What changed in Dragos Platform 2.x STIG V1R7V1R7 changes

CCIs

CCI-000060,CCI-000057,CCI-001133,CCI-002361,CCI-002034895

V-270904 in V1R7

CCIs

CCI-000015,CCI-000017,CCI-000044,CCI-000765,CCI-000766,CCI-000767003627,CCI-000768004061,CCI-000795004066,CCI-000200,CCI-000195,CCI-000198,CCI-001084,CCI-002238,CCI-002142004045,CCI-002145

V-270910 in V1R7

Title

The Dragos Platform must display the Standard Mandatory DODoW Notice and Consent Banner before granting local or remote access to the system.

Check text

Verify the Dragos Platform displays the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the system when login in via SSH. If the banner does not exist or is not formatted in accordance with applicable DODDoW policy, this is a finding.

Fix text

Configure the Dragos Platform to display the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the system: 1. Log in to the SiteStore or Sensor via SSH. 2. Input "config banner pre_login" into the CLI. 3. Input the banner text shown below, pressing "Enter" after each line. Press config appl CTRL-D to save the text or CTRL-C to quit without saving. 4. Apply the banner by executing the following: config apply The banner must be formatted in accordance with applicable DODDoW policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."

Discussion

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DODDoW policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't." Satisfies: SRG-APP-000068, SRG-APP-000069

V-270916 in V1R7

Title

The publicly accessible Dragos Platform application must display the Standard Mandatory DODoW Notice and Consent Banner before granting access to Dragos Platform.

Check text

Verify that the Standard Mandatory DODDoW Notice and Consent Banner appears before being granted access to Dragos Platform UI. If the Standard Mandatory DODDoW Notice is not presented, this is a finding. Example Banner: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.11nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:11n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.11n-At any time, the USG may inspect and seize data stored on this IS.11n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.11n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.11n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

Fix text

1. Download the following script, and putplace it in the "/root" directory on the sitestore wherethat yourequires want to apply the DODDoW Banner: import os, json, sys, time # Created by bdudley@dragos.com to assist with Dragos STIG implementation # specifically related to DODDoW Banner for web UI before login os.chdir("/root") # version compatibility check if 'Platform Version: 2.' not in os.popen("dragoscmd version").read(): print("This version of the Dragos platform is incompatible with this script.") exit() DOD_BANNER_JSDoW_BANNER_JS = "alert('You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.11nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:11n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.11n-At any time, the USG may inspect and seize data stored on this IS.11n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.11n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.11n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.');" fstream = open('banner.js', 'w') fstream.write(DOD_BANNER_JSDoW_BANNER_JS) fstream.close() # get the platform-ui container id platformui = os.popen("kubectl get pods | grep platform-ui | grep -v platform-ui-logger | awk '{print $1}'").read().strip() BANNER_DIR = '/usr/share/nginx/html/source/' HTML_DIR = '/usr/share/nginx/html/' if "--restore-defaults" in sys.argv: print("Restoring to default, no banner.") os.system("kubectl -n dragos-sitestore cp ./index.html.bak "+platformui+":"+HTML_DIR+"index.html") print("Done, reload the page to test changes.") exit() # this will check periodically to make sure the banner changes persisted, and re-apply them if not if "--persist-banner" in sys.argv: # check the current settings current_html = os.popen("curl -k https://localhost").read() if "./source/banner.js" in current_html: print("Banner is currently set, taking no action.") exit() else: fstream = open("banner.log", "a") fstream.write("["+time.ctime().replace(" ", "")+"] banner was not set, setting banner now.1n") fstream.close() # put the banner js file in the appropriate directory os.system("kubectl -n dragos-sitestore cp ./banner.js "+platformui+":"+BANNER_DIR+"banner.js") # update the current version of index.html in the pod os.system("kubectl -n dragos-sitestore cp ./index.html.patched "+platformui+":"+HTML_DIR+"index.html") exit() # is the sitestore up and running? if "System is ready." not in os.popen("dragoscmd system k3s status").read(): print("System is not ready, wait until all pods are started before configuring banner.") exit() # is there a backup of the old index.html file if os.path.exists('index.html.bak') == False: print("Creating an index.html backup...") os.system("kubectl -n dragos-sitestore cp "+platformui+":"+HTML_DIR+"index.html ./index.html.bak") print("Done.") # put the banner js file in the appropriate directory os.system("kubectl -n dragos-sitestore cp ./banner.js "+platformui+":"+BANNER_DIR+"banner.js") # perform appropriate patching on the index.html backup fstream = open("index.html.bak", "r") html = fstream.read() fstream.close() original = '&ltscript nonce="**CSP_NONCE**" type="module" crossorigin' replacement = '&ltscript src="./source/banner.js" nonce="**CSP_NONCE**">&lt/script>&ltscript nonce="**CSP_NONCE**" type="module" crossorigin' fstream = open("index.html.patched", "w") fstream.write(html.replace(original, replacement)) fstream.close() # update the current version of index.html in the pod os.system("kubectl -n dragos-sitestore cp ./index.html.patched "+platformui+":"+HTML_DIR+"index.html") print("Banner configuration changes complete, reload the login page (or logout) to see the popup. If the formatting for the popup needs to be adjusted, make the changes in the banner block above and re-run this script.") print("1nUse the below format to create a cron that makes the banner persist through reboots:1n1n*/5 * * * * python3 /root/DOD_Banner_Config_UtilityDoW_Banner_Config_Utility.py --persist-banner1n1n") 2. Run the script with the following syntax: python3 DOD_Banner_Config_UtilityDoW_Banner_Config_Utility.py, and go to the sitestore login page to verify the banner is present. 3. Schedule the cron with the following syntax to make sure the change survives reboots: 5 * * * * python3 /root/DOD_Banner_Config_UtilityDoW_Banner_Config_Utility.py --persist-banner.

