What changed in Firewall Security Requirements Guide V3R4V3R4 changes

Discussion

Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the Ports, Protocols, and Services Management (PPSM) Category Assurance LevelsList (CAL) list, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events. This requirement also applies to Zero Trust initiatives.

V-206675 in V3R4

Title

If communication with the central audit server is lost, the firewall must generate a real-time alert to, at a minimum, the systems adminsitratoradministrator (SA) and information system security officer (ISSO).

Discussion

Without a real-time alert (less than a second), security personnel may be unaware of an impending failure of the audit functions and system operation may be adversely impacted. Alerts provide organizations with urgent messages. Automated alerts can be conveyed in a variety of ways, including via a regularly monitored console, telephonically, via electronic mail, via text message, or via websites. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded. Most firewalls use UDP to send audit records to the server and cannot tell if the server has received the transmission,; thus, the site should either implement a connection-oriented communications solution (e.g., TCP) or implement a heartbeat with the central audit server and send an alert if it is unreachable.

V-206700 in V3R4