| Identifying source address for information flows within the network allows forensic reconstruction of events when required, and increases policy compliance by attributing policy violations to specific individuals. Means to enforce this enhancement include ensuring the network device authenticates the source involved in sending information.
Network device policies or rules may be configured to allow a source subnet or IP address range, and a possible destination of ANY, but the monitoring, logging, and auditing mechanism must identify the specific source and destination IP addresses and ports/protocols and, if configured, the source and destination DNS.
Examples of information transfer for the network device are communications with the router, IPS, or central logging server. Without unique identifiers, the audit records of these information transfers would not be useful when tracking possible violations. This requirement is applicable to specific devices and does not involve the management of a network device. |
