STIGQter STIGQter: STIG Summary:

Forescout Network Access Control Security Technical Implementation Guide

Version: 1

Release: 1 Benchmark Date: 20 Nov 2020

SV-233309r611394_ruleForescout must enforce approved access by employing admissions assessment filters that include, at a minimum, device attributes such as type, IP address, resource group, and/or mission conditions as defined in Forescout System Security Plan (SSP).
SV-233310r611394_ruleEndpoint policy assessment must proceed after the endpoint attempting access has been identified using an approved identification method such as IP address.
SV-233311r616544_ruleFor endpoints that require automated remediation, Forescout must be configured to redirect endpoints to a logically separate VLAN for remediation services.
SV-233312r615851_ruleIf a device requesting access fails Forescout policy assessment, Forescout must communicate with other components and the switch to either terminate the session or redirect the endpoint to the remediation subnet.
SV-233313r615864_ruleForescout must be configured to notify the user before proceeding with remediation of the user's endpoint device when automated remediation is used.
SV-233314r615869_ruleForescout must be configured so that all client machines are assessed by Forescout with exceptions that are allowed to bypass Forescout based on account or account type, as approved by the Information System Security Manager (ISSM) and documented in the System Security Plan (SSP).
SV-233315r611394_ruleForescout appliance must not be configured to implement a DHCP layer 3 method for separation or device authorization.
SV-233316r611394_ruleForescout must send an alert to the Information System Security Manager (ISSM) and System Administrator (SA), at a minimum, when critical security issues are found that put the network at risk.
SV-233317r611394_ruleWhen devices fail the policy assessment, Forescout must create a record with sufficient detail suitable for forwarding to a remediation server for automated remediation or sending to the user for manual remediation.
SV-233318r611394_ruleForescout must place client machines on the blacklist and terminate Forescout agent connection when critical security issues are found that put the network at risk.
SV-233319r611394_ruleForescout must be configured so client machines do not communicate with other network devices in the DMZ or subnet except as needed to perform a client assessment or to identify itself.
SV-233320r611394_ruleForescout must enforce the revocation of endpoint access authorizations when devices are removed from an authorization group.
SV-233321r611394_ruleForescout must enforce the revocation of endpoint access authorizations at the next compliance assessment interval based on changes to the compliance assessment security policy.
SV-233322r611394_ruleForescout must deny or restrict access for endpoints that fail critical endpoint security checks.
SV-233323r611394_ruleForescout must be configured to log records onto a centralized events server.
SV-233324r611394_ruleForescout must off-load log records onto a different system.
SV-233325r615865_ruleForescout must generate a critical alert to be sent to the Information System Security Officer (ISSO) and Systems Administrator (SA) (at a minimum) in the event of an audit processing failure.
SV-233326r615862_ruleForescout must authenticate all endpoint devices before establishing a connection and proceeding with posture assessment.
SV-233327r611394_ruleForescout must be configured to apply dynamic ACLs that restrict the use of ports when non-entity endpoints are connected using MAC Authentication Bypass (MAB).
SV-233328r615856_ruleForescout must reveal error messages only to the Information System Security Officer (ISSO), Information System Security Manager (ISSM), and System Administrator (SA).
SV-233329r615867_ruleForescout must configure TCP for the syslog protocol to allow for detection by the central event server if communications is lost.
SV-233330r616542_ruleForescout switch module must only allow a maximum of one registered MAC address per access port.
SV-233331r611394_ruleFor TLS connections, Forescout must automatically terminate the session when a client certificate is requested and the client does not have a suitable certificate.
SV-233332r611394_ruleForescout must use TLS 1.2, at a minimum, to protect the confidentiality of information passed between the endpoint agent and Forescout for the purposes of client posture assessment.
SV-233333r611394_ruleForescout that stores device keys must have a key management process that is FIPS-approved and protected by Advanced Encryption Standard (AES) block cipher algorithms.
SV-233334r611394_ruleCommunications between Forescout endpoint agent and the switch must transmit access authorization information via a protected path using a cryptographic mechanism.
SV-233335r616546_ruleForescout must generate a log record when the client machine fails policy assessment because required security software is missing or has been deleted.
SV-233336r616547_ruleForescout must be configured with a secondary log server, in case the primary log is unreachable.
SV-233337r611394_ruleForescout must perform continuous detection and tracking of endpoint devices attached to the network.
SV-233338r611394_ruleForescout must deny network connection for endpoints that cannot be authenticated using an approved method.
SV-233339r611394_ruleForescout must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the endpoint device.
SV-233340r615860_ruleWhen connecting with endpoints, Forescout must validate certificates used for Transport Layer Security (TLS) functions by performing RFC 5280-compliant certification path validation.