| Finding ID |
Severity |
Title |
Description |
|
V-76453
|
High |
Kona Site Defender must reveal error messages only to the ISSO, ISSM, and SCA. |
Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can give configuration details about the network element.
Limiting access to system logs and administrative consoles to authorized personnel will help to mitigate this risk.... |
|
V-76433
|
High |
Kona Site Defender providing user authentication intermediary services using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of protected sessions. |
Non-DoD approved PKIs have not been evaluated to ensure that they have security controls and identity vetting procedures in place that are sufficient for DoD systems to rely on the identity asserted in the certificate. PKIs lacking sufficient security controls and identity vetting procedures risk being compromised and issuing certificates... |
|
V-76431
|
High |
Kona Site Defender providing encryption intermediary services must use NIST FIPS-validated cryptography to implement encryption services. |
Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.
This requirement applies only to ALGs that... |
|
V-76427
|
High |
Kona Site Defender providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes. |
Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.
This requirement applies only to ALGs that... |
|
V-76401
|
High |
Kona Site Defender that provides intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52. |
NIST SP 800-52 provides guidance on using the most secure version and configuration of the TLS/SSL protocol. Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.
This requirement applies to TLS gateways (also known as... |
|
V-76393
|
High |
Kona Site Defender must immediately apply updates to the Kona Rule Set to block designated traffic of interest in response to new or emerging threats. |
Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events.
Changes to the ALG must take... |
|
V-76391
|
High |
Kona Site Defender must immediately use updates made to policy enforcement mechanisms to enforce that all traffic flows over HTTPS port 443. |
Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events.
Changes to the ALG must take... |
|
V-76455
|
Medium |
Kona Site Defender must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations. |
Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.
Access control policies and access control lists implemented on devices that control the flow of network traffic (e.g., application... |
|
V-76451
|
Medium |
Kona Site Defender must check the validity of all data inputs except those specifically identified by the organization. |
Invalid user input occurs when a user inserts data or characters into an application's data entry fields and the application is unprepared to process that data. This results in unanticipated application behavior, potentially leading to an application or information system compromise. Invalid input is one of the primary methods employed... |
|
V-76449
|
Medium |
Kona Site Defender providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected. |
Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.
The ALG generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should... |
|
V-76447
|
Medium |
Kona Site Defender providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources (e.g., IAVMs or CTOs) are detected. |
Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.
The ALG generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should... |
|
V-76445
|
Medium |
Kona Site Defender providing content filtering must send an alert to, at a minimum, the ISSO and ISSM when detection events occur. |
Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.
Since these incidents require immediate action, these messages are assigned a critical or Level 1 priority/severity, depending on the system's priority schema.... |
|
V-76443
|
Medium |
Kona Site Defender providing content filtering must continuously monitor inbound communications traffic crossing internal security boundaries for unusual or unauthorized activities or conditions. |
If inbound communications traffic is not continuously monitored, hostile activity may not be detected and prevented. Output from application and traffic monitoring serves as input to continuous monitoring and incident response programs.
Internal monitoring includes the observation of events occurring on the network that cross internal boundaries at managed interfaces... |
|
V-76439
|
Medium |
Kona Site Defender providing content filtering must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection. |
Without an alert, security personnel may be unaware of an impending failure of the audit capability. This will impede the ability to perform forensic analysis and detect rate-based and other anomalies.
The ALG generates an immediate (within seconds) alert that notifies designated personnel of the incident. Sending a message to... |
|
V-76437
|
Medium |
Kona Site Defender providing content filtering must block malicious code upon detection. |
Taking an appropriate action based on local organizational incident handling procedures minimizes the impact of malicious code on the network.
This requirement is limited to ALGs, web content filters, and packet inspection firewalls that perform malicious code detection as part of their functionality. |
|
V-76435
|
Medium |
Kona Site Defender providing content filtering must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures. |
Malicious code protection mechanisms include but are not limited to anti-virus and malware detection software. To minimize any potential negative impact to the organization caused by malicious code, malicious code must be identified and eradicated. Malicious code includes viruses, worms, trojan horses, and spyware. |
|
V-76429
|
Medium |
Kona Site Defender providing encryption intermediary services must implement NIST FIPS-validated cryptography for digital signatures. |
Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.
