The firewall implementation must verify the correct operation of security functions, in accordance with organizationally identified conditions and frequency.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-37316	SRG-NET-000267-FW-000146	SV-49077r1_rule		Medium

Description
Security functional testing involves testing the system for conformance to the application's security function specifications, as well as, compliance with the underlying security model. The need to verify security functionality applies to all security functions. For those security functions that are not able to execute automated self-tests, the organization either implements compensating security controls or explicitly accepts the risk of not performing the verification as required. System initialization, shutdown, and aborts must be configured to ensure the system remains in a secure state. If tests are not provided and periodically run, the integrity of the system state cannot be verified.

Description

Security functional testing involves testing the system for conformance to the application's security function specifications, as well as, compliance with the underlying security model. The need to verify security functionality applies to all security functions. For those security functions that are not able to execute automated self-tests, the organization either implements compensating security controls or explicitly accepts the risk of not performing the verification as required. System initialization, shutdown, and aborts must be configured to ensure the system remains in a secure state. If tests are not provided and periodically run, the integrity of the system state cannot be verified.

STIG	Date
Firewall Security Requirements Guide	2013-04-24

Details

Check Text ( C-45564r1_chk )
Obtain the organization's list of identified self-tests (or other organizationally identified tests). Verify these tests are performed in accordance with the organizationally defined conditions and frequency. If the correct operation of organizationally identified security functions is not performed in accordance with the organizationally defined conditions and frequency, this is a finding.

Fix Text (F-42241r1_fix)
Configure the firewall implementation to verify the correct operation of security functions in accordance with organizationally defined conditions and frequency.