The IDPS must automatically update malicious code protection mechanisms and signature definitions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000251-IDPS-000223	SRG-NET-000251-IDPS-000223	SRG-NET-000251-IDPS-000223_rule		Medium

Description
Malicious code includes viruses, worms, Trojan horses, and spyware. It can be transported by electronic mail, mail attachments, web accesses, removable media, or other common means. Malicious mobile code is a vehicle to remotely install malware on a computer. This type of code can be transmitted through interactive web applications such as ActiveX controls, Flash animation, or JavaScript. The code provides the ability for a malicious user to read from and write to files and folders on a computer's hard drive. They also have the ability to run and attach programs, which provides a high risk potential for the distribution of malicious mobile code. The black hats and malicious code writers continuously find new methods to attack hosts and the network infrastructure. It is imperative that new protection mechanisms developed to mitigate their risks must be installed as quickly as possible. For the IDPS, rules are also updated to detect attempts to exploit systems. Not updating the rule sets could lead to missed reconnaissance and malicious attacks.

Description

Malicious code includes viruses, worms, Trojan horses, and spyware. It can be transported by electronic mail, mail attachments, web accesses, removable media, or other common means. Malicious mobile code is a vehicle to remotely install malware on a computer. This type of code can be transmitted through interactive web applications such as ActiveX controls, Flash animation, or JavaScript. The code provides the ability for a malicious user to read from and write to files and folders on a computer's hard drive. They also have the ability to run and attach programs, which provides a high risk potential for the distribution of malicious mobile code. The black hats and malicious code writers continuously find new methods to attack hosts and the network infrastructure. It is imperative that new protection mechanisms developed to mitigate their risks must be installed as quickly as possible. For the IDPS, rules are also updated to detect attempts to exploit systems. Not updating the rule sets could lead to missed reconnaissance and malicious attacks.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43386_chk )
Connect to the IDPS management console using the GUI. Navigate to the "rules" configuration screen. Obtain a list of the rules currently in use. The latest new rules are often flagged by date or other indicator. Compare listing of the most recently downloaded "new" rules, with that obtained from the current version on the Patch Management server or the vendor site. If the system is not configured to automatically update malicious code protection mechanisms and signature definitions, this is a finding.

Check Text ( C-43386_chk )

Connect to the IDPS management console using the GUI.
Navigate to the "rules" configuration screen.
Obtain a list of the rules currently in use. The latest new rules are often flagged by date or other indicator.
Compare listing of the most recently downloaded "new" rules, with that obtained from the current version on the Patch Management server or the vendor site.

If the system is not configured to automatically update malicious code protection mechanisms and signature definitions, this is a finding.

Fix Text (F-43386_fix)
Installed the latest approved version of the vendor rules update for the detection of malicious code.