The firewall implementation must allow authorized administrators to enable/disable organizationally defined security policy filters.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000021-FW-000020	SRG-NET-000021-FW-000020	SRG-NET-000021-FW-000020_rule		Medium

Description
Organizationally defined security policy filters include dirty word filters, file type checking filters, structured data filters, unstructured data filters, metadata content filters, and hidden content filters. Configuration and enforcement of administrator privileges ensures only authorized users have access to certain commands and functions on the firewall. This control can be met by assigning the privilege to enable or disable security policy filters to privilege groups and then assigning users to these groups. Authorization to add, modify, or delete security policy filters must require the highest privilege level. If system administrators cannot be configured with different security privileges, then need-to-know cannot be enforced.

Description

Organizationally defined security policy filters include dirty word filters, file type checking filters, structured data filters, unstructured data filters, metadata content filters, and hidden content filters. Configuration and enforcement of administrator privileges ensures only authorized users have access to certain commands and functions on the firewall. This control can be met by assigning the privilege to enable or disable security policy filters to privilege groups and then assigning users to these groups. Authorization to add, modify, or delete security policy filters must require the highest privilege level. If system administrators cannot be configured with different security privileges, then need-to-know cannot be enforced.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000021-FW-000020_chk )
Verify only authorized firewall administrators have accounts capable of enabling or disabling security policy filters. If auditors or other restricted administrators have access to update ACLs or security policies, this is a finding.

Fix Text (F-SRG-NET-000021-FW-000020_fix)
Assign the privileges to enable and disable organizationally defined security policy filters to security groups. Assign only administrators who are authorized to perform enabling and disabling of security policy filters to these security groups.