If an automated scheduler is used to provide updates to the sensors, an account on the file server must be defined that will provide access to the signatures only to the sensors.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-18507	NET-IDPS-030	SV-20042r2_rule		Medium

Description
In a large scale IDPS deployment, it is common to have an automated update process implemented. This is accomplished by having the updates downloaded on a dedicated secure file server within the management network. The file server should be configured to allow read-only access to the files within the directory on which the signature packs are placed, and then only from the account that the sensors will use. The sensors can then be configured to automatically check the secure file server periodically to look for the new signature packs and to update themselves.

Description

In a large scale IDPS deployment, it is common to have an automated update process implemented. This is accomplished by having the updates downloaded on a dedicated secure file server within the management network. The file server should be configured to allow read-only access to the files within the directory on which the signature packs are placed, and then only from the account that the sensors will use. The sensors can then be configured to automatically check the secure file server periodically to look for the new signature packs and to update themselves.

STIG	Date
Network Infrastructure Policy Security Technical Implementation Guide	2016-12-22

Details

Check Text ( C-21208r2_chk )
Review the file server accounts and determine if the accounts with read access to the IDPS signatures are provided only to the IDPS sensors. If there are accounts other than those allocated for the IDPS sensors providing access to the signatures, this is a finding.

Fix Text (F-19098r1_fix)
Secure the signatures from access to accounts for IDS updates.