STIGQter: STIG Summary: Symantec Edge SWG NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Apr 2026:

The Edge SWG must be configured to protect against known types of denial-of-service (DoS) attacks by employing organization-defined security safeguards.

DISA Rule

SV-279271r1170700_rule

Vulnerability Number

V-279271

Group Title

SRG-APP-000435-NDM-000315

Rule Version

SYME-ND-000740

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

1. In the Edge SWG Web UI, navigate to the Configuration tab.
2. Go to "Authentication" and "Console Access".
3. Under "Console Access", click "Add ACL Entry".
4. In the open block, add the IPv4 or IPv6 source address or network under "Source Address", then add the subnet mask or CIDR prefix under "Prefix Length" (e.g., 2001:db8:1:: and 48).
5. Click "Apply" next to the entry.
6. Repeat the above steps by adding all the allowed management prefixes.
Note: Ensure the subnet is in one of the allowed IPv4 or IPv6 subnets or the session will be disconnected after clicking "Save".
7. Once completed, click "Save".

To add the timeouts:
1. Log in to the Edge SWG SSH CLI.
2. Enter "enable" and "configure terminal".
3. Enter "security management web-timeout 5".
4. Enter "security management cli-timeout 5".

To add lockout configurations:
1. Log in to the Edge SWG SSH CLI.
2. Enter "enable" and "configure terminal".
3. Issue the command "security local-user-list create local".
4. Enter "security local-user-list edit local".
5. Enter "max-failed-attempts 3".
6. Enter "lockout-duration 900".
7. Enter "reset-interval 900".

Check Contents

1. In the Edge SWG Web UI and navigate to the Configuration tab.
2. Go to "Authentication" and "Console Access".

If under "Console Access" there is no configured ACL, this is a finding.

If there is a configured ACL, but "Enforce ACL for built-in administrators" is not checked, this is a finding.

1. Log in to the Edge SWG SSH CLI.
2. Enter "show security".

If under "Account" "CLI session timeout" does not say "5 minutes", this is a finding.

If under "Account" "Web interface session timeout" does not say "5 minutes", this is a finding.

1. Log in to the Edge SWG SSH CLI.
2. Enter "enable" and "configure terminal".
3. Issue the command "security local-user-list edit local", then type "view".

If "Max failed attempts" under "Account lockout" does not equal "3", this is a finding.

If "Lockout duration" under "Account lockout" does not equal "900 seconds", this is a finding.

Vulnerability Number

V-279271

Documentable

False

Rule Version

SYME-ND-000740

Severity Override Guidance

1. In the Edge SWG Web UI and navigate to the Configuration tab.
2. Go to "Authentication" and "Console Access".

If under "Console Access" there is no configured ACL, this is a finding.

If there is a configured ACL, but "Enforce ACL for built-in administrators" is not checked, this is a finding.

1. Log in to the Edge SWG SSH CLI.
2. Enter "show security".

If under "Account" "CLI session timeout" does not say "5 minutes", this is a finding.

If under "Account" "Web interface session timeout" does not say "5 minutes", this is a finding.

1. Log in to the Edge SWG SSH CLI.
2. Enter "enable" and "configure terminal".
3. Issue the command "security local-user-list edit local", then type "view".

If "Max failed attempts" under "Account lockout" does not equal "3", this is a finding.

If "Lockout duration" under "Account lockout" does not equal "900 seconds", this is a finding.

Check Content Reference

M

Target Key

5726