STIGQter STIGQter: STIG Summary: Application Layer Gateway (ALG) Security Requirements Guide (SRG)

Version: 1

Release: 2 Benchmark Date: 24 Jul 2015

CheckedNameTitle
SV-68583r1_ruleThe ALG providing user access control intermediary services must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.
SV-68599r1_ruleThe ALG providing intermediary services for remote access communications traffic must ensure inbound and outbound traffic is monitored for compliance with remote access security policies.
SV-68601r1_ruleThe ALG providing intermediary services for remote access communications traffic must control remote access methods.
SV-68603r1_ruleThe ALG providing intermediary services for remote access communications traffic must use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.
SV-68605r1_ruleThe ALG that provides intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52.
SV-68607r1_ruleThe ALG providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
SV-68609r1_ruleThe ALG providing intermediary services for remote access communications traffic must provide the capability to immediately disconnect or disable remote access to the information system.
SV-68611r1_ruleTo protect against data mining, the ALG providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
SV-68613r1_ruleTo protect against data mining, the ALG providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.
SV-68615r1_ruleTo protect against data mining, the ALG providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
SV-68617r1_ruleTo protect against data mining, the ALG providing content filtering must detect code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
SV-68619r1_ruleTo protect against data mining, the ALG providing content filtering as part of its intermediary services must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code.
SV-68621r1_ruleThe ALG must enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies.
SV-68623r1_ruleThe ALG must enforce approved authorizations for controlling the flow of information within the network based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.
SV-68625r1_ruleThe ALG must restrict or block harmful or suspicious communications traffic by controlling the flow of information between interconnected networks based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.
SV-68631r1_ruleThe ALG must immediately use updates made to policy enforcement mechanisms such as policy filters, rules, signatures, and analysis algorithms for gateway and/or intermediary functions.
SV-68633r1_ruleThe ALG that is part of a CDS must apply information flow control to data transferred between security domains by means of a policy filter which consists of a set of hardware and/or software.
SV-68635r1_ruleThe ALG providing user access control intermediary services must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.
SV-68637r1_ruleThe ALG providing user access control intermediary services must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.
SV-68639r1_ruleThe ALG providing user access control intermediary services for publicly accessible applications must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.
SV-68641r1_ruleThe ALG providing user access control intermediary services must generate audit records when successful/unsuccessful attempts to access privileges occur.
SV-68643r1_ruleThe ALG must generate audit records when successful/unsuccessful attempts to access security objects occur.
SV-68645r1_ruleThe ALG that is part of a CDS must generate audit records when successful/unsuccessful attempts to access security levels occur.
SV-68647r1_ruleThe ALG must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur.
SV-68649r1_ruleThe ALG providing user access control intermediary services must generate audit records when successful/unsuccessful attempts to modify privileges occur.
SV-68651r1_ruleThe ALG must generate audit records when successful/unsuccessful attempts to modify security objects occur.
SV-68653r1_ruleThe ALG must generate audit records when successful/unsuccessful attempts to modify security levels occur.
SV-68655r1_ruleThe ALG must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur.
SV-68657r1_ruleThe ALG providing user access control intermediary services must generate audit records when successful/unsuccessful attempts to delete privileges occur.
SV-68659r1_ruleThe ALG must generate audit records when successful/unsuccessful attempts to delete security levels occur.
SV-68661r1_ruleThe ALG providing user access control intermediary services must generate audit records when successful/unsuccessful logon attempts occur.
SV-68663r1_ruleThe ALG must produce audit records containing information to establish what type of events occurred.
SV-68665r1_ruleThe ALG must produce audit records containing information to establish when (date and time) the events occurred.
SV-68667r1_ruleThe ALG must produce audit records containing information to establish where the events occurred.
SV-68669r1_ruleThe ALG must produce audit records containing information to establish the source of the events.
SV-68671r1_ruleThe ALG must produce audit records containing information to establish the outcome of the events.
SV-68673r1_ruleThe ALG must generate audit records containing information to establish the identity of any individual or process associated with the event.
SV-68675r1_ruleThe ALG must be configured to support centralized management and configuration.
SV-68677r1_ruleThe ALG must off-load audit records onto a centralized log server.
