UCF STIG Viewer Logo

Application Layer Gateway (ALG) Security Requirements Guide (SRG)


Overview

Date Finding Count (150)
2015-06-30 CAT I (High): 0 CAT II (Med): 150 CAT III (Low): 0
STIG Description
The Application Layer Gateway (ALG) SRG is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the NIST 800-53 and related documents. Comments or proposed revisions to STIG or SRG documents should be sent to this email address: disa.stig_spt@mail.mil.

Available Profiles



Findings (MAC III - Administrative Public)

Finding ID Severity Title
V-54675 Medium The ALG providing content filtering must continuously monitor outbound communications traffic crossing internal security boundaries for unusual/unauthorized activities or conditions.
V-54677 Medium The ALG providing content filtering must send an alert to, at a minimum, the ISSO and ISSM when detection events occur.
V-54671 Medium The ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when unauthorized network services are detected.
V-54673 Medium The ALG providing content filtering must continuously monitor inbound communications traffic crossing internal security boundaries for unusual or unauthorized activities or conditions.
V-54679 Medium The ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources (e.g., IAVMs or CTOs) are detected.
V-54371 Medium To protect against data mining, the ALG providing content filtering must detect code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
V-54373 Medium To protect against data mining, the ALG providing content filtering as part of its intermediary services must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code.
V-54461 Medium The ALG that provides intermediary services for HTTP must inspect inbound and outbound HTTP traffic for protocol compliance and protocol anomalies.
V-54377 Medium The ALG must enforce approved authorizations for controlling the flow of information within the network based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.
V-54437 Medium The ALG must provide an immediate real-time alert to, at a minimum, the SCA and ISSO, of all audit failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.
V-54379 Medium The ALG must restrict or block harmful or suspicious communications traffic by controlling the flow of information between interconnected networks based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.
V-54469 Medium The ALG that is part of a CDS, when transferring information between different security domains, must use organization-defined data type identifiers to validate data essential for information flow decisions.
V-54407 Medium The ALG must generate audit records when successful/unsuccessful attempts to modify security levels occur.
V-54405 Medium The ALG must generate audit records when successful/unsuccessful attempts to modify security objects occur.
V-54435 Medium The ALG that is part of a CDS must have the capability to implement journaling.
V-54403 Medium The ALG providing user access control intermediary services must generate audit records when successful/unsuccessful attempts to modify privileges occur.
V-54401 Medium The ALG must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur.
V-54649 Medium The ALG must generate error messages that provide the information necessary for corrective actions without revealing information that could be exploited by adversaries.
V-54409 Medium The ALG must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur.
V-54433 Medium The ALG must off-load audit records onto a centralized log server in real time.
V-56199 Medium The ALG providing user access control intermediary services must provide a logoff capability for user-initiated communications sessions.
V-56197 Medium The ALG providing user access control intermediary services must automatically terminate a user session when organization-defined conditions or trigger events that require a session disconnect occur.
V-56195 Medium The ALG providing user access control intermediary services must retain the session lock until the user reestablishes access using established identification and authentication procedures.
V-54431 Medium The ALG must off-load audit records onto a centralized log server.
V-56193 Medium The ALG providing user access control intermediary services must provide the capability for users to directly initiate a session lock.
V-56191 Medium The ALG providing user access control intermediary services must initiate a session lock after a 15-minute period of inactivity.
V-54771 Medium To protect against data mining, the ALG providing content filtering must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
V-54773 Medium The ALG must fail to a secure state upon failure of initialization, shutdown, or abort actions.
V-54473 Medium The ALG that is part of a CDS, when transferring information between different security domains, must implement organization-defined security policy filters requiring fully enumerated formats that restrict data structure and content.
V-54471 Medium The ALG that is part of a CDS must decompose information into organization-defined, policy-relevant subcomponents for submission to policy enforcement mechanisms before transferring information between different security domains.
