| Checked | Name | Title |
|---|
| ☐ | SV-233309r611394_rule | Forescout must enforce approved access by employing admissions assessment filters that include, at a minimum, device attributes such as type, IP address, resource group, and/or mission conditions as defined in Forescout System Security Plan (SSP). |
| ☐ | SV-233310r611394_rule | Endpoint policy assessment must proceed after the endpoint attempting access has been identified using an approved identification method such as IP address. |
| ☐ | SV-233311r616544_rule | For endpoints that require automated remediation, Forescout must be configured to redirect endpoints to a logically separate VLAN for remediation services. |
| ☐ | SV-233312r615851_rule | If a device requesting access fails Forescout policy assessment, Forescout must communicate with other components and the switch to either terminate the session or redirect the endpoint to the remediation subnet. |
| ☐ | SV-233313r615864_rule | Forescout must be configured to notify the user before proceeding with remediation of the user's endpoint device when automated remediation is used. |
| ☐ | SV-233314r615869_rule | Forescout must be configured so that all client machines are assessed by Forescout with exceptions that are allowed to bypass Forescout based on account or account type, as approved by the Information System Security Manager (ISSM) and documented in the System Security Plan (SSP). |
| ☐ | SV-233315r611394_rule | Forescout appliance must not be configured to implement a DHCP layer 3 method for separation or device authorization. |
| ☐ | SV-233316r611394_rule | Forescout must send an alert to the Information System Security Manager (ISSM) and System Administrator (SA), at a minimum, when critical security issues are found that put the network at risk. |
| ☐ | SV-233317r611394_rule | When devices fail the policy assessment, Forescout must create a record with sufficient detail suitable for forwarding to a remediation server for automated remediation or sending to the user for manual remediation. |
| ☐ | SV-233318r611394_rule | Forescout must place client machines on the blacklist and terminate Forescout agent connection when critical security issues are found that put the network at risk. |
| ☐ | SV-233319r611394_rule | Forescout must be configured so client machines do not communicate with other network devices in the DMZ or subnet except as needed to perform a client assessment or to identify itself. |
| ☐ | SV-233320r611394_rule | Forescout must enforce the revocation of endpoint access authorizations when devices are removed from an authorization group. |
| ☐ | SV-233321r611394_rule | Forescout must enforce the revocation of endpoint access authorizations at the next compliance assessment interval based on changes to the compliance assessment security policy. |
| ☐ | SV-233322r611394_rule | Forescout must deny or restrict access for endpoints that fail critical endpoint security checks. |
| ☐ | SV-233323r611394_rule | Forescout must be configured to log records onto a centralized events server. |
| ☐ | SV-233324r611394_rule | Forescout must off-load log records onto a different system. |
| ☐ | SV-233325r615865_rule | Forescout must generate a critical alert to be sent to the Information System Security Officer (ISSO) and Systems Administrator (SA) (at a minimum) in the event of an audit processing failure. |
| ☐ | SV-233326r615862_rule | Forescout must authenticate all endpoint devices before establishing a connection and proceeding with posture assessment. |
| ☐ | SV-233327r611394_rule | Forescout must be configured to apply dynamic ACLs that restrict the use of ports when non-entity endpoints are connected using MAC Authentication Bypass (MAB). |
| ☐ | SV-233328r615856_rule | Forescout must reveal error messages only to the Information System Security Officer (ISSO), Information System Security Manager (ISSM), and System Administrator (SA). |
| ☐ | SV-233329r615867_rule | Forescout must configure TCP for the syslog protocol to allow for detection by the central event server if communications is lost. |
| ☐ | SV-233330r616542_rule | Forescout switch module must only allow a maximum of one registered MAC address per access port. |
| ☐ | SV-233331r611394_rule | For TLS connections, Forescout must automatically terminate the session when a client certificate is requested and the client does not have a suitable certificate. |
| ☐ | SV-233332r611394_rule | Forescout must use TLS 1.2, at a minimum, to protect the confidentiality of information passed between the endpoint agent and Forescout for the purposes of client posture assessment. |
| ☐ | SV-233333r611394_rule | Forescout that stores device keys must have a key management process that is FIPS-approved and protected by Advanced Encryption Standard (AES) block cipher algorithms. |
| ☐ | SV-233334r611394_rule | Communications between Forescout endpoint agent and the switch must transmit access authorization information via a protected path using a cryptographic mechanism. |
| ☐ | SV-233335r616546_rule | Forescout must generate a log record when the client machine fails policy assessment because required security software is missing or has been deleted. |
| ☐ | SV-233336r616547_rule | Forescout must be configured with a secondary log server, in case the primary log is unreachable. |
| ☐ | SV-233337r611394_rule | Forescout must perform continuous detection and tracking of endpoint devices attached to the network. |
| ☐ | SV-233338r611394_rule | Forescout must deny network connection for endpoints that cannot be authenticated using an approved method. |
| ☐ | SV-233339r611394_rule | Forescout must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the endpoint device. |
| ☐ | SV-233340r615860_rule | When connecting with endpoints, Forescout must validate certificates used for Transport Layer Security (TLS) functions by performing RFC 5280-compliant certification path validation. |
STIGQter: STIG Summary: