The firewall implementation must verify the correct operation of security functions, in accordance with organizationally defined conditions and frequency.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000267-FW-000154	SRG-NET-000267-FW-000154	SRG-NET-000267-FW-000154_rule		Medium

Description
Security functional testing involves testing the system for conformance to the application's security function specifications, as well as, compliance with the underlying security model. The need to verify security functionality applies to all security functions. For those security functions that are not able to execute automated self-tests, the organization either implements compensating security controls or explicitly accepts the risk of not performing the verification as required. System initialization, shutdown, and aborts must be configured to ensure the system remains in a secure state. If tests are not provided and periodically run, the integrity of the system state cannot be verified.

Description

Security functional testing involves testing the system for conformance to the application's security function specifications, as well as, compliance with the underlying security model. The need to verify security functionality applies to all security functions. For those security functions that are not able to execute automated self-tests, the organization either implements compensating security controls or explicitly accepts the risk of not performing the verification as required. System initialization, shutdown, and aborts must be configured to ensure the system remains in a secure state. If tests are not provided and periodically run, the integrity of the system state cannot be verified.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000267-FW-000154_chk )
Review the firewall vendor documentation and system configuration to determine if the correct operation of security functions, in accordance with organizationally defined conditions and frequency, is verified. If the correct operation of organizationally defined security functions cannot be verified, this is a finding.

Fix Text (F-SRG-NET-000267-FW-000154_fix)
Configure the firewall implementation to verify the correct operation of security functions in accordance with organizationally defined conditions and frequency.