UCF STIG Viewer Logo

The Network IDPS administrator will review whitelists and blacklists regularly and validate all entries to ensure that they are still accurate and necessary.


Overview

Finding ID Version Rule ID IA Controls Severity
V-18502 NET-IDPS-005 SV-20037r1_rule DCSW-1 Medium
Description
A blacklist is a list of discrete entities, such as hosts, TCP or UDP port numbers, ICMP types and codes, applications, usernames, URLs, filenames, or file extensions, that have been previously determined to be associated with malicious activity. Blacklists, also known as hot lists, are typically used to allow IDPSs to recognize and block activity that is highly likely to be malicious, and may also be used to assign a higher priority to alerts that match entries on the blacklists. Some IDPSs generate dynamic blacklists that are used to temporarily block recently detected threats (e.g., activity from an attacker’s IP address). A whitelist is a list of discrete entities that are known to be benign. Whitelists are typically used on a granular basis, such as protocol-by-protocol, to reduce or ignore false positives involving known benign activity from trusted hosts. Whitelists and blacklists are most commonly used in signature-based detection and stateful protocol analysis.
STIG Date
IDS/IPS Security Technical Implementation Guide 2013-10-08

Details

Check Text ( C-21189r1_chk )
Review the Whitelists and Blacklists used by the IDPS and interview the SA to determine when the last update occurred. These lists are updated frequently by the vendor.
Fix Text (F-19093r1_fix)
Create a periodic update schedule to review the Whitelists and Blacklist.