What changed in Symantec Edge SWG ALG STIG V1R2V1R2 changes

Fix text

1. In the Edge SWG Web UI, navigate to the VPM. 2. Add a web access layer called "Web Access Layer". 3. Click "Add a rule." 4. Under "Source", left-click and select "Set". 5. Click "Add a new object" and select "Group". 6. Enter the full DN of the LDAP group. For example: CN=broadcom.proxyusers.gsg,OU=BROADCOM,DC=dodDoW,DC=mil 7. Under "Authentication Realm", select the CAC Certificate. 8. Click "Apply" and then click "Set". 9. Click "Service" and then click "Set". 10. Click "Add a new object". 11. Click "Client Protocol", select "HTTP", and then click "Apply and set". 12. Under "Action", left-click and set to "Allow". 13. Under "Track", left-click "Add a new Object". 14. Click "Event Log". 15. Under "Details", add the following text: "$(appliance.name)$(appliance.primary_address)$(c-ip)$(c-port)$(c-uri)$(c-uri-address)$(c-uri-cookie-domain)$(c-uri-extension)$(c-uri-host)$(c-uri-hostname)$(c-uri-path)$(c-ur-pathquery)$(client.address)$(client.certificate.subject)$(client.host)$(client.public_address)$(cs-auth-group)$(cs-categories-policy)$(date)$(user.name)$(user.x509.subject)" 16. Under "Category", select "All". 17. Under "Display options", select "Both". 18. Click "Apply and set". 19. Repeat the above procedure for each service/protocol being proxied with authorization enforcement. For example, ensure HTTPS is selected when doing HTTPS and not HTTP. 20. Click "Apply Policy". 1. Navigate to the top of the VPM and add a new layer. It must be a CPL layer. 2. Include the following in the layer text: &ltProxy> url.regex="ssl://" authenticate(no) &ltProxy>client.certificate.require(yes) service.name=!(CAC-MC-Notify,HTTPS-Console) authenticate(CAC) authenticate.force(no) authenticate.mode(auto) Note: The CAC-MC-Notify and HTTPS-Console must match a proxy or reverse service in use. The authenticate(CAC) must represent the Certificate Authentication Realm previously configured. 3. Click "Apply Policy".

V-279166 in V1R2

Fix text

1. In the Edge SWG Web UI, navigate to the VPM. 2. Under the configured Web Access Layer, add a rule. 3. Under "Source", left-click then click "Set". 4. Click "Add new object". 5. Select "Group". 6. Enter the full Distinguished Name (DN) of the LDAPS group. For example: "CN=broadcom.proxyusers.gsg,OU=BROADCOM,DC=dodDoW,DC=mil" 7. Under "Authentication Realm", select the CAC/certificate realm. 8. Click "Apply". 9. Under "Service", left-click then click "Set". 10. Select the "All HTTPS client" protocol. 11. Click "Apply". 12. Under Action, left-click then click "Set". 13. Click "Allow", then click "Apply". 14. Under "Track", left-click then click "Set". 15. Select the event log that was created previously. 16. Click "Apply". 17. Repeat the above steps for HTTP instead of HTTPS and add any additional protocols that need to be proxied. 18. Click "Apply policy".

Discussion

For remote access to nonprivileged accounts, one factor of multifactor authentication must be provided by a device separate from the information system gaining access to reduce the likelihood of compromising authentication credentials stored on the system. Before continuing, ensure that the Edge SWG was implemented for SYME-ND-000190. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification (PIV) card and the DODDoW common access card (CAC). A privileged account is defined as an information system account with authorizations of a privileged user. Remote access is access to DODDoW-nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. An example of compliance with this requirement is the use of a one-time password token and PIN coupled with a password; or the use of a CAC/PIV card and PIN coupled with a password. Satisfies: SRG-NET-000339-ALG-000090, SRG-NET-000500-ALG-000035, SRG-NET-000340-ALG-000091, SRG-NET-000355-ALG-000117, SRG-NET-000370-ALG-000125, SRG-NET-000494-ALG-000029, SRG-NET-000495-ALG-000030, SRG-NET-000496-ALG-000031, SRG-NET-000497-ALG-000032, SRG-NET-000498-ALG-000033, SRG-NET-000499-ALG-000034, SRG-NET-000501-ALG-000036, SRG-NET-000502-ALG-000037, SRG-NET-000503-ALG-000038, SRG-NET-000505-ALG-000039

V-279167 in V1R2

Title

The Edge SWG must display the standard mandatory DODoW-approved notice and consent banner before granting access to the network.

