The ALG used in a Cross Domain Solution (CDS) must apply information flow control to data transferred between security domains by means of a policy filter which consists of a set of hardware and/or software.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000019-ALG-000021	SRG-NET-000019-ALG-000021	SRG-NET-000019-ALG-000021_rule		Medium

Description
Information flow control regulates where information is allowed to travel within a network and between interconnected networks. The flow of all network traffic must be monitored and controlled so it does not introduce any unacceptable risk to the network infrastructure or data. Apply information flow control to data transferred between security domains by means of a set of hardware and/or software, collectively known as the “filter”. Flow control includes the inspection, sanitization, and/or rejection of data from one security domain prior to transfer of data to a different security domain. For an access type CDS, the remote desktop architecture provides the capability for a user to have access from a single device to computing platforms, applications, or data residing on multiple different security domains; while preventing any information flow between the different security domains.

Description

Information flow control regulates where information is allowed to travel within a network and between interconnected networks. The flow of all network traffic must be monitored and controlled so it does not introduce any unacceptable risk to the network infrastructure or data. Apply information flow control to data transferred between security domains by means of a set of hardware and/or software, collectively known as the “filter”. Flow control includes the inspection, sanitization, and/or rejection of data from one security domain prior to transfer of data to a different security domain. For an access type CDS, the remote desktop architecture provides the capability for a user to have access from a single device to computing platforms, applications, or data residing on multiple different security domains; while preventing any information flow between the different security domains.

STIG	Date
Application Layer Gateway Security Requirements Guide	2014-06-27

Details

Check Text ( C-SRG-NET-000019-ALG-000021_chk )
If the ALG is not used as part of a Cross Domain Solution (CDS), this is not a finding. Verify the CDS is configured to enforce approved authorizations for controlling the flow of information between interconnected systems in accordance based on organization-defined flow control policies. If the ALG is not configured to enforce approved authorizations for controlling the flow of information between interconnected systems in accordance based on organization-defined flow control policies, this is a finding.

Check Text ( C-SRG-NET-000019-ALG-000021_chk )

If the ALG is not used as part of a Cross Domain Solution (CDS), this is not a finding.

Verify the CDS is configured to enforce approved authorizations for controlling the flow of information between interconnected systems in accordance based on organization-defined flow control policies.

If the ALG is not configured to enforce approved authorizations for controlling the flow of information between interconnected systems in accordance based on organization-defined flow control policies, this is a finding.

Fix Text (F-SRG-NET-000019-ALG-000021_fix)
Configure the ALG to enforce approved authorizations for controlling the flow of information between interconnected systems in accordance based on organization-defined flow control policies.