The firewall implementation must monitor for unauthorized remote connections to specific information systems on an organizationally defined frequency.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-37089	SRG-NET-000065-FW-000045	SV-48850r1_rule		Medium

Description
Remote access is access to organizational information systems by users (or processes acting on behalf of users) communicating through external networks (e.g., the Internet). Remote access methods include, dial-up, broadband, and wireless. Virtual private networks (VPNs), when adequately provisioned with appropriate security controls, are considered internal networks, rather than a remote access method. Monitoring will ensure unauthorized access to the enclave's resources and data will not go undetected. The security zone connecting to the remote access gateway must be at a lower level than the security zone where the information systems reside. Access control lists can also be used to monitor (by logging all access) or restrict access to these systems.

Description

Remote access is access to organizational information systems by users (or processes acting on behalf of users) communicating through external networks (e.g., the Internet). Remote access methods include, dial-up, broadband, and wireless. Virtual private networks (VPNs), when adequately provisioned with appropriate security controls, are considered internal networks, rather than a remote access method. Monitoring will ensure unauthorized access to the enclave's resources and data will not go undetected. The security zone connecting to the remote access gateway must be at a lower level than the security zone where the information systems reside. Access control lists can also be used to monitor (by logging all access) or restrict access to these systems.

STIG	Date
Firewall Security Requirements Guide	2013-04-24

Details

Check Text ( C-45628r1_chk )
Review the access control lists or the security zones whose interface connects to a remote access gateway. Verify that access from the remote clients is monitored or restricted when making connections to specific information systems. If the firewall implementation is not configured to monitor remote access traffic, this is a finding. If monitoring is not performed on an organizationally defined frequency, this is a finding.

Check Text ( C-45628r1_chk )

Review the access control lists or the security zones whose interface connects to a remote access gateway.
Verify that access from the remote clients is monitored or restricted when making connections to specific information systems.

If the firewall implementation is not configured to monitor remote access traffic, this is a finding. If monitoring is not performed on an organizationally defined frequency, this is a finding.

Fix Text (F-42425r1_fix)
Configure access control lists to log or restrict access to specific information systems on an organizationally defined frequency. Another acceptable method would be to configure a lower level for the security zone to the interface where the remote access gateway is connected.