Symantec ProxySG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-94347	SYMP-AG-000670	SV-104301r1_rule		Medium

Description
Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The ALG generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema. CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The ALG must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

Description

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The ALG generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema. CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The ALG must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

STIG	Date
Symantec ProxySG ALG Security Technical Implementation Guide	2019-12-20

Details

Check Text ( C-93533r1_chk )
Verify that DoS events generate alerts to at least the ISSO and ISSM. 1. SSH into the ProxySG console and type "enable". 2. Enter the correct password and type "config". 3. Press "Enter" and type "show attack-detection configuration". 4. Verify that "client limits enabled" equals "true". 5. Log on to the Web Management Console. 6. Browse to Maintenance >> Event Logging and click the "Mail" tab. Verify that the ISSO and ISSM email addresses are specified. 7. Browse to Configuration >> Policy >> Visual Policy Manager. Click "Launch". 8. In each Web Access Layer, find rules that contain an "Action" of "Attack Detection". 9. Verify that the "Track" field of these rules is set to "Email" and that the "recipients" are set to at least the ISSO and ISSM. If Symantec ProxySG providing content filtering does not generate an alert to, at a minimum, the ISSO and ISSM when DoS incidents are detected, this is a finding.

Check Text ( C-93533r1_chk )

Verify that DoS events generate alerts to at least the ISSO and ISSM.

1. SSH into the ProxySG console and type "enable".
2. Enter the correct password and type "config".
3. Press "Enter" and type "show attack-detection configuration".
4. Verify that "client limits enabled" equals "true".
5. Log on to the Web Management Console.
6. Browse to Maintenance >> Event Logging and click the "Mail" tab. Verify that the ISSO and ISSM email addresses are specified.
7. Browse to Configuration >> Policy >> Visual Policy Manager. Click "Launch".
8. In each Web Access Layer, find rules that contain an "Action" of "Attack Detection".
9. Verify that the "Track" field of these rules is set to "Email" and that the "recipients" are set to at least the ISSO and ISSM.

If Symantec ProxySG providing content filtering does not generate an alert to, at a minimum, the ISSO and ISSM when DoS incidents are detected, this is a finding.

Fix Text (F-100463r2_fix)
Configure the ProxySG to email DoS attack detection/mitigation alerts to the ISSO and ISSM. 1. SSH into the ProxySG console and type "enable". 2. Enter the correct password and type "config". 3. Press "Enter" and type "attack-detection". 4. See the ProxySG Administration Guide, Chapter 73: Preventing Denial of Service Attacks, to understand the functionality before proceeding. 5. Type "client" and press "Enter". Type "enable-limits" and press "Enter". 6. Log on to the Web Management Console. 7. Browse to Maintenance >> Event Logging and click the "Mail" tab. Ensure that the ISSO and ISSM email addresses are specified. 8. Browse to Configuration >> Policy >> Visual Policy Manager. Click "Launch". 9. In one Web Access Layer, create a new rule. Right-click the "Action" of that rule and select "Set". Click "New" and select "Set Attack Detection". Provide a "Failure Weight" per local security policy requirements. 10. Click "OK" and click "OK" again. 11. Right-click the "Track" column for this rule and select "Set". Click "New" and select "Email". 12. Select "Custom Recipients" and click "Configure Custom Recipients Lists". 13. Click "New," provide a name for the list, and enter the ISSO and ISSM email addresses in the "List Members" field. 14. Click "OK" and click "OK" again. Create message text and click "OK". 15. Click "OK" and click "OK" again. Select File >> Install Policy on SG Appliance.

Fix Text (F-100463r2_fix)

Configure the ProxySG to email DoS attack detection/mitigation alerts to the ISSO and ISSM.

1. SSH into the ProxySG console and type "enable".
2. Enter the correct password and type "config".
3. Press "Enter" and type "attack-detection".
4. See the ProxySG Administration Guide, Chapter 73: Preventing Denial of Service Attacks, to understand the functionality before proceeding.
5. Type "client" and press "Enter". Type "enable-limits" and press "Enter".
6. Log on to the Web Management Console.
7. Browse to Maintenance >> Event Logging and click the "Mail" tab. Ensure that the ISSO and ISSM email addresses are specified.
8. Browse to Configuration >> Policy >> Visual Policy Manager. Click "Launch".
9. In one Web Access Layer, create a new rule. Right-click the "Action" of that rule and select "Set". Click "New" and select "Set Attack Detection". Provide a "Failure Weight" per local security policy requirements.
10. Click "OK" and click "OK" again.
11. Right-click the "Track" column for this rule and select "Set". Click "New" and select "Email".
12. Select "Custom Recipients" and click "Configure Custom Recipients Lists".
13. Click "New," provide a name for the list, and enter the ISSO and ISSM email addresses in the "List Members" field.
14. Click "OK" and click "OK" again. Create message text and click "OK".
15. Click "OK" and click "OK" again. Select File >> Install Policy on SG Appliance.