If a device requesting access fails Forescout policy assessment, Forescout must communicate with other components and the switch to either terminate the session or redirect the endpoint to the remediation subnet.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-233312	FORE-NC-000040	SV-233312r615851_rule		High

Description
Endpoints with identified security flaws and weaknesses endanger the network and other devices on it. Isolation or termination prevents traffic from flowing with traffic from endpoints that have been fully assessed and authorized.

STIG	Date
Forescout Network Access Control Security Technical Implementation Guide	2020-12-11

Details

Check Text ( C-36507r615850_chk )
Verify Forescout is configured to filter the policy assessment devices based on risk and are remediated accordingly based on local SSP. Verify filters for the policy assessment devices are set to take remediation actions. 1. In the Forescout UI, go to the Policy Tab >> Compliance Policies. 2. Verify the action within the Compliance Policies is configured with one of the following actions: - Terminate the connection and place the device on a "blacklist" to prevent future connection attempts until action is taken to remove the device from the blacklist. - Redirect traffic from the remote endpoint to the automated remediation subnet for connection to the remediation server. - Allow the device access to limited network services such as public web servers in the protected DMZ (must be approved by the AO). - Allow the device and user full entry into the protected networks but flag it for future remediation. With this option, an automated reminder should be used to inform the user of the remediation status. If Forescout does not communicate with the remote access gateway to implement a policy to either terminate the session or redirect the session for endpoint remediation, this is a finding.

Check Text ( C-36507r615850_chk )

Verify Forescout is configured to filter the policy assessment devices based on risk and are remediated accordingly based on local SSP. Verify filters for the policy assessment devices are set to take remediation actions.

1. In the Forescout UI, go to the Policy Tab >> Compliance Policies.
2. Verify the action within the Compliance Policies is configured with one of the following actions:
- Terminate the connection and place the device on a "blacklist" to prevent future connection attempts until action is taken to remove the device from the blacklist.
- Redirect traffic from the remote endpoint to the automated remediation subnet for connection to the remediation server.
- Allow the device access to limited network services such as public web servers in the protected DMZ (must be approved by the AO).
- Allow the device and user full entry into the protected networks but flag it for future remediation. With this option, an automated reminder should be used to inform the user of the remediation status.

If Forescout does not communicate with the remote access gateway to implement a policy to either terminate the session or redirect the session for endpoint remediation, this is a finding.

Fix Text (F-36472r605640_fix)
Configure Forescout policy to take remediation actions on endpoints with risk. 1. In the Forescout UI, go to the Policy Tab >> Compliance Policies. 2. Select a policy, then click Edit. 3. Configure the Compliance Policies to include any of the following actions: - Terminate the connection and place the device on a "blacklist" to prevent future connection attempts until action is taken to remove the device from the blacklist. - Redirect traffic from the remote endpoint to the automated remediation subnet for connection to the remediation server. - Allow the device access to limited network services such as public web servers in the protected DMZ (must be approved by the AO). - Allow the device and user full entry into the protected networks but flag it for future remediation. With this option, an automated reminder must be used to inform the user of the remediation status.

Fix Text (F-36472r605640_fix)

Configure Forescout policy to take remediation actions on endpoints with risk.

1. In the Forescout UI, go to the Policy Tab >> Compliance Policies.
2. Select a policy, then click Edit.
3. Configure the Compliance Policies to include any of the following actions:
- Terminate the connection and place the device on a "blacklist" to prevent future connection attempts until action is taken to remove the device from the blacklist.
- Redirect traffic from the remote endpoint to the automated remediation subnet for connection to the remediation server.
- Allow the device access to limited network services such as public web servers in the protected DMZ (must be approved by the AO).
- Allow the device and user full entry into the protected networks but flag it for future remediation. With this option, an automated reminder must be used to inform the user of the remediation status.