The firewall implementation must provide mechanisms to protect the authenticity of communications sessions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000230-FW-000143	SRG-NET-000230-FW-000143	SRG-NET-000230-FW-000143_rule		Low

Description
This requirement addresses communications protection at the session, versus packet level (e.g., sessions in service-oriented architectures providing web-based services). Maintaining the authenticity of the communications session and confidence in the mutual ongoing identity of both communicating entities, the information being transmitted may be malicious or invalid. Authenticity protection includes protecting against man-in-the-middle attacks (i.e., session hijacking) and guarding against the insertion of false information into sessions.

Description

This requirement addresses communications protection at the session, versus packet level (e.g., sessions in service-oriented architectures providing web-based services). Maintaining the authenticity of the communications session and confidence in the mutual ongoing identity of both communicating entities, the information being transmitted may be malicious or invalid. Authenticity protection includes protecting against man-in-the-middle attacks (i.e., session hijacking) and guarding against the insertion of false information into sessions.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000230-FW-000143_chk )
Verify the application uses session authentication mechanisms (e.g., error checking, source and destination verification, and session identification). If mechanisms are not provided to protect the authenticity of communications sessions between the firewall and other network elements, this is a finding.

Fix Text (F-SRG-NET-000230-FW-000143_fix)
Configure the firewall implementation to require session authentication mechanisms (e.g., error checking, source and destination verification, and session identification) when communicating.