STIGQter: STIG Summary: Symantec Edge SWG ALG Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

The ALG providing user authentication intermediary services must uniquely identify and authenticate nonorganizational users (or processes acting on behalf of nonorganizational users).

DISA Rule

SV-279166r1170654_rule

Vulnerability Number

V-279166

Group Title

SRG-NET-000169-ALG-000102

Rule Version

SYME-00-002500

Severity

CAT II

CCI(s)

• CCI-000804 - Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
• CCI-000766 - Implement multifactor authentication for network access to non-privileged accounts.
• CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.
• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.
• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.

Weight

10

Fix Recommendation

1. In the Edge SWG Web UI, navigate to the VPM.
2. Add a web access layer called "Web Access Layer".
3. Click "Add a rule."
4. Under "Source", left-click and select "Set".
5. Click "Add a new object" and select "Group".
6. Enter the full DN of the LDAP group. For example: CN=broadcom.proxyusers.gsg,OU=BROADCOM,DC=dod,DC=mil
7. Under "Authentication Realm", select the CAC Certificate.
8. Click "Apply" and then click "Set".
9. Click "Service" and then click "Set".
10. Click "Add a new object".
11. Click "Client Protocol", select "HTTP", and then click "Apply and set".
12. Under "Action", left-click and set to "Allow".
13. Under "Track", left-click "Add a new Object".
14. Click "Event Log".
15. Under "Details", add the following text: "$(appliance.name)$(appliance.primary_address)$(c-ip)$(c-port)$(c-uri)$(c-uri-address)$(c-uri-cookie-domain)$(c-uri-extension)$(c-uri-host)$(c-uri-hostname)$(c-uri-path)$(c-ur-pathquery)$(client.address)$(client.certificate.subject)$(client.host)$(client.public_address)$(cs-auth-group)$(cs-categories-policy)$(date)$(user.name)$(user.x509.subject)"
16. Under "Category", select "All".
17. Under "Display options", select "Both".
18. Click "Apply and set".
19. Repeat the above procedure for each service/protocol being proxied with authorization enforcement. For example, ensure HTTPS is selected when doing HTTPS and not HTTP.
20. Click "Apply Policy".

1. Navigate to the top of the VPM and add a new layer. It must be a CPL layer.
2. Include the following in the layer text:
<Proxy>
url.regex="ssl://" authenticate(no)

<Proxy>client.certificate.require(yes)
service.name=!(CAC-MC-Notify,HTTPS-Console) authenticate(CAC) authenticate.force(no) authenticate.mode(auto)

Note: The CAC-MC-Notify and HTTPS-Console must match a proxy or reverse service in use. The authenticate(CAC) must represent the Certificate Authentication Realm previously configured.

3. Click "Apply Policy".

Check Contents

In the Edge SWG Web UI, navigate to the Visual Policy Manager (VPM).

If there is not a Web Access Layer, and the authorization has not been configured on this layer for the proxy users based on the CAC/LDAP authentication realm, this is a finding.

If there are not specific services restricted to each group, this is a finding.

Ensure there is a CPL layer that includes a client certificate requirement rule; otherwise, this is a finding.

Vulnerability Number

V-279166

Documentable

False

Rule Version

SYME-00-002500

Severity Override Guidance

In the Edge SWG Web UI, navigate to the Visual Policy Manager (VPM).

If there is not a Web Access Layer, and the authorization has not been configured on this layer for the proxy users based on the CAC/LDAP authentication realm, this is a finding.

If there are not specific services restricted to each group, this is a finding.

Ensure there is a CPL layer that includes a client certificate requirement rule; otherwise, this is a finding.

Check Content Reference

M

Target Key

5725