What changed in Cisco ASA IPS STIG V2R1V2R1 changes

Check text

Verify logging for connection events is enabled. Step 1: Navigate to Configuration >> ASA Firepower Configuration >> Policies >> Access Control Policy. The Access Control Policy page appears. Step 2: Click the edit icon next to the access control policy you want to view. The access control policy editor appears. Step 3: Click the edit icon next to a rule to view. Verify a logging option has been selected,. Verify the Syslog check box has been selected. --------------------------------------------------- Verify logging for Intrusion events is enabled. Step 1: Navigate to Configuration >> ASA Firepower Configuration >> Policies >> Intrusion Policy >> Intrusion Policy. The Intrusion Policy page appears. Step 2: Click Advanced Setting. The Advanced Settings page appears. Step 3: Verify that Syslog Alerting under External Responses is enabled. If the Cisco ASA is not configured to produce log records containing information to establish when the events occurred, this is a finding.

V-239874 in V2R1

Title

The Cisco ASA must be configured to block outbound traffic containing denial-of-service (DoS) attacks by ensuring an intrusion prevention policy has been applied to outbound communications traffic.

Fix text

Configure access control rules to block non-compliantnoncompliant traffic. Step 1: Navigate to Configuration >> ASA FirePOWER Configuration >> Policies >> Access Control Policy. The Access Control Policy page appears. Step 2: Click the edit icon next to the access control policy configured for intrusion inspection using access control rules. Step 3: Click the edit icon next to the rule you want to edit. The access control rule editor appears. Step 4: Set the rule action Interactive Block or Interactive Block with reset. Step 5: Select the Inspection tab. The Inspection tab appears. Step 6: Select a system-provided or custom intrusion policy. Step 7: Click Save to save the rule. --------------------------------------------------- Configure the ASA to redirect all traffic to the FirePOWER module in inline mode as shown in the example below. Step 1: Configure access list for all traffic. ASA1(config)# access-list FIREPOWER_REDIRECT extended permit ip any any Step 2: Create a class-map in order to match the traffic on an access list. ASA1(config)# class-map FIREPOWER_SFR ASA1(config-cmap)# match access-list FIREPOWER_REDIRECT Step 3: Configure deployment mode as inline. ASA1(config)# policy-map global_policy ASA1(config-pmap)# class FIREPOWER_SFR ASA1(config-pmap-c)# sfr fail-open

CCIs

CCI-001095CCI-001095,CCI-004866

V-239882 in V2R1

CCIs

CCI-001240CCI-004964,CCI-004965

V-239885 in V2R1

Discussion

Failing to automatically update malicious code protection mechanisms, including application software files, signature definitions, and vendor-provided rules, leaves the system vulnerable to exploitation by recently developed attack methods and programs. An automatic update process ensures this important task is performed without the need for system administrator intervention. The IDPS is a key malicious code protection mechanism in the enclave infrastructure. To ensure this protection is responsive to changes in malicious code threats, IDPS components must be automatically updated, including anti-virus signatures, detection heuristics, vendor-provided rules, and vendor-provided signatures. If a DoDDOD patch management server or update repository having the tested/verified updates is available for the IDPS component, the components must be configured to automatically check this server/site for updates and install new updates. If a DoDDOD server/site is not available, the component must be configured to automatically check a trusted vendor site for updates. A trusted vendor is either commonly used by DoDDOD, specifically approved by DoDDOD, the vendor from which the equipment was purchased, or approved by the local program's CCB.

CCIs

CCI-001247964

V-239889 in V2R1