Fix text

1. In the Edge SWG Web UI, navigate to the VPM. 2. Navigate to the Symantec site: https://knowledge.broadcom.com/external/article/388134. 3. Download the file "ProxyTrafficLoginBanner.txt". 4. Copy and paste the text into this CPL layer. 5. Find line 426 as shown below, and replace the hostname of the current Edge SWG being configured. "&ltProxy> condition=!__is_notify_internal_proxy url.domain=!"tditwbcsg001.dodDoW.mil" ; Guard Rule" 6. In line 414, replace the service name being used for the HTTPS-console name. By default, it should be "HTTPS-Console" and not "H2-Console". [rule] service.name=!H2-Console 7. Click "Apply Policy".

V-279175 in V1R2

Discussion

NIST SP 800-52 provides guidance on using the most secure version and configuration of the TLS/SSL protocol. Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks, which exploit vulnerabilities in this protocol. This requirement applies to TLS gateways (also known as SSL gateways) and is not applicable to VPN devices. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol, thus are in scope for this requirement. NIST SP 800-52 sets TLS version 1.1 as a minimum version, thus all versions of SSL are not allowed (including for client negotiation) either on DODDoW-only or on public-facing servers.

V-279178 in V1R2

Fix text

1. In the Edge SWG Web UI, navigate to the Administration tab. 2. Go to "Logging and Access Logging". 3. Scroll down to "Logs" and click "Edit" on the Main log. 4. Under "Upload Client", select "SCP". 5. Click "Open Settings" and configure the following variables: host, port, full path, username, and password. 6. Click "Apply and Test Upload". If there are connection issues, fix these before continuing. 7. Under "Transmission Parameters", select a signing certificate. This signing certificate must be the certificate used for SSL Proxying issued by the DODDoW WCF Certificate Authority (CA). 8. Check "Text File". 9. Under "Upload Schedule" select "Periodically". 10. Then, choose 5 seconds between connect attempts. 11. Select the "Daily interval" and select a time that works for the site SCP server. 12. Click "Upload Now" to test if the upload works. If there are connection issues, fix these before continuing. 13. Click "Apply and Save".

V-279187 in V1R2

Fix text

These procedures will create a user-defined exception page that will show only necessary errors to the proxy user with specific contact information. 1. Log in to the Edge SWG SSH CLI. 2. Enter "enable" and "configure terminal". 3. Enter "exceptions". 4. Enter "create DODDoW-BLOCKS". 5. Enter "edit DODDoW-BLOCKS". 6. Enter "inline format EOF". 7. Copy and paste the data below exactly as it appears and edit items such as Organization, email addresses, etc.: &lt!DOCTYPE html> &lthtml> &lthead> &lttitle>Denied Access Policy &lt/title> &ltmeta name= "author" content = "SAMPLE ORGANIZATION" > &ltmeta name="description" content = "Denied Access Policy" > &ltmeta name="category" content = "$(exception.category)"> &lt/head> &ltbody> &ltcenter> &ltp> &ltfont face = "Arial, Helvetica, sans-serif" size = "4" color = "Red" >&ltb>You have reached a website that is currently being blocked due to malicious activity and/or current acceptable use policies.&lt/font>&ltbr> &ltfont face= "Arial, Helvetica, sans-serif" size = "4" color = "Red">INTERNET USAGE IS MONITORED AND LOGGED.&lt/font>&ltbr> &ltfont face = "Arial, Helvetica, sans-serif" size = "3" color = "Red">&ltb>Your IP address: $(client.address) &ltbr>Your username: $(user.name) &ltbr> Banned Website: $(url) &ltbr> Website IP address: $(url.address)&ltbr>Banned Category: $(category) &ltbr> Rule Name: $(exception.id)&lt/b>&lt/font>&ltbr> &ltbr> &ltfont face = "Arial, Helvetica, sans-serif" size = "4" color = "red" > This has been reported by: $(proxy.name)&ltfont>&ltbr> &ltA href='mailto:email@mail.mil?subject=Barred web page $(url),IP address: $(client.address)&body=IP address:$(client.address)%0DYour username:$(user.name)%0DBanned Website:$(url)%0DWebsite IP address:$(url.address)%0DBanned Category:$(category)%0DRule Name:$(exception.id)' > If you have further questions or require assistance click here to send an email &ltbr> to your Information Management Office (IMO) or ORGANIZATION Cyber Security & Risk Management&lt/a>&lt/font>&lt/a>&lt/font> &lt/p> &lt/center> &lt/body> &lt/html> EOF 8. After the EOF, click "Enter". 9. Enter "http-code 403". 1. In the Edge SWG Web UI, navigate to the VPM. 2. Under the Web Access Layer for the Action on disallowed content, click "Set and Add New Object". 3. Select "Return Exception". 4. Enter a name and select "User-defined exception". 5. Select the previously created user-defined exception. 6. Check the box for "Force exception even if later policy would allow request". 7. Click "Set" and repeat steps for other services being proxied. 8. Click "Apply Policy".

