What changed in Forescout Network Device Management STIG V2R4V2R4 changes

Fix text

There are two default accounts of last resort. The CLIAdmin root account can only be used to access Forescout with the CLI. Accounts created in CounterACT user profile in the management console do not have access to login to the CLI. The default console account "Admin" allows access only to the management console. These accounts can be used as the accounts of last resort or two other accounts may be created for this purpose as long as a strong password that meets DoDDoW requirements is used for both. 1. Log on to the Forescout Administrator UI. 2. From the menu, select Tools >> Options >> CounterACT user profiles. Remove unauthorized local accounts not identified as the account of last resort.

V-230932 in V2R4

Title

Forescout must display the Standard Mandatory DoDW Notice and Consent Banner before granting access to the device.

Fix text

Log on to the Forescout Administrator UI. 1. Select Tools >> Options >> CounterACT User Profiles >> Password and Sessions. 2. Select the "Login" tab and check the "Display this Notice and Consent Message after login" option. 3. Select the "Before login, prompt user to accept these Terms and Conditions". 4. Copy the exact text and formatting for the Standard Mandatory DoDDoW and Consent Banner into the white box. Be sure to adhere to the exact line spacing required by DTM-08-060.

Discussion

Display of the DoDDoW-approved use notification before granting access to the application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users. The banner must be formatted in accordance with DTM-08-060.

V-230934 in V2R4

Title

Forescout must retain the Standard Mandatory DODDoW Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.

Check text

Verify Forescout retains the Standard Mandatory DODDoW-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and takes explicit actions to log on for further access. Attempt to log on to the Forescout device as a system administrator using the web management tool. If Forescout does not retain the Standard Mandatory DODDoW-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access, this is a finding.

Discussion

The banner must be acknowledged by the administrator prior to the device allowing the administrator access to the network device. This provides assurance that the administrator has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the administrator, DODDoW will not be in compliance with system use notifications required by law. To establish acceptance of the network administration policy, a click-through banner at management session logon is required. The device must prevent further activity until the administrator executes a positive action to manifest agreement. In the case of CLI access using a terminal client, entering the username and password when the banner is presented is considered an explicit action of acknowledgement. Entering the username, viewing the banner, then entering the password is also acceptable. The web management tool configuration setting works for both the CLI and the web management tool.

V-230935 in V2R4

Discussion

The loss of connectivity to a particular authoritative time source will result in the loss of time synchronization (free-run mode) and increasingly inaccurate time stamps on audit events and other functions. Multiple time sources provide redundancy by including a secondary source. Time synchronization is usually a hierarchy; clients synchronize time to a local source while the source synchronizes time to a more accurate source. The network device must utilize an authoritative time server and/or be configured to use redundant authoritative time sources. This requirement is related to the comparison done in CCI-001891. DODDoW-approved solutions consist of a combination of a primary and secondary time source using a combination or multiple instances of the following: a time server designated for the appropriate DODDoW network (NIPRNet/SIPRNet); United States Naval Observatory (USNO) time servers; and/or the Global Positioning System (GPS). The secondary time source must be located in a different geographic region than the primary time source.

V-230944 in V2R4

Check text

Determine if the network device prohibits installation of software without explicit privileged status. This requirement may be verified by demonstration or configuration review. 1. From the menu, select Tools >> Options >> User Console and Options. 2. Select (highlight) the user profile to be reviewed (group or user) and then select Edit >> Permissions. 3. Check a sampling of users against the current SSP and associated documentation to verify only the users, roles, or groups that should have privilege to update software have the Software Upgrade privilege selected. If installation of software is not prohibited without explicit privileged status, this is a finding.

Fix text

Remove accounts that are not authorized. Do not remove the account of last resort. Compare users, withroles, or groups against the current SSP and associated documentation and ensure only the users, roles, or groups that should have the privilege to update software have the Software Upgrade privilege selected. 1. From the menu, select Tools >> Options >> User Console and Options. 2. Select (highlight) the user profile to be reviewed (group or user) and then select Edit >> Permissions. 3. Disable or delete unauthorized users.

V-230946 in V2R4

Fix text

Remove accounts that are not authorized. Do not remove the account of last resort. 1. Log on to the Forescout Administrator UI with admin or operator credentials. 2. From the menu, select Tools >> Options >> User Console and Options. 3. Select (highlight) the user profile to be reviewed (group or user) and then select Edit >> Permissions. 4. Check user or roles against the current SSP anddefined groups/roles to ensure only the users and roles that should have privilege to make changes have the CounterACT Appliance Configuration; CounterACT Appliance Control; Module Control; Multiple CounterACT Appliance Management; Policy Control; Policy Management; and User Management privileges selected. 5. Delete or disable unauthorized users.

