What changed in Intrusion Detection and Prevention Systems Security Requirements Guide V3R4V3R4 changes

Title

The IDPSIPS must enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network as defined in the PPSM CAL and vulnerability assessments.

Check text

If the device being reviewed is an IDS, this is not applicable. Verify the IDPSIPS enforces approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network as defined in the PPSM CAL and vulnerability assessments. If the IDPSIPS does not enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network as defined in the PPSM CAL and vulnerability assessments, this is a finding.

Fix text

Configure the IDPSIPS to enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network as defined in the PPSM CAL and vulnerability assessments.

Discussion

The flow of all communications traffic must be monitored and controlled so it does not introduce any unacceptable risk to the network infrastructure or data. Restricting the flow of communications traffic, also known as Informationinformation flow control, regulateshelps whereprevent informationunauthorized isaccess. allowedUpon todetecting travelmalicious astraffic opposedor toan whoanomaly, is allowed to access the informationIPS andmust withoutbe explicitconfigured regard to subsequent accesses to that information. The IDPS will include policy filtersdrop, rulesblock, signatures,or andredirect behaviorthis analysis algorithms that inspects and restricts traffic based on theorganization-defined characteristicsactions ofin the informationsite's and/orsecurity theplan information path as it crosses internal network boundaries. The IDPS monitors for harmful or suspicious information flows and restricts or blocks this traffic based on attribute- and content-based inspection of the source,device's destination,capabilities. This headers,requirement and/oralso contentapplies ofto theZero communicationsTrust trafficinitiatives.

V-206864 in V3R4

Title

The IDPSIPS must restrict or block harmful or suspicious communications traffic between interconnected networks based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.

Check text

If the device being reviews is an IDS, this is not applicable. Verify the IDPSIPS enforces approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic for controlling the flow of information between interconnected networks as defined in the PPSM CAL and vulnerability assessments. If the IDPSIPS does not enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic for controlling the flow of information between interconnected networks as defined in the PPSM CAL and vulnerability assessments, this is a finding.

Fix text

Configure the IDPSIPS to enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic for controlling the flow of information between interconnected networks as defined in the PPSM CAL and vulnerability assessments.

Discussion

TheRestricting IDPSthe enforcescommunications approvedtraffic authorizationsas byit controllingcrosses theexternal/perimeter flowboundaries, ofalso informationknown betweenas interconnectedinformation networksflow tocontrol, helps prevent harmfulmalicious or suspicious traffic does spread to these interconnected networksaccess. InformationThe flowIPS controlmust policiesbe andconfigured restrictions govern where information is allowed to travelleverage as opposed to who is allowed to access the information. The IDPS includes policy filters, rules, signatures, and/or behavior analysis algorithms that inspects and restricts traffic based on the characteristics of the information and/or the information path. asInspection itis crossesbased externalon attribute- and content-based inspection of the source, destination, headers, and/perimeteror boundariescontent of the communications traffic. DOD IDPShas componentsdefined arethe installedactions andrequired configuredupon suchthe thatdetection theyof restrictharmful or blocksuspicious detectedtraffic harmfulis to restrict, redirect, drop, or suspectblock informationthe flowstraffic. basedSpecific actions taken depends on attribute-the andsite's content-basedsecurity inspectionplan ofand the source,device's destination,capabilities. This headers,requirement and/oralso contentapplies ofto theZero communicationsTrust trafficinitiatives.

V-206865 in V3R4

Discussion

Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the PPSM CAL, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events. Changes to the IDPS must take effect when made by an authorized administrator and the new configuration is put in place or committed, including upon restart or the application or reboot of the system. With some devices, the changes take effect as the configuration is changed, while with others, the new configuration must be submitted to the device. In any case, the behavior of the IDPS must immediately be affected to reflect the configuration change. This requirement also applies to Zero Trust initiatives.

V-206866 in V3R4

Title

The IDPSIPS must block outbound traffic containing known and unknown denial-of-service (DoS) attacks by ensuring that security policies, signatures, rules, and anomaly detection techniques are applied to outbound communications traffic.

Check text

If the device being reviews is an IDS, this is not applicable. Verify the IDPSIPS blocks outbound traffic containing known and unknown DoS attacks by ensuring that security policies, signatures, rules, and anomaly detection techniques are applied to outbound communications traffic. If the IDPSIPS does not block outbound traffic containing known and unknown DoS attacks, by ensuring that security policies, signatures, rules, and anomaly detection techniques are applied to outbound communications traffic, this is a finding.

