The IDPS must monitor for unauthorized remote connections to specific information systems on an organizationally defined frequency.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34531	SRG-NET-000065-IDPS-00055	SV-45373r1_rule		Medium

Description
Remote access services enable users outside of the enclave to have access to data and services within the private network. In many instances these connections traverse the Internet. Monitoring of remote access sessions allows organizations to audit user activities and to ensure compliance with the remote access policy. Monitoring will ensure unauthorized access to the enclave’s resources and data will not go undetected.

Description

Remote access services enable users outside of the enclave to have access to data and services within the private network. In many instances these connections traverse the Internet. Monitoring of remote access sessions allows organizations to audit user activities and to ensure compliance with the remote access policy. Monitoring will ensure unauthorized access to the enclave’s resources and data will not go undetected.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42722r1_chk )
Verify the IDPS sensors are configured with rules to monitor for remote access traffic, to ensure traffic from the communications gateway is monitored by the IDPS. If the IDPS is not configured to monitor remote access traffic, this is a finding. If monitoring is not performed on an organizationally defined frequency, this is a finding.

Fix Text (F-38770r1_fix)
Configure the IDPS sensors to monitor for unauthorized remote access traffic on an organizationally defined frequency.