Discussion

FailureDetermine toif providethe logicalnetwork device enforces access restrictions associated with changes to device configuration. may 1. haveLog significant effects on to the overallForescout securityAdministrator ofUI with admin or operator credentials. 2. From the systemmenu, select Tools >> Options >> User Console and Options. 3. Select (highlight) the user profile to be reviewed (group or user) and then select Edit >> Permissions. For4. Forescout,Check user against the current SSP and associated documentation and ensure only authorizedthe users that should have accessthe privilege to usermake profilechanges permissions.have Allthe otherCounterACT adminsAppliance areConfiguration; blockedCounterACT fromAppliance accessControl; viaModule theControl; consoleMultiple toolsCounterACT and/orAppliance webManagement; portalPolicy basedControl; onPolicy permissionsManagement; setand onUser Management privileges selected. If the Editnetwork userdevice profiledoes not enforce such access restrictions, this is a finding.

V-230947 in V2R4

Fix text

When Forescout updates are downloaded, whether from the DODDoW update server or the updates.forescout.com portal, each update consists of an MD5 hash. Manually inspect, compare, and verify the MD5 hash against the Forescout website to ensure that the software has come from the Forescout server.

Discussion

Changes to any software components can have significant effects on the overall security of the network device. Verifying software components have been digitally signed using a certificate that is recognized and approved by the organization ensures the software has not been tampered with and has been provided by a trusted vendor. Accordingly, patches, service packs, or application components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The device should not have to verify the software again. This requirement does not mandate DODDoW certificates for this purpose; however, the certificate used to verify the software must be from an approved Certificate Authority (CA). Customer portal updates file download section on the vendor website has the MD5 hashes for the updates files. Currently, this is the method used by DODDoW to pull down files rather than using the internal connection to the Forescout server.

V-230949 in V2R4

Check text

Determine if there are users defined in Forescout that are not authorized to change the software libraries. Verify that Administrator privileges have been restricted for these users. This is verified by reviewing the administrator account profiles and auditing the assigned privilege for updated Forescout software. 1. Log on to the Forescout Console and select Tools >> Options >> Console User Profiles. 2. Select the user group that is not authorized access according to the SSP. 3. Select "Edit" and the "Permissions" tab. 4. Verify the users against the current SSP and associated documentation to ensure that nonprivileged users do not have the "PluginModule Management" and "Software Upgrade" options selected. If Forescout is not configured to limit privileges to change the software resident within software libraries for unauthorized users, this is a finding.

Fix text

Configure Forescout to prevent access to change the software resident within software libraries for unauthorized personnel. View each of the Forescout user group accounts that are associated with the external user directory groups (e.g., RADIUS, Active directoryDirectory, LDAP). Perform the following actions for each group. 1. Log on to the Forescout Console and select Tools >> Options >> Console User Profiles. 2. Select the user group that is not authorized access according to the SSP. 3. Select "Edit" and the "Permissions" tab. 4. Unselect the options for "Module Management" and "Software Upgrade".

Discussion

Changes to any software components of the network device can have significant effects on the overall security of the network. Therefore, only qualified and authorized individuals must be allowed administrative access to the network device for implementing any changes or upgrades. If the network device were to enable non-authorizednonauthorized users to make changes to software libraries, those changes could be implemented without undergoing testing, validation, and approval.

V-230950 in V2R4

Discussion

Network devices running an unsupported operating system lack current security fixes required to mitigate the risks associated with recent vulnerabilities. In October 2021, there is plan to make Version 7 end-of-life. This will be stated on the product lifecycle page of the Forescout website. All versions of V8 and above are authorized for use in DODDoW. Version 8 or later is mandatory after October 2021.

V-230953 in V2R4

Check text

Check that the administrative accountsaccount roles and authorization groups assigned to each role are documented within the SSP and associated documentation and have been configured correctly with least privilege. 1. Log on to Forescout UI. 2. Select Tools >> Options >> CounterACT User Profiles. 3. Select username, role, or group >> Edit >> Permissions. Check the SSP and associated documentation against the created users, roles, and groups to ensure least privilege has been configured properly. Options include Custom accounts for Console Access and Web Access. Each access account is then further established with permissions based on the user's authorizations. If Forescout does not enforce organization-defined, role-based access control policies over defined subjects and objects, this is a finding.

Fix text

Login1. Log on to Forescout UI. 12. Select Tools >> Options >> CounterACT User Profiles. 23. Select username, role, or group >> Edit >> Permissions. 4. Check the SSP and associated documentation against the created users, roles, and groups to ensure least privilege has been configured properly. Options 5. includeModify Custompermissions accountsas forneeded Consoleso Accesseach andaccount, Webrole, Access.or Eachgroup accesshas accountonly isthe thenConsole furtherAccess, establishedWeb withAccess, permissionsand basedpermission onassignments authorized by the user'sSSP authorizationsand associated documentation.

V-230954 in V2R4

Fix text

Configure Forescout to conduct backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner. Setup a backup server. 1. Open the Forescout Console and select Tools >> Advanced >> Backup >> Backup Server. 2. Click "SCP" or "SFTP" for the transfer protocol. 3. Add the IP address of the backup destination server. 4. Add the directory to receive the file. 5. Add PKI key (preferred) or add username and DoDDoW compliant password for the backup account to be used. 6. Enable "Authenticate Destination Sever". 7. Test the file transfer. 8. Click "Apply". Generate a backup job. 1. Click the "System Backup" tab. 2. Select "Enable System Backup". 3. Under Backup Schedule, add a "Generate backup at" and enter a time to run the backup in accordance with site procedures. 4. Select "Weekly" for Recurrence Pattern. When changes to the configuration occur, the admin must immediately create a new backup by clicking "Backup Now" on the Backup screen.