Fix text

Configure the IDPSIPS to block outbound traffic containing known and unknown DoS attacks, by ensuring that security policies, signatures, rules, and anomaly detection techniques are applied to outbound communications traffic.

Discussion

The IDPSIPS must include protection against DoS attacks thatoriginating originate from inside the enclave whichthat can affect either internal or external systems. These attacks may use legitimate or rogue endpoints from inside the enclave. Installation of IDPSIPS detection and prevention components (i.e., sensors) at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume/type. To comply with this requirement, the IDPSIPS must inspect outbound traffic for indications of known and unknown DoS attacks. Sensor log capacity management, along with techniques whichthat prevent the logging of redundant information during an attack, also guard against DoS attacks. This requirement is used in conjunction with other requirements whichthat require configuration of security policies, signatures, rules, and anomaly detection techniques and are applicable to both inbound and outbound traffic.

V-206881 in V3R4

Title

The IDPS must block any prohibited mobile code at the enclave boundary when it is detected.

Check text

If the device being reviewed is an IDS, this is not applicable. Verify the IDPSIPS blocks any prohibited mobile code at the enclave boundary when it is detected. If the IDPSIPS does not block any prohibited mobile code at the enclave boundary when it is detected, this is a finding.

Fix text

Configure the IDPS to block any prohibited mobile code at the enclave boundary when it is detected.

Discussion

Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient. Examples of mobile code include JavaScript, VBScript, Java applets, ActiveX controls, Flash animations, Shockwave videos, and macros embedded within Microsoft Office documents. Mobile code can be exploited to attack a host. It can be sent as an e-mail attachment or embedded in other file formats not traditionally associated with executable code. While the IDPSIPS cannot replace the anti-virusantivirus and host-based IDS (HIDS) protection installed on the network's endpoints, vendor or locally created sensor rules can be implemented, whichthat provide preemptive defense against both known and zero-day vulnerabilities. Many of the protections may provide defenses before vulnerabilities are discovered and rules or blacklist updates are distributed by anti-virusantivirus or malicious code solution vendors. To block known prohibited mobile code or approved mobile code that violates permitted usage requirements, the IDPSIPS must implement policy filters, rules, signatures, and anomaly analysis.

V-206883 in V3R4

Title

The IDPS must block malicious code.

Check text

If the device being reviewed is an IDS, this is not applicable. Verify the IDPSIPS blocks malicious code. If the IDPSIPS does not block malicious code, this is a finding.

Fix text

Configure the IDPS to block malicious code.

Discussion

Configuring the IDPSIPS to deleteblocks, drops, and/or quarantine based on local organizational incident handling procedures minimizes the impact of this code on the network.

V-206889 in V3R4

Title

The IDPS must quarantine and/or debleteock malicious code.

Check text

If the device being reviewed is an IDS, this is not applicable. Verify the IDPSIPS quarantines and/orblocks delete malicious code. If the IDPSIPS does not quarantine and/or deleteblocks malicious code, this is a finding.

Fix text

Configure the IDPS to quarantine and/or debleteock malicious code.

Discussion

Configuring the network element to deleteblock, drop, and/or quarantine based on local organizational incident handling procedures minimizes the impact of this code on the network. Malicious code includes, but is not limited to, viruses, worms, Trojan horses, and spyware. The code provides the ability for a malicious user to read from and write to files and folders on a computer's hard drive. Malicious code maycould also be able to run and attach programs, which may allow the unauthorized distribution of malicious mobile code. Sometimes it is necessary to generate a log event and then automatically deletedrop or block the malicious code; however, for critical attacks or where forensic evidence is deemed necessary, the preferred action is for the file to be quarantined for further investigation. This requirement is limited to network elements that perform security functions, such as ALG and IDPSIPS.

V-206890 in V3R4

Title

The IDPS must block outbound Internet Control Message Protocol (ICMP) Destination Unreachable, Redirect, and Address Mask reply messages.

Check text

If the device being reviewed is an IDS, this is not applicable. Verify the IDPSIPS blocks outbound ICMP Destination Unreachable, Redirect, and Address Mask reply messages. If the IDPSIPS does not block outbound ICMP Destination Unreachable, Redirect, and Address Mask reply messages, this is a finding.

