The IDPS must provide the capability for a privileged administrator to configure organizationally defined security policy filters to support different security policies.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34505	SRG-NET-000036-IDPS-00034	SV-45347r1_rule		Medium

Description

Each account should grant access to only those privileges the system administrator is authorized for. By not restricting system administrators to their proper privilege levels, access to restricted and advanced functions may be provided to system administrators not authorized or trained to use those functions. Network disruptions or outages could be caused by mistakes made by inexperienced system administrators. Monitoring account usage will reduce the risk of a privilege account being exploited by unauthorized persons and provides logging to be used for forensic investigation. Only accounts with the highest privilege level should have the authorization to configure security policy filters.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42697r1_chk )
View the account security policy functionality using the management console. Verify security policies exist that use security filters for managing account privileges and restrictions for administrator access to the management console and sensors. If the system does not have the capability to allow the use of security policy filters to support the security policies, this is a finding.

Fix Text (F-38743r1_fix)
Configure the system to provide the capability to configure organizationally defined security policy filters which can be used when creating security policies for user access control and privilege levels.