What changed in Akamai KSD Service Impact Level 2 ALG STIG V1R2V1R2 changes

Akamai KSD Service Impact Level 2 ALG STIG V1R2 (2026-09-30) replaced V1R1 (2017-09-12): 33 checks added, 33 removed. It has 33 checks, against 33 in V1R1.

V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare

  • 33 added
  • 33 removed
  • 0 updated

Added in V1R2 (33)

  • V-237104CAT IKona Site Defender must immediately use updates made to policy enforcement mechanisms to enforce that all traffic flows over HTTPS port 443.
  • V-237105CAT IKona Site Defender must immediately apply updates to the Kona Rule Set to block designated traffic of interest in response to new or emerging threats.
  • V-237106CAT IIKona Site Defender must immediately use updates made to policy enforcement mechanisms to block traffic from organizationally defined geographic regions.
  • V-237107CAT IIKona Site Defender must immediately use updates made to policy enforcement mechanisms to block traffic from organizationally defined IP addresses (i.e., IP blacklist).
  • V-237108CAT IIKona Site Defender must immediately use updates made to policy enforcement mechanisms to allow traffic from organizationally defined IP addresses (i.e., IP whitelist).
  • V-237109CAT IKona Site Defender that provides intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52.
  • V-237110CAT IITo protect against data mining, Kona Site Defender providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
  • V-237111CAT IITo protect against data mining, Kona Site Defender providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.
  • V-237112CAT IITo protect against data mining, Kona Site Defender providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
  • V-237113CAT IITo protect against data mining, Kona Site Defender providing content filtering must detect code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
  • V-237114CAT IITo protect against data mining, Kona Site Defender providing content filtering must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
  • V-237115CAT IITo protect against data mining, Kona Site Defender providing content filtering as part of its intermediary services must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code.
  • V-237116CAT IIKona Site Defender must off-load audit records onto a centralized log server.
  • V-237117CAT IIIKona Site Defender must off-load audit records onto a centralized log server in real time.
  • V-237118CAT IIKona Site Defender must not strip origin-defined HTTP session headers.
  • V-237119CAT IIKona Site Defender providing content filtering must protect against known and unknown types of denial-of-service (DoS) attacks by employing rate-based attack prevention behavior analysis.
  • V-237120CAT IIKona Site Defender providing content filtering must protect against known types of denial-of-service (DoS) attacks by employing signatures.
  • V-237121CAT IIKona Site Defender that provides intermediary services for HTTP must inspect inbound and outbound HTTP traffic for protocol compliance and protocol anomalies.
  • V-237122CAT IKona Site Defender providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes.
  • V-237123CAT IIKona Site Defender providing encryption intermediary services must implement NIST FIPS-validated cryptography for digital signatures.
  • V-237124CAT IKona Site Defender providing encryption intermediary services must use NIST FIPS-validated cryptography to implement encryption services.
  • V-237125CAT IKona Site Defender providing user authentication intermediary services using PKI-based user authentication must only accept end entity certificates issued by DoW PKI or DoW-approved PKI Certification Authorities (CAs) for the establishment of protected sessions.
  • V-237126CAT IIKona Site Defender providing content filtering must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.
  • V-237127CAT IIKona Site Defender providing content filtering must block malicious code upon detection.
  • V-237128CAT IIKona Site Defender providing content filtering must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection.
  • V-237129CAT IIIKona Site Defender providing content filtering must be configured to integrate with a system-wide intrusion detection system.
  • V-237130CAT IIKona Site Defender providing content filtering must continuously monitor inbound communications traffic crossing internal security boundaries for unusual or unauthorized activities or conditions.
  • V-237131CAT IIKona Site Defender providing content filtering must send an alert to, at a minimum, the ISSO and ISSM when detection events occur.
  • V-237132CAT IIKona Site Defender providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources (e.g., IAVMs or CTOs) are detected.
  • V-237133CAT IIKona Site Defender providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected.
  • V-237134CAT IIKona Site Defender must check the validity of all data inputs except those specifically identified by the organization.
  • V-237135CAT IKona Site Defender must reveal error messages only to the ISSO, ISSM, and SCA.
  • V-237136CAT IIKona Site Defender must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Removed since V1R1 (33)