Fix text

Configure the IDPSIPS to block outbound ICMP Destination Unreachable, Redirect, and Address Mask reply messages. An acceptable alternative to blocking all Destination Unreachable responses is to filter Destination Unreachable messages generated by the firewall implementation to allow ICMP Destination Unreachable-- Fragmentation Needed but DF Bit Set (Type 3, Code 4) and apply this filter to the external interfaces.

Discussion

Internet Control Message Protocol (ICMP) messages are used to provide feedback about problems in the network. These messages are sent back to the sender to support diagnostics.; Howeverhowever, some messages can also provide host information and network topology that may be exploited by an attacker. An IDPSIPS must be configured to "silently drop" the packet and not send an ICMP control message back to the source. In some cases, it may be necessary to direct the traffic to a null interface. Three ICMP messages are commonly used by attackers for network mapping: Destination Unreachable, Redirect, and Address Mask Reply. These responses must be blocked on external interfaces; however, blocking the Destination Unreachable response will prevent Path Maximum Transmission Unit Discovery (PMTUD), which relies on the response "ICMP Destination Unreachable--Fragmentation Needed but DF Bit Set". PMTUD is a useful function and should only be "broken" after careful consideration. An acceptable alternative to blocking all Destination Unreachable responses is to filter Destination Unreachable messages generated by the IDPSIPS to allow ICMP Destination Unreachable--Fragmentation Needed but DF Bit Set (Type 3, Code 4) and apply this filter to the external interfaces.

V-206893 in V3R4

Title

The IDPS must block malicious Internet Control Message Protocol (ICMP) packets by properly configuring ICMP signatures and rules.

Check text

If the device being reviewed is an IDS, this is not applicable. Verify the IDPSIPS blocks malicious ICMP packets by properly configuring ICMP signatures and rules. If the IDPSIPS does not block malicious ICMP packets by properly configuring ICMP signatures and rules, this is a finding.

Fix text

Configure the IDPS to block malicious ICMP packets by properly configuring ICMP signatures and rules.

Discussion

Internet Control Message Protocol (ICMP) messages are used to provide feedback about problems in the network. These messages are sent back to the sender to support diagnostics.; Howeverhowever, some messages can also provide host information, network topology, and a covert channel that may be exploited by an attacker. Given the prevalence of ICMP traffic on the network, monitoring for malicious ICMP traffic would be cumbersome. Vendors provide signatures and rules which filter for known ICMP traffic exploits.

V-206894 in V3R4

Title

To protect against unauthorized data mining, the IDPSIPS must prevent code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

Check text

If the device being reviewed is an IDS, this is not applicable. Verify the IDPSIPS prevents code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields. If the IDPSIPS does not prevent code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields, this is a finding.

Fix text

Configure the IDPSIPS components to prevent code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

Discussion

Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks that use unauthorized data mining techniques to attack databases may result in the compromise of information. Injection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database, or change data on a website. Web applications frequently access databases to store, retrieve, and update information. An attacker can construct inputs that the database will execute. This is most commonly referred to as a code injection attack. This type of attack includes XPath and LDAP injections. IDPSIPS component(s) with the capability to prevent code injections must be included in the IDPSIPS implementation to protect against unauthorized data mining. These components must include rules and anomaly detection algorithms to monitor for atypical database queries or accesses.

V-206895 in V3R4

Title

To protect against unauthorized data mining, the IDPSIPS must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.

Check text

If the device being reviewed is an IDS, this is not applicable. Verify the IDPSIPS prevents code injection attacks launched against application objects including, at a minimum, application URLs and application code. If the IDPSIPS does not prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code, this is a finding.

Fix text

Configure the IDPS to prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.

Discussion

Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks that use unauthorized data mining techniques to attack applications may result in the compromise of information. Injection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database, or change data on a website. These attacks include buffer overrun, XML, JavaScript, and HTML injections. IDPSIPS component(s) with the capability to prevent code injections must be included in the IDPSIPS implementation to protect against unauthorized data mining. These components must include rules and anomaly detection algorithms to monitor for atypical database queries or accesses.

V-206896 in V3R4

Title

To protect against unauthorized data mining, the IDPSIPS must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.

Check text

If the device being reviewed is an IDS, this is not applicable. Verify the IDPSIPS prevents SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields. If the IDPSIPS does not prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields, this is a finding.

