V2R2 changes
Trend Micro TippingPoint IDPS STIG V2R2 (2024-10-24) replaced V2R1 (2024-07-24): 8 checks removed, 5 updated. It has 30 checks, against 38 in V2R1.
V2R2 checklistV2R1 checklist Compare V2R1 and V2R2 in STIG Compare
- 0 added
- 8 removed
- 5 updated
Updated fields: CCIs 4Check text 2Fix text 2Discussion 2Title 1
Removed since V2R1 (8)
- V-242178CAT IIThe SMS must produce audit records containing sufficient information to establish what type of event occurred, including, at a minimum, event descriptions, policy filter, rule or signature invoked, port, protocol, and criticality level/alert code or description by sending all audit and system logs to a centralized syslog server.
- V-242179CAT IIThe SMS must produce audit records containing information to establish when (date and time) the events occurred by sending all audit and system logs to a centralized syslog server.
- V-242180CAT IIThe SMS must produce audit records containing information to establish where the event was detected, including, at a minimum, network segment, destination address, and TPS component which detected the event by sending all audit and system logs to a centralized syslog server.
- V-242181CAT IIThe SMS must produce audit records containing information to establish the source of the event, including, at a minimum, originating source address by sending all audit and system logs to a centralized syslog server.
- V-242182CAT IIThe SMS must produce audit records containing information to establish the outcome of events associated with detected harmful or potentially harmful traffic, including, at a minimum, capturing all associated communications traffic by sending all audit and system logs to a centralized syslog server.
- V-242184CAT IIThe TPS and SMS must off-load log records to a centralized log server.
- V-242185CAT IIIn the event of a logging failure, caused by loss of communications with the central logging server, the SMS must queue audit records locally by using the syslog over TCP protocol until communication is restored or until the audit records are retrieved manually or using automated synchronization tools.
- V-242200CAT IISMS and TPS components, including sensors, event databases, and management consoles must integrate with a network-wide monitoring capability.
Updated in V2R2 (5)
V-242176CAT IIThe TPS must provide audit record generation capability for detection events based on implementation of policy filters, rules, signatures, and anomaly analysis.Check text, Fix text, Discussion, CCIs
Check text
1. In the Trend Micro SMS interface,:
1. goGo to the "Admin" tab, and select "Server Properties".
2. Select the "syslogSyslog" tab. If
3. aNavigate syslogto serverDevice isAudit not>> configuredDevice toSystem send>> theSMS followingAudit audit>> logs,SMS thissystem.
4. isReview athe finding:
-settings Devicefor Auditall syslogs servers.
-
If Deviceeach Systemsyslog
-server SMSis Auditnot
-configured SMSto systemuse TCP or Encrypted TCP, this is a finding.
Fix text
1. In the Trend Micro SMS interface,
1. goGo to the "Admin" tab, and select "Server Properties".
2. Select the "syslog" tab.
3. Click "New".
4. Under syslog server, type the hostname or IP address of the syslog server. (If using Encrypted TCP, and depending on the syslog server, enter the hostname, if needed).
5. Click "TCP" to ensure logging data is queued in the case of disconnection of the syslog server.
6. Type the port used by the centralized logging server (traditionally it is port 514 for TCP and 6514 for Encrypted TCP).
7. Under log type, select "Device Audit".
8. Repeat steps to configure all syslog servers.
9. Under facility click "Log Audit".
910. Click Event timestamp under "Include Timestamp in Header".
1011. Select "include SMS hostname in header".
Repeat this oncethree more, changingtimes to change the Log Type to include Device System, SMS Audit, and SMS System.
Discussion
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.
While auditing and logging are closely related, they are not the same. Logging is recording data about events that take place in a system, while auditing is the use of log records to identify security-relevant information such as system or user accesses. In short, log records are audited to establish an accurate history. Without logging, it would be impossible to establish an audit trail.
The TPS musthas have the capability to capture and log detected security violations and potential security violations. DOD requires TCP at a minimum, but if operational needs permit, Encrypted TCP (also called TLS Syslog) is also supported.
CCIs
CCI-000169CCI-001851,CCI-000169,CCI-000130,CCI-000131,CCI-000132,CCI-000133,CCI-000134,CCI-000140,CCI-002656
V-242188CAT IIThe SMS must be configured to remove or disable nonessential capabilities on SMS and TPS, which are not required for operation or not related to IDPS functionality.Title, Check text, Fix text, Discussion
Title
The SMS must be configured to remove or disable non-essentialnonessential capabilities on SMS and TPS, which are not required for operation or not related to IDPS functionality (e.g., web server, SSH, telnet, and TAXII).
Check text
1. In the Trend Micro SMS interface, go to the "Devices" tab".
2. Select the Device to be modified.
3. Click "Device Configuration" and "Services".
If SSHHTTPS isor enabled,TAXII thisare is a finding.
Under "FIPS Settings"enabled, if the box is unchecked, this is a finding.
Fix text
1. In the Trend Micro SMS interface, go to the "Devices" tab".
2. Then Select the Devicedevice to be modified.
3. Click "Device Configuration" and "Services".
4. Uncheck enabled for SSHHTTPS and TAXII.
5. GoUnder toSSH "FIPSensure Settings",SSH selectLogin "enabled"Grace for Time"FIPS Mode".is
6.set Clickto OK.60
CAUTION:and This"SSH shouldMax beAuthentication doneAttempts" underis anset approvedto maintenance"3".
6. window,Click as selecting FIPS Mode will cause the TPS to reboot"OK".
Discussion
An IDPS can be capable of providing a wide variety of capabilities. Not all of these capabilities are necessary. Unnecessary services, functions, and applications increase the attack surface (sum of attack vectors) of a system. These unnecessary capabilities are often overlooked and therefore, may remain unsecured. Examples of unneeded services on TPS are web server, telnet, and TAXII.
V-242196CAT IIThe TPS must automatically install updates to signature definitions, detection heuristics, and vendor-provided rules.CCIs
V-242197CAT IThe SMS must install updates on the TPS for application software files, signature definitions, detection heuristics, and vendor-provided rules when new releases are available in accordance with organizational configuration management policy and procedures.CCIs
V-242199CAT IThe TPS must generate a log record so an alert can be configured to, at a minimum, the system administrator when malicious code is detected.CCIs
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R2 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.