V-270917 in V1R7

Fix text

Create Syslog server and Rule. 1. Create a Syslog server on a third-party device. The steps may vary depending on the chosen Syslog server software. 2. Create a syslog server output in the Dragos UI. Navigate to Admin >> Integrations. Click "LAUNCH" in the Syslog section. Click "ADD NEW SERVER". Enter third-party server information, select TLS or mTLS in the protocol dropdown, and click "NEXT". Note: This step may require TLS certificate generation. Input Message Template. Click "SAVE". 3. Create a rule. Navigate to Notification >> RULES Tab. Click "NEW RULE". Fill in Name and Processing Order. Select For Rule Criteria: If ANY of the following - "Notification Type" "Equals" "System" Action = Send Syslog (third-party server) Click "SAVE".

V-270944 in V1R7

Check text

Check password configurations. In the UI, navigate to Admin >> SiteStore Management >> Authentication Providers. Click "EDIT" in the Local Authentication section. Verify the following settings: 1. Password Expiration is set to "24 months" or less. 2. Password Reuse Limit is set to "5" or less. 3. Minimum Length is set to "15" or greater. 4. Uppercase and lowercase letters is checked. 5. Special characters is checked. 6. Numeric characters is checked. 7. Number of failed logins is set to "5", within is set to "15 minutes", and results in is set to "60 minute lockout". If any settings are not configured correctly, this is a finding.

Fix text

Change password configurations. In the UI, navigate to Admin >> SiteStore Management >> Authentication Providers. Click "EDIT" in the Local Authentication section. Change the fields to the following settings: 1. Password Expiration = "24 months" or less. 2. Password Reuse Limit = "5" or less. 3. Minimum Length = "15" or greater. 4. Uppercase and lowercase letters = Checked. 5. Special characters = Checked. 6. Numeric characters = Checked. 7. Number of failed logins =is set to "5 Within", =within is set to "15 minutes Results", and results in =is set to "60 minute lockout". Click "SAVE". For DragOS CLI: Passwords must meet a minimum requirement of 15 characters. Maximum password age is 1one year by default, and is configurable via the CLI.

CCIs

CCI-000205,CCI-000192,CCI-000193,CCI-000194,CCI-001619,CCI-000199CCI-004066

V-270955 in V1R7

CCIs

CCI-001683,CCI-001684,CCI-001685,CCI-001686CCI-000015

V-270993 in V1R7

Title

Dragos Platform must accept the DODDoW common access card (CAC) or other Public Key Infrastructure (PKI) credential for identity management and personal authentication.

Check text

Verify that Dragos is configured to use the DODDoW CAC or other PKI credential to log in to the application. Log in to the application. If DODDoW CAC or other PKI is not configured, this is a finding.

CCIs

CCI-002009,CCI-002010,CCI-001953,CCI-001954,CCI-000185,CCI-000186,CCI-000187,CCI-0019914068

V-271034 in V1R7

Title

The Dragos Platform must only allow the use of DODDoW Public Key Infrastructure (PKI) established certificate authorities for verification of the establishment of protected sessions.

Check text

Open a web browser and navigate to the Dragos Platform UI. Locate the security or certificate status indicator at the address bar. Open the certificate information. If the certificate is signed by anyone other than DODDoW, PKI, or CA, this is a finding.

Discussion

Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DODDoW systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DODDoW-approved CA, trust of this CA has not been established. The DODDoW will only accept PKI certificates obtained from a DODDoW-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of TLS certificates. This requirement focuses on communications protection for Dragos Platform session rather than for the network packet. This requirement applies to applications that use communications sessions. This includes, but is not limited to, web-based applications and Service-Oriented Architectures (SOA). Satisfies: SRG-APP-000427, SRG-APP-000605

V-271049 in V1R7

Discussion

Without device-to-device authentication, communications with malicious devices may be established. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk. Currently, DODDoW requires the use of AES for bidirectional authentication since it is the only FIPS-validated AES cipher block algorithm. The NTP uses MD5 authentication keys. The MD5 algorithm is not approved for use in either the FIPS or NIST recommendation; thus, a CAT 1 finding is allocated in CCI-000803. However, the use of MD5 is preferred to no authentication at all and can be used to mitigate this requirement to a CAT II finding. The trusted-key statement permits authenticating NTP servers. The product must be configured to support separate keys for each NTP server. Severs should have Public Key Infrastructure (PKI) device certificate involved for use in the device authentication process. Server authentication is performed by the client using the server's public key certificate, which the server presents during the handshake. The exact nature of the cryptographic operation for server authentication is dependent on the negotiated cipher suite and extensions. In most cases (e.g., RSA for key transport, DH, and ECDH), authentication is performed explicitly through verification of digital signatures present in certificates and implicitly by the use of the server public key by the client during the establishment of the master secret. A successful "Finished" message implies that both parties calculated the same master secret and thus, the server must have known the private key corresponding to the public key used for key establishment.

V-271105 in V1R7