Fix text

Configure the IDPSIPS to prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.

Discussion

Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to detect attacks that use unauthorized data mining techniques to attack databases may result in the compromise of information. SQL injection attacks are the most prevalent attacks against web applications and databases. These attacks inject SQL commands that can read, modify, or compromise the meaning of the original SQL query. An attacker can spoof identity; expose, tamper, destroy, or make existing data unavailable; or gain unauthorized privileges on the database server. IDPSIPS component(s) with the capability to prevent SQL code injections must be included in the IDPSIPS implementation to protect against unauthorized data mining. These components must include rules and anomaly detection algorithms to monitor for SQL injection attacks.

V-206897 in V3R4

Title

The IDPSIPS must protect against or limit the effects of known and unknown types of Denial denial-of-service Service (DoS) attacks by employing rate-based attack prevention behavior analysis.

Check text

If the device being reviewed is an IDS, this is not applicable. Verify the IDPSIPS protects against or limits the effects of known and unknown types of DoS attacks by employing rate-based attack prevention behavior analysis. If the device does not protect against or limit the effects of known and unknown types of DoS attacks by employing rate-based attack prevention behavior analysis, this is a finding.

Fix text

Configure the IDPSIPS to protect against or limit the effects of known and unknown types of DoS attacks by employing rate-based attack prevention behavior analysis.

Discussion

If the network does not provide safeguards against DoS attackattacks, network resources will be unavailable to users. Installation of IDPSIPS detection and prevention components (i.e., sensors) at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume/type. Detection components that use rate-based behavior analysis can detect attacks when signatures for the attack do not exist or are not installed. These attacks include zero-day attacks, which are new attacks for which vendors have not yet developed signatures. Rate-based behavior analysis can detect sophisticated, Distributeddistributed DoS (DDoS) attacks by correlating traffic information from multiple network segments or components. This requirement applies to the communications traffic functionality of the IDPSIPS as it pertains to handling communications traffic, rather than to the IDPSIPS device itself.

V-206905 in V3R4

Title

The IDPS must protect against or limit the effects of known and unknown types of Ddenial -of S-service (DoS) attacks by employing anomaly-based attack detection.

Check text

If the device being reviewed is an IDS, this is not applicable. Verify the IDPSIPS protect against or limits the effects of known and unknown types of DoS attacks by employing, also known as anomaly-based detection. If the device does not protect against or limit the effects of known and unknown types of DoS attacks by employing anomaly-based detection, this is a finding.

Fix text

Configure the IDPS to protect against or limit the effects of known and unknown types of DoS attacks by employing anomaly-based detection.

Discussion

If the network does not provide safeguards against DoS attackattacks, network resources will be unavailable to users. Installation of IDPSIPS detection and prevention components (i.e., sensors) at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks. Detection components that use anomaly-based attack detection can detect attacks when signatures for the attack do not exist or are not installed. These attacks include zero-day attacks, which are new attacks for which vendors have not yet developed signatures. This requirement applies to the communications traffic functionality of the IDPSIPS as it pertains to handling communications traffic, rather than to the IDPSIPS device itself.

V-206906 in V3R4

Title

The IDPS must protect against or limit the effects of known types of Ddenial -of S-service (DoS) attacks by employing signatures.

Check text

If the device being reviewed is an IDS, this is not applicable. Verify the IDPSIPS protects against or limits the effects of known types of DoS attacks by employing signatures. If the device does not protect against or limit the effects of known types of DoS attacks by employing signatures, this is a finding.

Fix text

Configure the IDPS to protect against or limit the effects of known types of DoS attacks by employing signatures.

Discussion

If the network does not provide safeguards against DoS attackattacks, network resources will be unavailable to users. Installation of IDPSIPS detection and prevention components (i.e., sensors) at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume, type, or protocol usage. Detection components that use signatures can detect known attacks by using known attack signatures. Signatures are usually obtained from and updated by the IDPSIPS component vendor. These attacks include SYN-flood, ICMP-flood, and Land Attacks. This requirement applies to the communications traffic functionality of the IDPSIPS as it pertains to handling communications traffic, rather than to the IDPSIPS device itself.

V-206907 in V3R4

Discussion

Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command and control function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions. This requirement also applies to Zero Trust initiatives.

V-263664 in V3R4