  • V-76391CAT IKona Site Defender must immediately use updates made to policy enforcement mechanisms to enforce that all traffic flows over HTTPS port 443.
  • V-76393CAT IKona Site Defender must immediately apply updates to the Kona Rule Set to block designated traffic of interest in response to new or emerging threats.
  • V-76395CAT IIKona Site Defender must immediately use updates made to policy enforcement mechanisms to block traffic from organizationally defined geographic regions.
  • V-76397CAT IIKona Site Defender must immediately use updates made to policy enforcement mechanisms to block traffic from organizationally defined IP addresses (i.e., IP blacklist).
  • V-76399CAT IIKona Site Defender must immediately use updates made to policy enforcement mechanisms to allow traffic from organizationally defined IP addresses (i.e., IP whitelist).
  • V-76401CAT IKona Site Defender that provides intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52.
  • V-76403CAT IITo protect against data mining, Kona Site Defender providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
  • V-76405CAT IITo protect against data mining, Kona Site Defender providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.
  • V-76407CAT IITo protect against data mining, Kona Site Defender providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
  • V-76409CAT IITo protect against data mining, Kona Site Defender providing content filtering must detect code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
  • V-76411CAT IITo protect against data mining, Kona Site Defender providing content filtering must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
  • V-76413CAT IITo protect against data mining, Kona Site Defender providing content filtering as part of its intermediary services must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code.
  • V-76415CAT IIKona Site Defender must off-load audit records onto a centralized log server.
  • V-76417CAT IIIKona Site Defender must off-load audit records onto a centralized log server in real time.
  • V-76419CAT IIKona Site Defender must not strip origin-defined HTTP session headers.
  • V-76421CAT IIKona Site Defender providing content filtering must protect against known and unknown types of denial-of-service (DoS) attacks by employing rate-based attack prevention behavior analysis.
  • V-76423CAT IIKona Site Defender providing content filtering must protect against known types of denial-of-service (DoS) attacks by employing signatures.
  • V-76425CAT IIKona Site Defender that provides intermediary services for HTTP must inspect inbound and outbound HTTP traffic for protocol compliance and protocol anomalies.
  • V-76427CAT IKona Site Defender providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes.
  • V-76429CAT IIKona Site Defender providing encryption intermediary services must implement NIST FIPS-validated cryptography for digital signatures.
  • V-76431CAT IKona Site Defender providing encryption intermediary services must use NIST FIPS-validated cryptography to implement encryption services.
  • V-76433CAT IKona Site Defender providing user authentication intermediary services using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of protected sessions.
  • V-76435CAT IIKona Site Defender providing content filtering must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.
  • V-76437CAT IIKona Site Defender providing content filtering must block malicious code upon detection.
  • V-76439CAT IIKona Site Defender providing content filtering must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection.
  • V-76441CAT IIIKona Site Defender providing content filtering must be configured to integrate with a system-wide intrusion detection system.
  • V-76443CAT IIKona Site Defender providing content filtering must continuously monitor inbound communications traffic crossing internal security boundaries for unusual or unauthorized activities or conditions.
  • V-76445CAT IIKona Site Defender providing content filtering must send an alert to, at a minimum, the ISSO and ISSM when detection events occur.
  • V-76447CAT IIKona Site Defender providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources (e.g., IAVMs or CTOs) are detected.
  • V-76449CAT IIKona Site Defender providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected.
  • V-76451CAT IIKona Site Defender must check the validity of all data inputs except those specifically identified by the organization.
  • V-76453CAT IKona Site Defender must reveal error messages only to the ISSO, ISSM, and SCA.
  • V-76455CAT IIKona Site Defender must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.