STIGQter: STIG Summary: Trend Micro TippingPoint IDPS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The TPS must block outbound traffic containing known and unknown denial-of-service (DoS) attacks by ensuring that security policies, signatures, rules, and anomaly detection techniques are applied to outbound communications traffic.

DISA Rule

SV-242193r997620_rule

Vulnerability Number

V-242193

Group Title

SRG-NET-000192-IDPS-00140

Rule Version

TIPP-IP-000280

Severity

CAT II

CCI(s)

• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.
• CCI-004866 - Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective.

Weight

10

Fix Recommendation

1. In the Trend Micro SMS, navigate to "Profiles" and "Inspection Profiles" and select the organization's profile.
2. If there is not one configured, select "Default".
3. Click "Search".
4. Under "advanced DDoS", select New.
a. Under Filter Parameters, type a name.
b. Select Block + Notify as the action set.
c. Determine which port-pair direction is the outbound direction. For example, if the outbound traffic direction is Port A to Port B, select "Port A to Port B" as the direction.
d. Select "Any" for the destination IP.
e. Select SYN Proxy Settings.
f. Click "enabled".
g. Type a notification threshold of SYN transmits per second. The range is 1–10000. Consult with the ISSO to ensure this range will meet organizational policy.
h. Under an approved change window, select Distribute to the TPS.

Check Contents

1. In the Trend Micro SMS, navigate to "Profiles" and "Inspection Profiles" and select the organization's profile.
2. If there is not one configured, select "Default".
3. Click "Search".

Under "advanced DDoS", if a DDoS filter does not exist, this is a finding.

Vulnerability Number

V-242193

Documentable

False

Rule Version

TIPP-IP-000280

Severity Override Guidance

1. In the Trend Micro SMS, navigate to "Profiles" and "Inspection Profiles" and select the organization's profile.
2. If there is not one configured, select "Default".
3. Click "Search".

Under "advanced DDoS", if a DDoS filter does not exist, this is a finding.

Check Content Reference

M

Target Key

5367