This requirement applies only to ALGs that... |
|
V-76425
|
Medium |
Kona Site Defender that provides intermediary services for HTTP must inspect inbound and outbound HTTP traffic for protocol compliance and protocol anomalies. |
Application protocol anomaly detection examines application layer protocols such as HTTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols.
Since protocol... |
|
V-76423
|
Medium |
Kona Site Defender providing content filtering must protect against known types of denial-of-service (DoS) attacks by employing signatures. |
If the network does not provide safeguards against DoS attacks, network resources may not be available to users during an attack.
Installation of content filtering gateways and application layer firewalls at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed... |
|
V-76421
|
Medium |
Kona Site Defender providing content filtering must protect against known and unknown types of denial-of-service (DoS) attacks by employing rate-based attack prevention behavior analysis. |
If the network does not provide safeguards against DoS attacks, network resources may not be available to users during an attack.
Installation of content filtering gateways and application layer firewalls at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed... |
|
V-76419
|
Medium |
Kona Site Defender must not strip origin-defined HTTP session headers. |
Lack of authentication enables anyone to gain access to the network or possibly a network element that provides the opportunity for intruders to compromise resources within the network infrastructure. By identifying and authenticating non-organizational users, their access to network resources can be restricted accordingly.
Non-organizational users will be uniquely identified... |
|
V-76415
|
Medium |
Kona Site Defender must off-load audit records onto a centralized log server. |
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
Off-loading is a common process in information systems with limited audit storage capacity.
This does not apply to audit logs generated on behalf of the device itself (management). |
|
V-76413
|
Medium |
To protect against data mining, Kona Site Defender providing content filtering as part of its intermediary services must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code. |
Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks launched against organizational applications may result in the compromise of information.
Injection attacks allow an attacker to inject code into a program or query or inject malware... |
|
V-76411
|
Medium |
To protect against data mining, Kona Site Defender providing content filtering must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields. |
Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks launched against organizational databases may result in the compromise of information.
SQL injection attacks are the most prevalent attacks against web applications and databases. These attacks inject... |
|
V-76409
|
Medium |
To protect against data mining, Kona Site Defender providing content filtering must detect code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields. |
Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks launched against organizational databases may result in the compromise of information.
Injection attacks allow an attacker to inject code into a program or query or inject malware... |
|
V-76407
|
Medium |
To protect against data mining, Kona Site Defender providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields. |
Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of information.
SQL injection attacks are the most prevalent attacks against web applications and... |
|
V-76405
|
Medium |
To protect against data mining, Kona Site Defender providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code. |
Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of information.
Injection attacks allow an attacker to inject code into a program or... |
|
V-76403
|
Medium |
To protect against data mining, Kona Site Defender providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields. |
Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of information.
Injection attacks allow an attacker to inject code into a program or... |
|
V-76399
|
Medium |
Kona Site Defender must immediately use updates made to policy enforcement mechanisms to allow traffic from organizationally defined IP addresses (i.e., IP whitelist). |
Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events.
Changes to the ALG must take... |
|
V-76397
|
Medium |
Kona Site Defender must immediately use updates made to policy enforcement mechanisms to block traffic from organizationally defined IP addresses (i.e., IP blacklist). |
Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events.
Changes to the ALG must take... |
|
V-76395
|
Medium |
Kona Site Defender must immediately use updates made to policy enforcement mechanisms to block traffic from organizationally defined geographic regions. |
Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events.
Changes to the ALG must take... |
|
V-76441
|
Low |
Kona Site Defender providing content filtering must be configured to integrate with a system-wide intrusion detection system. |
Without coordinated reporting between separate devices, it is not possible to identify the true scale and possible target of an attack.
Integration of the ALG with a system-wide intrusion detection system supports continuous monitoring and incident response programs. This requirement applies to monitoring at internal boundaries using TLS gateways, web... |
|
V-76417
|
Low |
Kona Site Defender must off-load audit records onto a centralized log server in real time. |
Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised.
Off-loading is a common process in information systems with limited audit storage capacity. The audit storage on the ALG is... |
