Forescout must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-230959	FORE-NM-000330	SV-230959r615886_rule		High

Description
To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable unused or unnecessary physical and logical ports/protocols on information systems. Forescout is capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. Wireless is an example only of a service that is frequently unnecessary in many Forescout implementations. Reword more generically and be sure to look for module that are not part of the UC ACL default and may have been installed by the site and therefore are not authorized for use in DoD.

Description

To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable unused or unnecessary physical and logical ports/protocols on information systems. Forescout is capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. Wireless is an example only of a service that is frequently unnecessary in many Forescout implementations. Reword more generically and be sure to look for module that are not part of the UC ACL default and may have been installed by the site and therefore are not authorized for use in DoD.

STIG	Date
Forescout Network Device Management Security Technical Implementation Guide	2020-12-11

Details

Check Text ( C-33889r603716_chk )
Navigate to the plugin tool and remove all unneeded or unsecure services. 1. Connect to the Forescout Console and select Tools >> Options >> Plugins. 2. Review the list of plugins. If an unnecessary or nonsecure service is "Enabled", select the plugin and then select "Configure". If no configuration is present, this is a finding. If any unnecessary or nonsecure functions are enabled, this is a finding.

Check Text ( C-33889r603716_chk )

Navigate to the plugin tool and remove all unneeded or unsecure services.

1. Connect to the Forescout Console and select Tools >> Options >> Plugins.
2. Review the list of plugins. If an unnecessary or nonsecure service is "Enabled", select the plugin and then select "Configure".

If no configuration is present, this is a finding.

If any unnecessary or nonsecure functions are enabled, this is a finding.

Fix Text (F-33862r603717_fix)
Configure the network device to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services. The following is an example of disabling the wireless plugin if no wireless devices are directly managed by Forescout. Example ONLY: 1. Connect to the Forescout Console and select Tools >> Options >> Modules >> Network. 2. Determine if the wireless plugin is running. If it is running, click the option and click "Stop". If the user is logged in to the enterprise manager, this will stop it on all the appliances in the enterprise. This process can be used to disable or remove plugins not being used.

Fix Text (F-33862r603717_fix)

Configure the network device to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services. The following is an example of disabling the wireless plugin if no wireless devices are directly managed by Forescout.

Example ONLY:

1. Connect to the Forescout Console and select Tools >> Options >> Modules >> Network.
2. Determine if the wireless plugin is running. If it is running, click the option and click "Stop". If the user is logged in to the enterprise manager, this will stop it on all the appliances in the enterprise.

This process can be used to disable or remove plugins not being used.