The IDPS must be configured to enable automated mechanisms to support auditing of the enforcement actions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34604	SRG-NET-000120-IDPS-00087	SV-45470r1_rule		Medium

Description
Changes to the hardware or software components of the IDPS can have significant effects on the overall security of the network. Therefore, only qualified and authorized individuals are allowed administrative access to the IDPS for implementing any changes or upgrades. Additionally, maintaining automated log records of access is essential for ensuring configuration change control is being implemented, as intended, and for supporting after-the-fact actions should the organization become aware of an unauthorized change to the information system.

Description

Changes to the hardware or software components of the IDPS can have significant effects on the overall security of the network. Therefore, only qualified and authorized individuals are allowed administrative access to the IDPS for implementing any changes or upgrades. Additionally, maintaining automated log records of access is essential for ensuring configuration change control is being implemented, as intended, and for supporting after-the-fact actions should the organization become aware of an unauthorized change to the information system.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42820r1_chk )
Verify automated mechanisms such as logging and restricting configuration changes and updates for both hardware and software are in place. If auditing of access control restrictions for hardware and software updates is not enabled, this is a finding.

Fix Text (F-38868r1_fix)
Enable auditing of access restrictions to hardware and software updates.