V-54477 Medium The ALG that is part of a CDS must prohibit the transfer of unsanctioned information in accordance with the security policy when transferring information between different security domains.
V-54369 Medium To protect against data mining, the ALG providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
V-54367 Medium To protect against data mining, the ALG providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.
V-54365 Medium To protect against data mining, the ALG providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
V-54363 Medium The ALG providing intermediary services for remote access communications traffic must provide the capability to immediately disconnect or disable remote access to the information system.
V-54361 Medium The ALG providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
V-54415 Medium The ALG providing user access control intermediary services must generate audit records when successful/unsuccessful logon attempts occur.
V-54417 Medium The ALG must produce audit records containing information to establish what type of events occurred.
V-54411 Medium The ALG providing user access control intermediary services must generate audit records when successful/unsuccessful attempts to delete privileges occur.
V-54413 Medium The ALG must generate audit records when successful/unsuccessful attempts to delete security levels occur.
V-54657 Medium The ALG providing content filtering must be configured to perform real-time scans of files from external sources at network entry/exit points as they are downloaded and prior to being opened or executed.
V-54655 Medium The ALG providing content filtering must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.
V-54419 Medium The ALG must produce audit records containing information to establish when (date and time) the events occurred.
V-54651 Medium The ALG must reveal error messages only to the ISSO, ISSM, and SCA.
V-54393 Medium The ALG providing user access control intermediary services for publicly accessible applications must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.
V-54391 Medium The ALG providing user access control intermediary services must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.
V-54397 Medium The ALG must generate audit records when successful/unsuccessful attempts to access security objects occur.
V-56189 Medium The ALG providing user access control intermediary services must conceal, via the session lock, information previously visible on the display with a publicly viewable image.
V-54395 Medium The ALG providing user access control intermediary services must generate audit records when successful/unsuccessful attempts to access privileges occur.
V-54399 Medium The ALG that is part of a CDS must generate audit records when successful/unsuccessful attempts to access security levels occur.
V-54769 Medium The ALG providing user access control intermediary services must provide the capability for authorized users to capture, record, and log all content related to a selected user session.
V-54763 Medium The ALG must generate audit records when successful/unsuccessful attempts to delete categories of information (e.g., classification levels) occur.
V-54761 Medium The ALG must generate audit records when successful/unsuccessful attempts to delete security objects occur.
V-54767 Medium The ALG providing user access control intermediary services must provide the capability for authorized users to select a user session to capture or view.
V-54765 Medium The ALG providing user access control intermediary services must generate audit records showing starting and ending time for user access to the system.
V-54623 Medium The ALG providing user authentication intermediary services using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of protected sessions.
V-54489 Medium The ALG that is part of a CDS must enforce information flow control based on organization-defined metadata.
V-54487 Medium The ALG that is part of a CDS must enforce dynamic traffic flow control based on organization-defined policies.
V-54485 Medium The ALG that is part of a CDS, when transferring information between different security domains, must apply the same security policy filtering to metadata as it applies to data payloads.
V-54483 Medium The ALG that is part of a CDS must bind security attributes to information using organization-defined binding techniques to facilitate information flow policy enforcement.
V-54481 Medium The ALG that is part of a CDS must uniquely identify and authenticate destination by organization, system, application, and/or individual for information transfer.
V-54421 Medium The ALG must produce audit records containing information to establish where the events occurred.
V-54423 Medium The ALG must produce audit records containing information to establish the source of the events.
V-54425 Medium The ALG must produce audit records containing information to establish the outcome of the events.
V-54427 Medium The ALG must generate audit records containing information to establish the identity of any individual or process associated with the event.
V-54429 Medium The ALG must be configured to support centralized management and configuration.
V-54621 Medium The ALG must generate unique session identifiers using a FIPS 140-2 approved random number generator.
V-54475 Medium The ALG that is part of a CDS, when transferring information between different security domains, must examine the information for the presence of organization-defined unsanctioned information.
