Symantec ProxySG must identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-94329	SYMP-AG-000580	SV-104283r1_rule		Medium

Description
Without identifying the users who initiated the traffic, it would be difficult to identify those responsible for the denied communications. This requirement applies to network elements that perform Data Leakage Prevention (DLP) (e.g., ALGs, proxies, or application level firewalls).

STIG	Date
Symantec ProxySG ALG Security Technical Implementation Guide	2020-03-27

Details

Check Text ( C-93515r1_chk )
Verify that the ProxySG is configured to log user web traffic for auditing. 1. Log on to the Web Management Console. 2. Browse to "Configuration" and click "Access Logging". Verify that "Enable Access Logging" is checked. 3. Click Policy >> Visual Policy Manager >> Launch. 4. For each Web Access Layer, verify that each rule that has "Action" set to "Deny" and "Destination" defined as a restricted set of potentially threatening destinations has a value other than "none" in the "Track". If Symantec ProxySG does not identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems, this is a finding.

Check Text ( C-93515r1_chk )

Verify that the ProxySG is configured to log user web traffic for auditing.

1. Log on to the Web Management Console.
2. Browse to "Configuration" and click "Access Logging". Verify that "Enable Access Logging" is checked.
3. Click Policy >> Visual Policy Manager >> Launch.
4. For each Web Access Layer, verify that each rule that has "Action" set to "Deny" and "Destination" defined as a restricted set of potentially threatening destinations has a value other than "none" in the "Track".

If Symantec ProxySG does not identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems, this is a finding.

Fix Text (F-100445r1_fix)
Configure the ProxySG to log user web traffic for auditing. 1. Log on to the Web Management Console. 2. Browse to "Configuration" and click "Access Logging". Check the "Enable Access Logging" option and click "Apply". 3. Click Policy >> Visual Policy Manager >> Launch. 4. For each Web Access Layer, right-click the "Track" column for each rule that has "Action" set to "Deny" and "Destination" defined as a restricted set of potentially threatening destinations and select "Set". 5. Click "New" and select "Event Log".

Fix Text (F-100445r1_fix)

Configure the ProxySG to log user web traffic for auditing.

1. Log on to the Web Management Console.
2. Browse to "Configuration" and click "Access Logging". Check the "Enable Access Logging" option and click "Apply".
3. Click Policy >> Visual Policy Manager >> Launch.
4. For each Web Access Layer, right-click the "Track" column for each rule that has "Action" set to "Deny" and "Destination" defined as a restricted set of potentially threatening destinations and select "Set".
5. Click "New" and select "Event Log".