UCF STIG Viewer Logo

The IDPS must take corrective action when unauthorized mobile code is identified.


Overview

Finding ID Version Rule ID IA Controls Severity
SRG-NET-000229-IDPS-000182 SRG-NET-000229-IDPS-000182 SRG-NET-000229-IDPS-000182_rule Medium
Description
The mobile code paradigm encompasses programs that can be executed on one or several hosts other than the one they originate from. Mobility of such programs implies some built-in capability for each piece of code to travel smoothly from one host to another. Mobile code systems range from simple applets to intelligent software agents. These systems offer several advantages over the more traditional distributed computing approach. However, mobile code introduces risk to the IT infrastructure. Malicious mobile code is a vehicle to remotely install malware on a computer. This type of code can be transmitted through interactive Web applications such as ActiveX controls, Flash animation, or JavaScript. The code provides the ability for a malicious user to read from and write to files and folders on a computer's hard drive. They also have the ability to run and attach programs, which provides a high risk potential for the distribution of malicious mobile code. This code must be detected before it infiltrates the enclave. When detected, the IDPS must log and drop the traffic containing the mobile code.
STIG Date
IDPS Security Requirements Guide (SRG) 2012-03-08

Details

Check Text ( C-43327_chk )
Inspect the alerts configured on the IDS or IPS.
Verify the sensors are configured to take action (e.g., alert and/or log) detection of unauthorized mobile code.

If the IDPS is not configured take action when unauthorized mobile code is detected, this is a finding.
Fix Text (F-43327_fix)
Configure the sensors to take action (e.g., alerts to notify authorized users or block the traffic) when mobile code is detected.