STIGQter: STIG Summary: ForeScout CounterACT NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 12 Sep 2017:

CounterACT must support organizational requirements to conduct backups of system-level information contained in the information system when changes occur or weekly, whichever is sooner.

DISA Rule

SV-90897r1_rule

Vulnerability Number

V-76209

Group Title

SRG-APP-000516-NDM-000340

Rule Version

CACT-NM-000013

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.
• CCI-000537 - The organization conducts backups of system-level information contained in the information system per organization-defined frequency that is consistent with recovery time and recovery point objectives.

Weight

10

Fix Recommendation

Configure CounterACT to generate audit log events for a locally developed list of auditable events.

1. Open the CounterACT Console.
2. Select Tools >> Options >> Plugin.
3. Select the Syslog Plugin.
4. Select CounterACT or the Enterprise Manager appliance you would like to verify.
5. Ensure additional settings for audit are available by ensuring that either one of these options is selected: "Include only messages generated by the 'send message to syslog action'" or "include NAC policy logs".

Check Contents

Check CounterACT to determine if the network device is configured to conduct backups of system-level information contained in the information system when changes occur or weekly, whichever is sooner.

1. Open CounterACT Console and select Tools >> Options.
2. Select the "+" next to "Advanced" menu (toward the bottom).
3. Select the “Backup” submenu.
4. On the “System Backup” tab, verify the "Enable System Backup" radio button is selected.
5. Verify the Backup schedule is selected to at least "weekly".

If CounterACT does not support the organizational requirements to conduct backups of system-level data according to the defined frequency, this is a finding.

Vulnerability Number

V-76209

Documentable

False

Rule Version

CACT-NM-000013

Severity Override Guidance

Check CounterACT to determine if the network device is configured to conduct backups of system-level information contained in the information system when changes occur or weekly, whichever is sooner.

1. Open CounterACT Console and select Tools >> Options.
2. Select the "+" next to "Advanced" menu (toward the bottom).
3. Select the “Backup” submenu.
4. On the “System Backup” tab, verify the "Enable System Backup" radio button is selected.
5. Verify the Backup schedule is selected to at least "weekly".

If CounterACT does not support the organizational requirements to conduct backups of system-level data according to the defined frequency, this is a finding.

Check Content Reference

M

Target Key

3225

Comments