The IDPS must enforce information flow control on metadata.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34664	SRG-NET-000280-IDPS-00202	SV-45539r1_rule		Medium

Description
Metadata is information about one or more pieces of data. This may include information about the data's purpose, creator, origin, or classification. Information flow control regulates where information is allowed to travel within a network and between hosts as opposed to who is allowed to access the information. Information flow enforcement mechanisms compare security attributes on all information such as source and destination objects, and respond appropriately (e.g., block, quarantine, alert administrator) when the mechanisms encounter information flows not explicitly allowed by the information flow policy. This is a network architecture best practice and does not require a configuration setting on the IDPS sensor.

Description

Metadata is information about one or more pieces of data. This may include information about the data's purpose, creator, origin, or classification. Information flow control regulates where information is allowed to travel within a network and between hosts as opposed to who is allowed to access the information. Information flow enforcement mechanisms compare security attributes on all information such as source and destination objects, and respond appropriately (e.g., block, quarantine, alert administrator) when the mechanisms encounter information flows not explicitly allowed by the information flow policy. This is a network architecture best practice and does not require a configuration setting on the IDPS sensor.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42888r1_chk )
Verify rules are created to examine and block packet with malformed or otherwise disallowed metadata. If a rule or signature does not exist which examines metadata, this is a finding.

Fix Text (F-38936r1_fix)
Download a vendor signature or create a rule which examines metadata.