SV-68679r1_ruleThe ALG must off-load audit records onto a centralized log server in real time.
SV-68681r1_ruleThe ALG that is part of a CDS must have the capability to implement journaling.
SV-68683r1_ruleThe ALG must provide an immediate real-time alert to, at a minimum, the SCA and ISSO, of all audit failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.
SV-68685r1_ruleThe ALG must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.
SV-68687r1_ruleThe ALG must shut down by default upon audit failure (unless availability is an overriding concern).
SV-68689r1_ruleThe ALG must protect audit information from unauthorized read access.
SV-68691r1_ruleThe ALG must protect audit information from unauthorized modification.
SV-68693r1_ruleThe ALG must protect audit information from unauthorized deletion.
SV-68695r1_ruleThe ALG must protect audit tools from unauthorized access.
SV-68697r1_ruleThe ALG must protect audit tools from unauthorized modification.
SV-68699r1_ruleThe ALG must protect audit tools from unauthorized deletion.
SV-68701r1_ruleThe ALG must be configured in accordance with the security configuration settings based on DoD security policy and technology-specific security best practices.
SV-68703r1_ruleThe ALG that provides intermediary services for SMTP must inspect inbound and outbound SMTP and Extended SMTP communications traffic for protocol compliance and protocol anomalies.
SV-68705r1_ruleThe ALG that intermediary services for FTP must inspect inbound and outbound FTP communications traffic for protocol compliance and protocol anomalies.
SV-68707r1_ruleThe ALG that provides intermediary services for HTTP must inspect inbound and outbound HTTP traffic for protocol compliance and protocol anomalies.
SV-68709r1_ruleThe ALG that is part of a CDS must use source and destination security attributes associated with organization-defined information, source, and/or destination objects to enforce organization-defined information flow control policies as a basis for flow control decisions.
SV-68711r1_ruleThe ALG that is part of a CDS must allow privileged administrators to enable/disable all security policy filters used to enforce information flow control.
SV-68713r1_ruleThe ALG that is part of a CDS must allow privileged administrators to configure and make changes to all security policy filters that are used to enforce information flow control.
SV-68715r1_ruleThe ALG that is part of a CDS, when transferring information between different security domains, must use organization-defined data type identifiers to validate data essential for information flow decisions.
SV-68717r1_ruleThe ALG that is part of a CDS must decompose information into organization-defined, policy-relevant subcomponents for submission to policy enforcement mechanisms before transferring information between different security domains.
SV-68719r1_ruleThe ALG that is part of a CDS, when transferring information between different security domains, must implement organization-defined security policy filters requiring fully enumerated formats that restrict data structure and content.
SV-68721r1_ruleThe ALG that is part of a CDS, when transferring information between different security domains, must examine the information for the presence of organization-defined unsanctioned information.
SV-68723r1_ruleThe ALG that is part of a CDS must prohibit the transfer of unsanctioned information in accordance with the security policy when transferring information between different security domains.
SV-68725r1_ruleThe ALG that is part of a CDS must uniquely identify and authenticate source by organization, system, application, and/or individual for information transfer.
SV-68727r1_ruleThe ALG that is part of a CDS must uniquely identify and authenticate destination by organization, system, application, and/or individual for information transfer.
SV-68729r1_ruleThe ALG that is part of a CDS must bind security attributes to information using organization-defined binding techniques to facilitate information flow policy enforcement.
SV-68731r1_ruleThe ALG that is part of a CDS, when transferring information between different security domains, must apply the same security policy filtering to metadata as it applies to data payloads.
SV-68733r1_ruleThe ALG that is part of a CDS must enforce dynamic traffic flow control based on organization-defined policies.
SV-68735r1_ruleThe ALG that is part of a CDS must enforce information flow control based on organization-defined metadata.
SV-68737r1_ruleThe ALG that is part of a CDS must block the transfer of data with malformed security attribute metadata structures.
SV-68739r1_ruleThe ALG that is part of a CDS must enforce organization-defined one-way information flows using hardware mechanisms.
SV-68741r1_ruleThe ALG that is part of a CDS must enforce information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows.
SV-68743r1_ruleThe ALG that is part of a CDS must enforce the use of human reviews for organization-defined information flows under organization-defined conditions.
