IBM DataPower Network Device Management Security Technical Implementation Guide

The IBM DataPower Network Device Management Security Technical Implementation Guide (V1 R2) has 64 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

64STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Tue Oct 24 2017

The DataPower Gateway must not use 0.0.0.0 as the management IP address.

IBM DataPower Network Device Management Security Technical Implementation Guide

Assessment Title

Rule Text

The DataPower Gateway must not use 0.0.0.0 as the management IP address.

Description

Discussion Text

If 0.0.0.0 as the management IP address, the DataPower appliance will listen on all configured interfaces for management traffic. This can allow an attacker to gain privileged-level access from an untrusted network.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-65189

Rule

SV-79679r1_rule

Severity

medium

Rule Version

WSDP-NM-000143

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Using an administrator account, log on to the default domain of the appliance.

Navigate to Network >> Management >> Web Management Service.

View the Local Address field; if the value is "0.0.0.0", this is a finding.

Implementation Procedure

Fix Text

To configure the DataPower appliance for web management:

Using an administrator account, log on to the default domain of the appliance.

On the Configure Web Management Service screen, complete the required information.

Set the Administrative state to "enabled".

For the Local Address, use the IP address from the management subnet assigned to the unit.

STIG check 64 of 64 in the IBM DataPower Network Device Management STIG checklist

← Previous · V-65187The DataPower Gateway must obtain its public key certificates from an appropriate certificate policy through an approved service provider.