The IDPS must enforce information flow control on metadata.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000280-IDPS-000052	SRG-NET-000280-IDPS-000052	SRG-NET-000280-IDPS-000052_rule		Medium

Description
Metadata is defined as data providing information about one or more pieces of data such as purpose of the data, author or creator of the data, network location of where data was created, and network specific information. Information flow control regulates where information is allowed to travel within a network and between hosts as opposed to who is allowed to access the information. Information flow enforcement mechanisms compare security attributes on all information such as source and destination objects, and respond appropriately (e.g., block, quarantine, alert administrator) when the mechanisms encounter information flows not explicitly allowed by the information flow policy. This is a network architecture best practice and does not require a configuration setting on the IDS or IPS sensor.

Description

Metadata is defined as data providing information about one or more pieces of data such as purpose of the data, author or creator of the data, network location of where data was created, and network specific information. Information flow control regulates where information is allowed to travel within a network and between hosts as opposed to who is allowed to access the information. Information flow enforcement mechanisms compare security attributes on all information such as source and destination objects, and respond appropriately (e.g., block, quarantine, alert administrator) when the mechanisms encounter information flows not explicitly allowed by the information flow policy. This is a network architecture best practice and does not require a configuration setting on the IDS or IPS sensor.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43179_chk )
Verify rules are created to examine and block packet with malformed or otherwise disallowed metadata. If a rule or signature does not exist which examines metadata, this is a finding.

Fix Text (F-43179_fix)
Download a vendor signature or create a rule which examines metadata.