The Bromium Enterprise Controller (BEC) must forward an event to the central log server when isolation is disabled on any protected Bromium vSentry client.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-80479	BROM-00-001305	SV-95187r1_rule		High

Description
Disabling isolation on the endpoint is a potential indicator of compromise of insider threat. In production deployments, the ability to disable Bromium isolation is not available to non-privileged users.

STIG	Date
Bromium Secure Platform 4.x Security Technical Implementation Guide	2018-05-11

Details

Check Text ( C-80155r1_chk )
Verify that a syslog destination is configured on the BEC server. 1. From the management console, click on the selection arrow next to "Events". 2. Click on "Destinations". 3. Inspect the list of configured syslog destinations. 4. Verify that the Severity level for the source Isolation Host is minimally set to "Warning". If the Bromium monitoring module installed on the BEC or Bromium vSentry does not generate an event and forward to the events server when anomalies in the operation of the application are discovered, this is a finding.

Check Text ( C-80155r1_chk )

Verify that a syslog destination is configured on the BEC server.

1. From the management console, click on the selection arrow next to "Events".
2. Click on "Destinations".
3. Inspect the list of configured syslog destinations.
4. Verify that the Severity level for the source Isolation Host is minimally set to "Warning".

If the Bromium monitoring module installed on the BEC or Bromium vSentry does not generate an event and forward to the events server when anomalies in the operation of the application are discovered, this is a finding.

Fix Text (F-87289r1_fix)
Configure the BEC server to automatically forward events to the desired syslog destination. 1. From the management console, click on the selection arrow next to "Events". 2. Click on "Destinations". 3. Click on "Add Syslog Destination". 4. Configure syslog server parameters and verify that the Severity level for the source Isolation Host is minimally set to "Warning". 5. Click "Save". Additional syslog destinations may be configured for forwarding events to multiple destinations simultaneously.

Fix Text (F-87289r1_fix)

Configure the BEC server to automatically forward events to the desired syslog destination.

1. From the management console, click on the selection arrow next to "Events".
2. Click on "Destinations".
3. Click on "Add Syslog Destination".
4. Configure syslog server parameters and verify that the Severity level for the source Isolation Host is minimally set to "Warning".
5. Click "Save".

Additional syslog destinations may be configured for forwarding events to multiple destinations simultaneously.