The IDPS must uniquely identify source domains for information transfer.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34494	SRG-NET-000024-IDPS-00026	SV-45312r1_rule		Medium

Description
Identifying source and destination addresses for information flows within the network allows forensic reconstruction of events when required, and increases policy compliance by attributing policy violations to specific individuals. Means to enforce this enhancement include ensuring the network element distinguishes between information systems and organizations, and between specific system components or individuals involved in sending and receiving information. Examples of information transfer for the IDPS are the sensor log updating the base, sensor alerts, or commands to update the firewall or router ACLs. Without unique identifiers, the audit records of these information transfers would not be useful to tracking possible violations.

Description

Identifying source and destination addresses for information flows within the network allows forensic reconstruction of events when required, and increases policy compliance by attributing policy violations to specific individuals. Means to enforce this enhancement include ensuring the network element distinguishes between information systems and organizations, and between specific system components or individuals involved in sending and receiving information. Examples of information transfer for the IDPS are the sensor log updating the base, sensor alerts, or commands to update the firewall or router ACLs. Without unique identifiers, the audit records of these information transfers would not be useful to tracking possible violations.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42660r1_chk )
Verify the IDPS uses a unique identifier (e.g., IP address) for source domain to track and log information transfer sessions between the sensors and other network elements. View log entries to verify the information tracked includes a unique identifier for each IDPS component (e.g., management server, sensors, or other network elements involved in information transfer). If a unique identifier for each component is not logged for information transfer sessions, this is a finding.

Check Text ( C-42660r1_chk )

Verify the IDPS uses a unique identifier (e.g., IP address) for source domain to track and log information transfer sessions between the sensors and other network elements.
View log entries to verify the information tracked includes a unique identifier for each IDPS component (e.g., management server, sensors, or other network elements involved in information transfer).

If a unique identifier for each component is not logged for information transfer sessions, this is a finding.

Fix Text (F-38708r1_fix)
Configure the IDPS management console to log information transfer events. Configure the system, so each event record contains a unique identifier for component identification and session.