The IDPS must authenticate an organizationally defined list of specific devices by device type before establishing a connection.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34642	SRG-NET-000148-IDPS-00108	SV-45517r1_rule		Low

Description
An IDPS must have a level of trust with any node wanting to connect to it. Device authentication prevents an authorized user from connecting to perform privileged functions using a device which may contain security issues which may provide a vector for compromising the IDPS. Communications to the IDPS components must be carefully restricted. Today's devices may need to communicate with the firewall, router, SYSLOG server, other IDPS components, and management clients. This control requires the organization to define these devices specifically and to identify these approved devices by type (e.g., firewall, router, remote PC, etc.). Thus, the authentication decision must take the device type, not just the user's authorization into account when allowing access. For example, a system administrator may be authorized access; however, access must also be from an authorized device.

Description

An IDPS must have a level of trust with any node wanting to connect to it. Device authentication prevents an authorized user from connecting to perform privileged functions using a device which may contain security issues which may provide a vector for compromising the IDPS. Communications to the IDPS components must be carefully restricted. Today's devices may need to communicate with the firewall, router, SYSLOG server, other IDPS components, and management clients. This control requires the organization to define these devices specifically and to identify these approved devices by type (e.g., firewall, router, remote PC, etc.). Thus, the authentication decision must take the device type, not just the user's authorization into account when allowing access. For example, a system administrator may be authorized access; however, access must also be from an authorized device.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42866r1_chk )
Verify sensor communications to network elements (e.g., sensors, management consoles, routers, SYSLOG servers, and forensics servers) are configured to establish authentication using a unique identifier. Verify authentication is based on an organizationally defined list of authorized device types. If devices not included on the organizationally defined list are allowed to connect, this is a finding.

Check Text ( C-42866r1_chk )

Verify sensor communications to network elements (e.g., sensors, management consoles, routers, SYSLOG servers, and forensics servers) are configured to establish authentication using a unique identifier.
Verify authentication is based on an organizationally defined list of authorized device types.

If devices not included on the organizationally defined list are allowed to connect, this is a finding.

Fix Text (F-38914r1_fix)
Configure the IDPS to authenticate based on an organizationally defined list of authorized device types.