SV-68745r1_ruleThe ALG must not have unnecessary services and functions enabled.
SV-68747r1_ruleThe ALG must be configured to remove or disable unrelated or unneeded application proxy services.
SV-68749r1_ruleThe ALG must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
SV-68751r1_ruleThe ALG providing user authentication intermediary services must require users to re-authenticate when organization-defined circumstances or situations require re-authentication.
SV-68753r1_ruleThe ALG providing user access control intermediary services must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) which validate user account access authorizations and privileges.
SV-68755r1_ruleThe ALG providing user authentication intermediary services must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
SV-68757r1_ruleThe ALG providing user authentication intermediary services must restrict user authentication traffic to specific authentication server(s).
SV-68759r2_ruleThe ALG providing user authentication intermediary services must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
SV-68761r1_ruleThe ALG providing user authentication intermediary services must implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
SV-68767r1_ruleThe ALG providing user authentication intermediary services must use multifactor authentication for network access to non-privileged accounts.
SV-68769r2_ruleThe ALG providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
SV-68771r1_ruleThe ALG providing user authentication intermediary services must transmit only encrypted representations of passwords.
SV-68773r1_ruleThe ALG must prohibit the use of cached authenticators after an organization-defined time period.
SV-68775r1_ruleThe ALG providing user authentication intermediary services using PKI-based user authentication must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.
SV-68777r1_ruleThe ALG that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.
SV-68779r1_ruleThe ALG providing PKI-based user authentication intermediary services must map authenticated identities to the user account.
SV-68781r1_ruleThe ALG providing user authentication intermediary services must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).
SV-68789r1_ruleThe ALG providing user authentication intermediary services must conform to FICAM-issued profiles.
SV-68791r1_ruleThe ALG must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged session), the session must be terminated after 15 minutes of inactivity.
SV-68793r1_ruleThe ALG providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes.
SV-68795r1_ruleThe ALG providing encryption intermediary services must implement NIST FIPS-validated cryptography for digital signatures.
SV-68797r1_ruleThe ALG providing encryption intermediary services must use NIST FIPS-validated cryptography to implement encryption services.
SV-68855r1_ruleThe ALG must detect, at a minimum, mobile code that is unsigned or exhibiting unusual behavior, has not undergone a risk assessment, or is prohibited for use based on a risk assessment.
SV-68857r1_ruleThe ALG providing content filtering must block or restrict detected prohibited mobile code.
SV-68859r1_ruleThe ALG providing content filtering must prevent the download of prohibited mobile code.
SV-68861r1_ruleThe ALG must protect the authenticity of communications sessions.
SV-68863r1_ruleThe ALG must invalidate session identifiers upon user logout or other session termination.
SV-68865r1_ruleThe ALG must recognize only system-generated session identifiers.
SV-68867r1_ruleThe ALG must generate unique session identifiers using a FIPS 140-2 approved random number generator.
SV-68869r1_ruleThe ALG providing user authentication intermediary services using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of protected sessions.
SV-68871r1_ruleIn the event of a system failure of the ALG function, the ALG must save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted.
SV-68873r1_ruleThe ALG must implement load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks.
SV-68875r1_ruleThe ALG providing content filtering must protect against known and unknown types of Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis.
SV-68877r1_ruleThe ALG providing content filtering must protect against or limit the effects of known and unknown types of Denial of Service (DoS) attacks by employing pattern recognition pre-processors.
SV-68879r1_ruleThe ALG providing content filtering must protect against known types of Denial of Service (DoS) attacks by employing signatures.
SV-68881r1_ruleThe ALG providing content filtering must block outbound traffic containing known and unknown DoS attacks to protect against the use of internal information systems to launch any Denial of Service (DoS) attacks against other networks or endpoints.
SV-68883r1_ruleThe ALG must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
SV-68885r1_ruleThe ALG must fail securely in the event of an operational failure.
SV-68887r1_ruleThe ALG must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
SV-68889r1_ruleThe ALG must identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems.
SV-68891r1_ruleThe ALG must check the validity of all data inputs except those specifically identified by the organization.
SV-68893r1_ruleThe ALG must behave in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.
