STIGQter: STIG Summary: Trend Micro TippingPoint IDPS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Trend Micro TippingPoint Security Management System (SMS) must be configured to send security IPS policy to the Trend Micro Threat Protection System (TPS).

DISA Rule

SV-242173r840498_rule

Vulnerability Number

V-242173

Group Title

SRG-NET-000018-IDPS-00018

Rule Version

TIPP-IP-000070

Severity

CAT I

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

1. In the Trend Micro SMS, navigate to "Profiles" and "Inspection Profiles" and select the organization's profile.
2. If there is no profile configured, select "default".
3. Click "Edit Details". Select the deployment mode of "Default". The default deployment mode ensures all strict DoD vulnerabilities are blocked and alerted upon.
4. Navigate to "Profile Overview", and select the action set for each category to "Recommended". The recommended action set is set to ensure all suspicious and vulnerable traffic is blocked and alerted upon.
5. Go through each default rule and tune the block and disabled rules to ensure they reflect the network environment's traffic patterns. Not all default block or disabled rules may be applicable to all DoD networks, especially in the cases of multitenancy.

Note: If the site has set up a security profile (i.e., not using the default profile), then verify compliance using the site's SSP.

Check Contents

1. In the Trend Micro SMS, navigate to "Profiles" and "Inspection Profiles" and select the organization's profile.
2. If there is not one configured, select "Default".
3. Click "Edit Details". Ensure the deployment mode of "Default" is selected. The default deployment mode ensures all strict DoD vulnerabilities are blocked and alerted upon.
4. Navigate to "Profile Overview" and ensure the action set for each category is set to "Recommended". The recommended action set is set to ensure all suspicious and vulnerable traffic is blocked and alerted upon.

If the "default" deployment mode is used, but not configured in a compliant manner, this is a finding.

Note: If the site has set up a security profile (i.e., not using the default profile), then verify compliance with the site's SSP requirements.

Vulnerability Number

V-242173

Documentable

False

Rule Version

TIPP-IP-000070

Severity Override Guidance

1. In the Trend Micro SMS, navigate to "Profiles" and "Inspection Profiles" and select the organization's profile.
2. If there is not one configured, select "Default".
3. Click "Edit Details". Ensure the deployment mode of "Default" is selected. The default deployment mode ensures all strict DoD vulnerabilities are blocked and alerted upon.
4. Navigate to "Profile Overview" and ensure the action set for each category is set to "Recommended". The recommended action set is set to ensure all suspicious and vulnerable traffic is blocked and alerted upon.

If the "default" deployment mode is used, but not configured in a compliant manner, this is a finding.

Note: If the site has set up a security profile (i.e., not using the default profile), then verify compliance with the site's SSP requirements.

Check Content Reference

M

Target Key

5367