V-54627 Medium The ALG must implement load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks.
V-54625 Medium In the event of a system failure of the ALG function, the ALG must save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted.
V-54385 Medium The ALG must immediately use updates made to policy enforcement mechanisms such as policy filters, rules, signatures, and analysis algorithms for gateway and/or intermediary functions.
V-54387 Medium The ALG that is part of a CDS must apply information flow control to data transferred between security domains by means of a policy filter which consists of a set of hardware and/or software.
V-54389 Medium The ALG providing user access control intermediary services must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.
V-54479 Medium The ALG that is part of a CDS must uniquely identify and authenticate source by organization, system, application, and/or individual for information transfer.
V-56203 Medium The ALG that stores secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.
V-56201 Medium The ALG providing user access control intermediary services must display an explicit logoff message to users indicating the reliable termination of authenticated communications sessions.
V-54551 Medium The ALG providing encryption intermediary services must use NIST FIPS-validated cryptography to implement encryption services.
V-54499 Medium The ALG must not have unnecessary services and functions enabled.
V-54495 Medium The ALG that is part of a CDS must enforce information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows.
V-54497 Medium The ALG that is part of a CDS must enforce the use of human reviews for organization-defined information flows under organization-defined conditions.
V-54491 Medium The ALG that is part of a CDS must block the transfer of data with malformed security attribute metadata structures.
V-54493 Medium The ALG that is part of a CDS must enforce organization-defined one-way information flows using hardware mechanisms.
V-54639 Medium The ALG must fail securely in the event of an operational failure.
V-54535 Medium The ALG providing user authentication intermediary services must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).
V-54533 Medium The ALG providing PKI-based user authentication intermediary services must map authenticated identities to the user account.
V-54531 Medium The ALG that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.
V-54439 Medium The ALG must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.
V-54631 Medium The ALG providing content filtering must protect against or limit the effects of known and unknown types of Denial of Service (DoS) attacks by employing pattern recognition pre-processors.
V-54633 Medium The ALG providing content filtering must protect against known types of Denial of Service (DoS) attacks by employing signatures.
V-54635 Medium The ALG providing content filtering must block outbound traffic containing known and unknown DoS attacks to protect against the use of internal information systems to launch any Denial of Service (DoS) attacks against other networks or endpoints.
V-54637 Medium The ALG must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
V-54629 Medium The ALG providing content filtering must protect against known and unknown types of Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis.
V-54465 Medium The ALG that is part of a CDS must allow privileged administrators to enable/disable all security policy filters used to enforce information flow control.
V-54337 Medium The ALG providing user access control intermediary services must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.
V-54659 Medium The ALG providing content filtering must block malicious code upon detection.
V-54467 Medium The ALG that is part of a CDS must allow privileged administrators to configure and make changes to all security policy filters that are used to enforce information flow control.
V-54543 Medium The ALG providing user authentication intermediary services must conform to FICAM-issued profiles.
V-54547 Medium The ALG providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes.
V-54545 Medium The ALG must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged session), the session must be terminated after 15 minutes of inactivity.
V-54375 Medium The ALG must enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies.
V-54549 Medium The ALG providing encryption intermediary services must implement NIST FIPS-validated cryptography for digital signatures.
V-54525 Medium The ALG providing user authentication intermediary services must transmit only encrypted representations of passwords.
V-54449 Medium The ALG must protect audit tools from unauthorized access.
V-54527 Medium The ALG must prohibit the use of cached authenticators after an organization-defined time period.
V-54521 Medium The ALG providing user authentication intermediary services must use multifactor authentication for network access to non-privileged accounts.
V-54523 Medium The ALG providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
V-54443 Medium The ALG must protect audit information from unauthorized read access.
V-54441 Medium The ALG must shut down by default upon audit failure (unless availability is an overriding concern).
V-54447 Medium The ALG must protect audit information from unauthorized deletion.