SV-68895r1_ruleThe ALG must generate error messages that provide the information necessary for corrective actions without revealing information that could be exploited by adversaries.
SV-68897r1_ruleThe ALG must reveal error messages only to the ISSO, ISSM, and SCA.
SV-68899r1_ruleThe ALG providing content filtering must automatically update malicious code protection mechanisms.
SV-68901r1_ruleThe ALG providing content filtering must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.
SV-68903r1_ruleThe ALG providing content filtering must be configured to perform real-time scans of files from external sources at network entry/exit points as they are downloaded and prior to being opened or executed.
SV-68905r1_ruleThe ALG providing content filtering must block malicious code upon detection.
SV-68907r1_ruleThe ALG providing content filtering must delete or quarantine malicious code in response to malicious code detection.
SV-68909r1_ruleThe ALG providing content filtering must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection.
SV-68911r1_ruleThe ALG providing content filtering must be configured to integrate with a system-wide intrusion detection system.
SV-68913r1_ruleThe ALG providing content filtering must detect use of network services that have not been authorized or approved by the ISSM and ISSO, at a minimum.
SV-68915r1_ruleThe ALG providing content filtering must generate a log record when unauthorized network services are detected.
SV-68917r1_ruleThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when unauthorized network services are detected.
SV-68919r1_ruleThe ALG providing content filtering must continuously monitor inbound communications traffic crossing internal security boundaries for unusual or unauthorized activities or conditions.
SV-68921r1_ruleThe ALG providing content filtering must continuously monitor outbound communications traffic crossing internal security boundaries for unusual/unauthorized activities or conditions.
SV-68923r1_ruleThe ALG providing content filtering must send an alert to, at a minimum, the ISSO and ISSM when detection events occur.
SV-68925r1_ruleThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources (e.g., IAVMs or CTOs) are detected.
SV-68927r1_ruleThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when root level intrusion events which provide unauthorized privileged access are detected.
SV-68929r1_ruleThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when user level intrusions which provide non-privileged access are detected.
SV-68931r1_ruleThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when denial of service incidents are detected.
SV-68933r1_ruleThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when new active propagation of malware infecting DoD systems or malicious code adversely affecting the operations and/or security of DoD systems is detected.
SV-68935r1_ruleThe ALG that implements spam protection mechanisms must be updated automatically.
SV-69007r1_ruleThe ALG must generate audit records when successful/unsuccessful attempts to delete security objects occur.
SV-69009r1_ruleThe ALG must generate audit records when successful/unsuccessful attempts to delete categories of information (e.g., classification levels) occur.
SV-69011r1_ruleThe ALG providing user access control intermediary services must generate audit records showing starting and ending time for user access to the system.
SV-69013r1_ruleThe ALG providing user access control intermediary services must provide the capability for authorized users to select a user session to capture or view.
SV-69015r1_ruleThe ALG providing user access control intermediary services must provide the capability for authorized users to capture, record, and log all content related to a selected user session.
SV-69017r1_ruleTo protect against data mining, the ALG providing content filtering must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
SV-69019r1_ruleThe ALG must fail to a secure state upon failure of initialization, shutdown, or abort actions.
SV-70443r1_ruleThe ALG providing user access control intermediary services must conceal, via the session lock, information previously visible on the display with a publicly viewable image.
SV-70445r1_ruleThe ALG providing user access control intermediary services must initiate a session lock after a 15-minute period of inactivity.
SV-70447r1_ruleThe ALG providing user access control intermediary services must provide the capability for users to directly initiate a session lock.
SV-70449r1_ruleThe ALG providing user access control intermediary services must retain the session lock until the user reestablishes access using established identification and authentication procedures.
SV-70451r1_ruleThe ALG providing user access control intermediary services must automatically terminate a user session when organization-defined conditions or trigger events that require a session disconnect occur.
SV-70453r1_ruleThe ALG providing user access control intermediary services must provide a logoff capability for user-initiated communications sessions.
SV-70455r1_ruleThe ALG providing user access control intermediary services must display an explicit logoff message to users indicating the reliable termination of authenticated communications sessions.
SV-70457r1_ruleThe ALG that stores secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.