V-279194 in V1R2

Fix text

1. In the Edge SWG Web UI, navigate to the Administration tab. 2. Click "Data and Cloud Services", then "Content Filtering". 3. Enable BlueCoat Content Filtering. 4. Click "BlueCoat" and check the box for "Always" under "Lookup Mode". 5. Test the download. If the URL cannot be reached, troubleshoot before proceeding to determine if there are networking, reachability, or routing issues. 1. In the Edge SWG Web UI, navigate to the VPM. 2. Go to the Web Access Layer. 3. Create a URL filter list rule if one has not been created, click "Add Rule". 4. For source use "Any". 5. Under "Destination", left-click and then click "Set". 6. Click "Add new Object and Request URL Category". 7. Enter a name and click the "BlueCoat" area. 8. Click each category that users will be blocked from accessing, then click "Apply and Set". 9. Under Service, click the "All HTTP" client protocol. 10. Click "Set". 11. Under "Action", click the "DODDoW-BLOCK" exception page previously created. 12. Under "Track", click the EventLog tracking previously created. 13. Repeat these steps for all other client protocol services for which forward proxying for users will be completed. 14. Click "Apply Policy".

Discussion

Remote access devices, such as those providing remote access to network devices and information systems, lack automated control capabilities, increase risk and make remote user access management difficult. Remote access is access to DODDoW-nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include broadband and wireless connections, for example, proxied remote encrypted traffic (e.g., TLS gateways, web content filters, and webmail proxies). This requirement applies to ALGs providing remote access proxy services as part of its intermediary services (e.g., OWA or TLS gateway). ALGs that proxy remote access must be capable of taking enforcement action (i.e., blocking, restricting, or forwarding to an enforcement mechanism) if traffic monitoring reveals unauthorized activity. Satisfies: SRG-NET-000313-ALG-000010, SRG-NET-000319-ALG-000153, SRG-NET-000364-ALG-000122, SRG-NET-000383-ALG-000135, SRG-NET-000385-ALG-000137, SRG-NET-000385-ALG-000138, SRG-NET-000390-ALG-000139, SRG-NET-000391-ALG-000140, SRG-NET-000392-ALG-000141, SRG-NET-000392-ALG-000142, SRG-NET-000392-ALG-000143, SRG-NET-000392-ALG-000147, SRG-NET-000392-ALG-000148

V-279203 in V1R2

Discussion

Without reauthentication, users may access resources or perform tasks for which they do not have authorization. In addition to the reauthentication requirements associated with session locks, organizations may require reauthentication of individuals and/or devices in other situations, including (but not limited to) the following circumstances: - When authenticators change. - When roles change. - When security categories of information systems change. - When the execution of privileged functions occurs. - After a fixed period of time. - Periodically. Within the DODDoW, the minimum circumstances requiring reauthentication are privilege escalation and role changes. This requirement only applies to components for which this is specific to the function of the device or has the concept of user authentication (e.g., VPN or ALG capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management). Satisfies: SRG-NET-000337-ALG-000096, SRG-NET-000344-ALG-000098

V-279216 in V1R2

Fix text

1. In the Edge SWG Web UI, navigate to the Configuration tab. 2. Go to SSL and OCSP. 3. Click "Add a Responder". 4. Under URL either set it to "from certificate" if routing to the DODINDOWIN is allowed, or if it is not, click the other items and add the local site's URL. 5. Under "Issuer CCL", select the one that includes all DODDoW ID CAs. 6. Under the "Response Cache TTL" is set it to either "from OCSP response" or to a value of 1 or more. 7. Ensure there are no Ignore Settings checked or enabled.

V-279217 in V1R2