V-230956 in V2R4

Fix text

Configure Forescout to conduct backups. Setup a backup server. 1. Open the Forescout Console and select Tools >> Advanced >> Backup >> Backup Server. 2. Click "SCP" or "SFTP" for the transfer protocol. 3. Add the IP address of the backup destination server. 4. Add the directory to receive the file. 5. Add PKI key (preferred) or add username and DoDDoW compliant password for the backup account to be used. 6. Enable "Authenticate Destination Sever". 7. Test the file transfer. 8. Click "Apply". Generate a backup job. 1. Click the System Backup tab. 2. Select "Enable System Backup". 3. Under Backup Schedule, add a "Generate backup at" and enter a time to run the backup in accordance with site procedures. 4. Select "Weekly" for Recurrence Pattern. When changes to the configuration occur, the admin must immediately create a new backup by clicking "Backup Now" on the Backup screen.

V-230957 in V2R4

Title

Forescout must use DODoW-approved PKI rather than proprietary or self-signed device certificates.

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DODDoW-approved PKIs. Forescout generates a key-pair and a Certificate Signing Request (CSR). The CSR is sent to the approved certificate authority (CA), who signs it and returns it as a certificate. That certificate is then installed. The process to obtain a device PKI certificate requires the generation of a CSR, submission of the CSR to a CA, approval of the request by an RA, and retrieval of the issued certificate from the CA.

V-230959 in V2R4

Discussion

To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable unused or unnecessary physical and logical ports/protocols on information systems. This option connects to a user verification server at Forescout infrastructure used for verification of customer profiles and must not be used in DoDDoW. If accidentally checked, this must error out.

V-230960 in V2R4

Check text

1. From the menuconsole, selectnavigate to Tools >> Options >> CounterACTForescout User Profiles >> PasswordPasswords and Sessions. 2. Verify the fifth "passwordPassword must containdiffer from previous password by at least" is checked. 3.and Verifythe therevalue is 1set (orto higher) in the "repeated8" characters or digits" configuration boxhigher. If Forescout"Password doesmust notdiffer enforcefrom theprevious requirementpassword thatby whenat theleast" password is changed,not thechecked charactersand arethe changedvalue inis atnot leastset eightto of"8" theor positions within the passwordhigher, this is a finding.

Fix text

Configure Forescout to be required that when a password is changed, the characters are changed in at least eight of the positions within the password. 1. From the menuconsole, selectnavigate to Tools >> Options >> CounterACTForescout User Profiles >> PasswordPasswords and Sessions. 2. CheckClick the fifthbox next to "passwordPassword must containdiffer from previous password by at least" optionto enable it. 3. AddSet athe 1value (or higher) in the "repeatedbox charactersnext orto digitsit to "8" configurationor boxhigher. 4. Click "Apply".

V-230968 in V2R4

Fix text

To enable FIPS mode on the Forescout appliance, start by opening a secure shell to the CLI of the management appliance using Putty or another tool. Log on using the CLIAdmin credentials established upon initial configuration. To enable FIPS mode, type "fstool fips". At the prompt to alert the user FIPS 140-2 will be enabled, type "Yes" to accept. Note: Use of FIPS mode is not mandatory in DoDDoW. However, it is the primary method for mitigation of this requirement and ensuring FIPS compliance.

Discussion

Unapproved mechanisms used for authentication to the cryptographic module are not validated and therefore cannot be relied upon to provide confidentiality or integrity, and DoDDoW data may be compromised. Network devices utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoDDoW requirements. However, authentication algorithms must configure security processes to use only FIPS-approved and NIST-recommended authentication algorithms.

V-230969 in V2R4

Check text

List the contents of Forescout’'s local storage, including any drives supporting removable media (such as flash drives), and check the file permissions of all files on those drives. 1. Review accounts with incorrect update privileges to Forescout appliance configuration by selecting Tools >> Options >> CounterACT User Profiles. 2. Select a user or group to edit. 3. Select the "Permissions" tab. 4. Verify the "CounterActCounterACT Appliance Configuration" and "CounterACT Appliance Control" radio buttons are set to "View only". If any files allow read or write access by accounts not specifically authorized access or access using non-privilegednonprivileged accounts, this is a finding.

Fix text

Review the SSP or other associated documentation for a list of groups, roles, or user accounts and privileges. Set the file permissions on files on Forescout or on removable media used by the device so that only authorized administrators can read or change their contents. This is completed by limiting access to SUDO accounts and command line admin accounts. 1. Review accounts with incorrect update privileges to Forescout appliance configuration by selecting Tools >> Options >> CounterACT User Profiles. 2. Select a user or group to edit. 3. Select the "Permissions" tab. 4. Ensure the "CounterACT Appliance Configuration" and "CounterACT Appliance Control" radio buttons are set to "View only".

V-230971 in V2R4