STIGQter: STIG Summary: AvePoint Compliance Guardian Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 15 Mar 2023:

Compliance Guardian must control remote access methods.

DISA Rule

SV-256845r890145_rule

Vulnerability Number

V-256845

Group Title

SRG-APP-000315

Rule Version

APCG-00-000030

Severity

CAT II

CCI(s)

• CCI-002314 - Employ automated mechanisms to control remote access methods.

Weight

10

Fix Recommendation

If needed configure the Compliance Guardian Manager to restrict inbound connections from nonsecure zones.
- Log on to Compliance Guardian as admin account.
- On the Control Panel page in the System Configuration section, click "General Settings".
- Select "Security - System Security Policy".
- Navigate to "Specify network security settings".
- Select "Enable Network Security" option.
- Add known, secure IPs to allow list of "Trusted Network" option.
- Or, add IPs to block to "Restricted Network" list.
- Save the settings.

Check Contents

Check the Compliance Guardian Manager configuration to ensure the restriction of inbound connections from nonsecure zones.
- Log on to Compliance Guardian as admin account.
- On the Control Panel page in the System Configuration section, click "General Settings".
- Select "Security - System Security Policy".
- Verify "Specify network security settings" option.

If "Enable Network Security" is not selected, this is a finding.

If "Enable Network Security" is selected, review the entries under Trusted Network. Verify only known, secure IPs are configured as "Allow".

If "Restricted Network" is selected, review the entries under Restricted Network.

If IP address restrictions are not configured or IP ranges configured to be allowed are not restrictive enough to prevent connections from nonsecure zones, this is a finding.

Vulnerability Number

V-256845

Documentable

False

Rule Version

APCG-00-000030

Severity Override Guidance

Check the Compliance Guardian Manager configuration to ensure the restriction of inbound connections from nonsecure zones.
- Log on to Compliance Guardian as admin account.
- On the Control Panel page in the System Configuration section, click "General Settings".
- Select "Security - System Security Policy".
- Verify "Specify network security settings" option.

If "Enable Network Security" is not selected, this is a finding.

If "Enable Network Security" is selected, review the entries under Trusted Network. Verify only known, secure IPs are configured as "Allow".

If "Restricted Network" is selected, review the entries under Restricted Network.

If IP address restrictions are not configured or IP ranges configured to be allowed are not restrictive enough to prevent connections from nonsecure zones, this is a finding.

Check Content Reference

M

Target Key

5531