V-54529 Medium The ALG providing user authentication intermediary services using PKI-based user authentication must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.
V-54445 Medium The ALG must protect audit information from unauthorized modification.
V-54653 Medium The ALG providing content filtering must automatically update malicious code protection mechanisms.
V-54463 Medium The ALG that is part of a CDS must use source and destination security attributes associated with organization-defined information, source, and/or destination objects to enforce organization-defined information flow control policies as a basis for flow control decisions.
V-54511 Medium The ALG providing user authentication intermediary services must restrict user authentication traffic to specific authentication server(s).
V-54459 Medium The ALG that intermediary services for FTP must inspect inbound and outbound FTP communications traffic for protocol compliance and protocol anomalies.
V-54513 Medium The ALG providing user authentication intermediary services must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
V-54515 Medium The ALG providing user authentication intermediary services must implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
V-54451 Medium The ALG must protect audit tools from unauthorized modification.
V-54453 Medium The ALG must protect audit tools from unauthorized deletion.
V-54455 Medium The ALG must be configured in accordance with the security configuration settings based on DoD security policy and technology-specific security best practices.
V-54457 Medium The ALG that provides intermediary services for SMTP must inspect inbound and outbound SMTP and Extended SMTP communications traffic for protocol compliance and protocol anomalies.
V-54645 Medium The ALG must check the validity of all data inputs except those specifically identified by the organization.
V-54689 Medium The ALG that implements spam protection mechanisms must be updated automatically.
V-54647 Medium The ALG must behave in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.
V-54685 Medium The ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when denial of service incidents are detected.
V-54687 Medium The ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when new active propagation of malware infecting DoD systems or malicious code adversely affecting the operations and/or security of DoD systems is detected.
V-54681 Medium The ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when root level intrusion events which provide unauthorized privileged access are detected.
V-54683 Medium The ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when user level intrusions which provide non-privileged access are detected.
V-54357 Medium The ALG providing intermediary services for remote access communications traffic must use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.
V-54355 Medium The ALG providing intermediary services for remote access communications traffic must control remote access methods.
V-54353 Medium The ALG providing intermediary services for remote access communications traffic must ensure inbound and outbound traffic is monitored for compliance with remote access security policies.
V-54641 Medium The ALG must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
V-54609 Medium The ALG must detect, at a minimum, mobile code that is unsigned or exhibiting unusual behavior, has not undergone a risk assessment, or is prohibited for use based on a risk assessment.
V-54359 Medium The ALG that provides intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52.
V-54667 Medium The ALG providing content filtering must detect use of network services that have not been authorized or approved by the ISSM and ISSO, at a minimum.
V-54665 Medium The ALG providing content filtering must be configured to integrate with a system-wide intrusion detection system.
V-54663 Medium The ALG providing content filtering must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection.
V-54661 Medium The ALG providing content filtering must delete or quarantine malicious code in response to malicious code detection.
V-54509 Medium The ALG providing user authentication intermediary services must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
V-54507 Medium The ALG providing user access control intermediary services must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) which validate user account access authorizations and privileges.
V-54505 Medium The ALG providing user authentication intermediary services must require users to re-authenticate when organization-defined circumstances or situations require re-authentication.
V-54503 Medium The ALG must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
V-54669 Medium The ALG providing content filtering must generate a log record when unauthorized network services are detected.
V-54501 Medium The ALG must be configured to remove or disable unrelated or unneeded application proxy services.
V-54613 Medium The ALG providing content filtering must prevent the download of prohibited mobile code.
V-54611 Medium The ALG providing content filtering must block or restrict detected prohibited mobile code.
V-54643 Medium The ALG must identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems.
V-54617 Medium The ALG must invalidate session identifiers upon user logout or other session termination.
V-54615 Medium The ALG must protect the authenticity of communications sessions.
V-54619 Medium The ALG must recognize only system-generated session identifiers.