An Intrusion Detection and Prevention System (IDPS) sensor must be deployed to monitor all Demilitarized Zone (DMZ) segments housing public servers.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-18490	NET-IDPS-016	SV-20025r2_rule		Medium

Description
The initial step in IDPS deployment is determining where sensors should be placed. Because attacks originate at the enclave perimeter and within the enclave boundary an IDPS implementation at the enclave perimeter only will not suffice. By placing IDPS technology throughout the Enterprise Regional enclaves and stand-alone enclaves, system administrators can track the spread of attacks and take corrective actions to prevent attacks reaching critical resources.

Description

The initial step in IDPS deployment is determining where sensors should be placed. Because attacks originate at the enclave perimeter and within the enclave boundary an IDPS implementation at the enclave perimeter only will not suffice. By placing IDPS technology throughout the Enterprise Regional enclaves and stand-alone enclaves, system administrators can track the spread of attacks and take corrective actions to prevent attacks reaching critical resources.

STIG	Date
Network Infrastructure Policy Security Technical Implementation Guide	2017-12-07

Details

Check Text ( C-21124r2_chk )
Review the DMZ topology and verify public servers are being monitored by an IDPS. If an IDPS sensor is not deployed to monitor all DMZ segments housing public servers, this is a finding.

Fix Text (F-19077r1_fix)
Place an IDPS sensor in the enclave to monitor public servers.