console.
2. Navigate to Tools >> Options >> Certificates >> Trusted Certificates.
3. Click "Add".
4. Specify the Certificate file.
5. Ensure "Enable trusting this certificate" is checked.
6. Click "Next".
7. Click "Next" after reviewing the certificate data.
8. Ensure "All subsystems" is selected, and then click "Next".
9. Ensure "All Forescout devices" is selected, and then click "Finish".
10. Click "Apply".

Check Contents

Navigate to Tools >> Options >> Certificates >> Trusted Certificates.

1. The System Certificates page appears and provides information for the local certificates.
2. Select a certificate to display the certificate details.

If Forescout does not obtain its public key certificates from an appropriate certificate policy through an approved service provider, this is a finding.

Vulnerability Number

V-230959

Documentable

False

Rule Version

FORE-NM-000330

Severity Override Guidance

Navigate to Tools >> Options >> Certificates >> Trusted Certificates.

1. The System Certificates page appears and provides information for the local certificates.
2. Select a certificate to display the certificate details.

If Forescout does not obtain its public key certificates from an appropriate certificate policy through an approved service provider, this is a finding.

Check Content Reference

M

Target Key

5245