The IDPS must authenticate devices before establishing network connections using bidirectional authentication between cryptographically based devices.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34645	SRG-NET-000151-IDPS-00110	SV-45520r1_rule		Medium

Description
This requirement is for device to device authentication between IDPS components and other network devices. Without authentication, an unauthorized device may connect to the IDPS and intercept monitored traffic, make configuration changes, or initiate man-in-the-middle attacks. Hence, it is imperative that authentication is bi-directional (mutual authentication) using cryptography to ensure a high level of trust and authenticity. Device authentication requires unique identification and authentication that may be defined by type, by specific device, or by a combination of type and device as deemed appropriate by the organization. The devices typically use either shared known information (e.g., Media Access Control [MAC] or Transmission Control Protocol/Internet Protocol [TCP/IP] addresses) for identification or an organizational authentication solution (e.g., IEEE 802.1x and Extensible Authentication Protocol [EAP], Radius server with EAP Transport Layer Security [TLS] authentication, Kerberos) to identify and authenticate devices on local area networks.

Description

This requirement is for device to device authentication between IDPS components and other network devices. Without authentication, an unauthorized device may connect to the IDPS and intercept monitored traffic, make configuration changes, or initiate man-in-the-middle attacks. Hence, it is imperative that authentication is bi-directional (mutual authentication) using cryptography to ensure a high level of trust and authenticity. Device authentication requires unique identification and authentication that may be defined by type, by specific device, or by a combination of type and device as deemed appropriate by the organization. The devices typically use either shared known information (e.g., Media Access Control [MAC] or Transmission Control Protocol/Internet Protocol [TCP/IP] addresses) for identification or an organizational authentication solution (e.g., IEEE 802.1x and Extensible Authentication Protocol [EAP], Radius server with EAP Transport Layer Security [TLS] authentication, Kerberos) to identify and authenticate devices on local area networks.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42869r1_chk )
Verify direct IDPS communications with network devices (e.g., firewall, router, sensors, or management console) are configured to establish bidirectional authentication before establishing communications. Verify the bidirectional authentication is between cryptographically based devices. If communication between the IDPS and network devices does not use bidirectional authentication, this is a finding. If device authentication is not established using cryptographically based devices, this is a finding.

Check Text ( C-42869r1_chk )

Verify direct IDPS communications with network devices (e.g., firewall, router, sensors, or management console) are configured to establish bidirectional authentication before establishing communications.
Verify the bidirectional authentication is between cryptographically based devices.

If communication between the IDPS and network devices does not use bidirectional authentication, this is a finding.
If device authentication is not established using cryptographically based devices, this is a finding.

Fix Text (F-38917r1_fix)
Configure the IDPS to require bidirectional authentication when communicating with network devices. Use cryptographically based devices to perform the bidirectional authentication.