STIGQter: STIG Summary: Cisco ASA IPS Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA must be configured to block traffic from IP addresses that have a known bad reputation based on the latest reputation intelligence.

DISA Rule

SV-239887r665974_rule

Vulnerability Number

V-239887

Group Title

SRG-NET-000249-IDPS-00221

Rule Version

CASA-IP-000270

Severity

CAT II

CCI(s)

CCI-001243 - Configure malicious code protection mechanisms to block malicious code; quarantine malicious code; and/or take organization-defined action(s) in response to malicious code detection.

Weight

Fix Recommendation

Step 1: Navigate to Configuration >> ASA FirePOWER Configuration >> Object Management.

Step 2: Click the Security Intelligence tab.

Step 3: Next to the Intelligence Feed, click the edit icon.

Step 4: Edit the Update Frequency. Choose various intervals from two hours to one week. The user can also disable feed updates.

Step 5: Click Store ASA FirePOWER Changes.

Check Contents

Step 1: Navigate to Configuration >> ASA FirePOWER Configuration >> Object Management.

Step 2: Click the Security Intelligence tab.

Step 3: Next to the Intelligence Feed, click the edit icon.

Step 4: Verify that a frequency has been selected and not disabled.

Note: The Security Intelligence block listing feature is the easiest method to maintain a blacklist. Security Intelligence uses reputation intelligence to quickly block connections to or from IP addresses, URLs, and domain names. The Intelligence Feed, which tracks IP addresses representing security threats such as malware, spam, botnets, and phishing. Because the Intelligence Feed is regularly updated, using it ensures that the system uses up-to-date information to filter malicious network traffic.

If the ASA is not configured to block traffic from IP addresses that have a known bad reputation based on the latest reputation intelligence, this is a finding.

Vulnerability Number

V-239887

Documentable

False

Rule Version

CASA-IP-000270

Severity Override Guidance

Step 1: Navigate to Configuration >> ASA FirePOWER Configuration >> Object Management.

Step 2: Click the Security Intelligence tab.

Step 3: Next to the Intelligence Feed, click the edit icon.

Step 4: Verify that a frequency has been selected and not disabled.

Note: The Security Intelligence block listing feature is the easiest method to maintain a blacklist. Security Intelligence uses reputation intelligence to quickly block connections to or from IP addresses, URLs, and domain names. The Intelligence Feed, which tracks IP addresses representing security threats such as malware, spam, botnets, and phishing. Because the Intelligence Feed is regularly updated, using it ensures that the system uses up-to-date information to filter malicious network traffic.

If the ASA is not configured to block traffic from IP addresses that have a known bad reputation based on the latest reputation intelligence, this is a finding.

Check Content Reference

Target Key

5341