The firewall implementation must monitor for unauthorized remote connections to specific information systems on an organizationally defined frequency.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000065-FW-000047	SRG-NET-000065-FW-000047	SRG-NET-000065-FW-000047_rule		Medium

Description
Remote access services enable users outside of the enclave to have access to data and services within the private network. In many instances these connections traverse the Internet. Monitoring of remote access sessions allows organizations to audit user activities and to ensure compliance with the remote access policy. Monitoring will ensure unauthorized access to the enclave's resources and data will not go undetected. The security zone connecting to the remote access gateway must be at a lower level than the security zone where the information systems reside. Access control lists can also be used to monitor (by logging all access) or restrict access to these systems.

Description

Remote access services enable users outside of the enclave to have access to data and services within the private network. In many instances these connections traverse the Internet. Monitoring of remote access sessions allows organizations to audit user activities and to ensure compliance with the remote access policy. Monitoring will ensure unauthorized access to the enclave's resources and data will not go undetected. The security zone connecting to the remote access gateway must be at a lower level than the security zone where the information systems reside. Access control lists can also be used to monitor (by logging all access) or restrict access to these systems.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000065-FW-000047_chk )
Review the access control lists or the security zones whose interface connects to a remote access gateway. Verify that access from the remote clients is monitored or restricted when making connections to specific information systems. If the firewall is not configured to monitor remote access traffic, this is a finding. If monitoring is not performed on an organizationally defined frequency, this is a finding.

Check Text ( C-SRG-NET-000065-FW-000047_chk )

Review the access control lists or the security zones whose interface connects to a remote access gateway.
Verify that access from the remote clients is monitored or restricted when making connections to specific information systems.

If the firewall is not configured to monitor remote access traffic, this is a finding. If monitoring is not performed on an organizationally defined frequency, this is a finding.

Fix Text (F-SRG-NET-000065-FW-000047_fix)
Configure access control lists to log or restrict access to specific information systems on an organizationally defined frequency. Another acceptable method would be to configure a lower level for the security zone to the interface where the remote access gateway is connected.