STIGQter: STIG Summary: Cisco ASA IPS Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA must be configured to install updates for signature definitions and vendor-provided rules.

DISA Rule

SV-239885r1016324_rule

Vulnerability Number

V-239885

Group Title

SRG-NET-000246-IDPS-00205

Rule Version

CASA-IP-000240

Severity

CAT II

CCI(s)

• CCI-004964 - Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy.
• CCI-004965 - Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management procedures.

Weight

10

Fix Recommendation

Apply Cisco Vulnerability Database (VDB) updates.

Step 1: Select Configuration >> ASA FirePOWER Configuration >> Updates. The Product Updates page appears.

Step 2: Click Download Updates to check for the latest updates on either of the following Support Sites:
- Sourcefire: https://support.sourcefire.com/
- Cisco: http://www.cisco.com/cisco/web/support/index.html

Step 3: Click the install icon next to the VDB update. The Install Update page appears.

Step 4: Click Install.
----------------------------------------------
Install Rule Updates Automatically.

Step 1: Select Configuration >> ASA FirePOWER Configuration >> Updates.

Step 2: Select the Rule Updates tab. The Rule Updates page appears.

Step 3: Select Enable Recurring Rule Update Imports.

Step 4: In the Import Frequency field, select Daily, Weekly, or Monthly from the drop-down list.

Step 5: Reapply policies after the update completes. Select Reapply intrusion policies after the rule update import completes. Select Reapply access control policies after the rule update import completes.

Step 6: Click Save.

Check Contents

Step 1: Select Configuration >> ASA FirePOWER Configuration >> Updates.

Step 2: Select the Rule Updates tab. The Rule Updates page appears.

Step 3: Verify that Enable Recurring Rule Update Imports has been selected.

Step 4: Verify that Daily, Weekly, or Monthly has been selected in the Import Frequency field.

Step 5: Verify that the following have been selected:
- Reapply intrusion policies after the rule update import completes
- Reapply access control policies after the rule update import completes

Note: The Cisco Vulnerability Database (VDB) is a database of known vulnerabilities to which hosts may be susceptible. The Cisco Vulnerability Research Team (VRT) issues periodic updates to the VDB. Verify with the ASA administrator that product updates are installed on a regular basis.

If the ASA is not configured to install updates for signature definitions and vendor-provided rules, this is a finding.

Vulnerability Number

V-239885

Documentable

False

Rule Version

CASA-IP-000240

Severity Override Guidance

Step 1: Select Configuration >> ASA FirePOWER Configuration >> Updates.

Step 2: Select the Rule Updates tab. The Rule Updates page appears.

Step 3: Verify that Enable Recurring Rule Update Imports has been selected.

Step 4: Verify that Daily, Weekly, or Monthly has been selected in the Import Frequency field.

Step 5: Verify that the following have been selected:
- Reapply intrusion policies after the rule update import completes
- Reapply access control policies after the rule update import completes

Note: The Cisco Vulnerability Database (VDB) is a database of known vulnerabilities to which hosts may be susceptible. The Cisco Vulnerability Research Team (VRT) issues periodic updates to the VDB. Verify with the ASA administrator that product updates are installed on a regular basis.

If the ASA is not configured to install updates for signature definitions and vendor-provided rules, this is a finding.

Check Content Reference

M

Target Key

5341