What changed in Trend Micro Deep Security 9.x STIG V2R1V2R1 changes

Trend Micro Deep Security 9.x STIG V2R1 (2024-01-24) replaced V1R1 (2016-02-26): 85 checks added, 85 removed. It has 85 checks, against 85 in V1R1.

V2R1 checklistV1R1 checklist Compare V1R1 and V2R1 in STIG Compare

  • 85 added
  • 85 removed
  • 0 updated

Added in V2R1 (85)

  • V-241108CAT IITrend Deep Security must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.
  • V-241109CAT IITrend Deep Security must initiate a session lock after a 15-minute period of inactivity.
  • V-241110CAT IITrend Deep Security must provide automated mechanisms for supporting account management functions.
  • V-241111CAT IITrend Deep Security must automatically audit account creation.
  • V-241112CAT IITrend Deep Security must automatically audit account modification.
  • V-241113CAT IITrend Deep Security must automatically audit account disabling actions.
  • V-241114CAT IITrend Deep Security must automatically audit account removal actions.
  • V-241115CAT IITrend Deep Security must enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.
  • V-241116CAT IITrend Deep Security must enforce approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.
  • V-241117CAT IITrend Deep Security must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period.
  • V-241118CAT IITrend Deep Security must scan all media used for system maintenance prior to use.
  • V-241119CAT IITrend Deep Security must provide audit record generation capability for DoD-defined auditable events within all application components.
  • V-241120CAT IITrend Deep Security must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
  • V-241121CAT IITrend Deep Security must generate audit records when successful/unsuccessful attempts to access privileges occur.
  • V-241122CAT IITrend Deep Security must initiate session auditing upon startup.
  • V-241123CAT IITrend Deep Security must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
  • V-241124CAT IITrend Deep Security must protect audit information from any type of unauthorized read access.
  • V-241125CAT IITrend Deep Security must protect audit information from unauthorized modification.
  • V-241126CAT IITrend Deep Security must protect audit information from unauthorized deletion.
  • V-241127CAT IITrend Deep Security must protect audit tools from unauthorized access.
  • V-241128CAT IITrend Deep Security must protect audit tools from unauthorized modification.
  • V-241129CAT IITrend Deep Security must protect audit tools from unauthorized deletion.
  • V-241130CAT IITrend Deep Security must back up audit records at least every seven days onto a different system or system component than the system or component being audited.
  • V-241131CAT ITrend Deep Security must use cryptographic mechanisms to protect the integrity of audit information.
  • V-241132CAT IITrend Deep Security must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
  • V-241133CAT IITrend Deep Security must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
  • V-241134CAT IITrend Deep Security must enforce a minimum 15-character password length.
  • V-241135CAT IITrend Deep Security must enforce password complexity by requiring that at least one upper-case character be used.
  • V-241136CAT IITrend Deep Security must enforce password complexity by requiring that at least one lower-case character be used.
  • V-241137CAT IITrend Deep Security must enforce password complexity by requiring that at least one numeric character be used.
  • V-241138CAT IITrend Deep Security must enforce password complexity by requiring that at least one special character be used.
  • V-241139CAT IITrend Deep Security must enforce a 60-day maximum password lifetime restriction.
  • V-241140CAT IITrend Deep Security must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).
  • V-241141CAT IITrend Deep Security must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged session), the session must be terminated after 15 minutes of inactivity, except to fulfill documented and validated mission requirements.
  • V-241142CAT IITrend Deep Security must isolate security functions from non-security functions.
  • V-241143CAT IITrend Deep Security must restrict the ability of individuals to use information systems to launch organization-defined Denial of Service (DoS) attacks against other information systems.
  • V-241144CAT IITrend Deep Security must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks.
  • V-241145CAT IITrend Deep Security must automatically update malicious code protection mechanisms.
  • V-241146CAT IITrend Deep Security must notify ISSO and ISSM of failed security verification tests.
  • V-241147CAT IITrend Deep Security must update malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures.
  • V-241148CAT IITrend Deep Security must configure malicious code protection mechanisms to perform periodic scans of the information system every seven (7) days.
  • V-241149CAT IITrend Deep Security must be configured to perform real-time malicious code protection scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy.
  • V-241150CAT IITrend Deep Security must be configured to block and quarantine malicious code upon detection, then send an immediate alert to appropriate individuals.
  • V-241151CAT IITrend Deep Security must notify System Administrators and Information System Security Officers when accounts are created.
  • V-241152CAT IITrend Deep Security must notify System Administrators and Information System Security Officers when accounts are modified.
  • V-241153CAT IITrend Deep Security must notify System Administrators and Information System Security Officers for account disabling actions.
  • V-241154CAT IITrend Deep Security must notify System Administrators and Information System Security Officers for account removal actions.
  • V-241155CAT IITrend Deep Security must automatically audit account enabling actions.
  • V-241156CAT IITrend Deep Security must notify SA and ISSO of account enabling actions.
  • V-241157CAT IITrend Deep Security must audit the execution of privileged functions.
  • V-241158CAT IITrend Deep Security must off-load audit records onto a different system or media than the system being audited.
  • V-241159CAT IITrend Deep Security must provide an immediate warning to the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.
  • V-241160CAT IITrend Deep Security must provide an immediate real-time alert to the SA and ISSO, at a minimum, of all audit failure events requiring real-time alerts.
  • V-241161CAT IITrend Deep Security must alert the ISSO, ISSM, and other designated personnel (deemed appropriate by the local organization) when the unauthorized installation of software is detected.
  • V-241162CAT IITrend Deep Security must prohibit user installation of software without explicit privileged status.
  • V-241163CAT IITrend Deep Security must implement organization-defined automated security responses if baseline configurations are changed in an unauthorized manner.
  • V-241164CAT IITrend Deep Security must enforce access restrictions associated with changes to application configuration.
  • V-241165CAT IITrend Deep Security must audit the enforcement actions used to restrict access associated with changes to the application.
  • V-241166CAT IITrend Deep Security must only allow the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions.
  • V-241167CAT IITrend Deep Security must maintain a separate execution domain for each executing process.
  • V-241168CAT IITrend Deep Security must protect against or limit the effects of all types of Denial of Service (DoS) attacks by employing organization-defined security safeguards.
  • V-241169CAT IITrend Deep Security must implement organization-defined security safeguards to protect its memory from unauthorized code execution.
  • V-241170CAT IITrend Deep Security must install security-relevant software updates within the time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).
  • V-241171CAT IITrend Deep Security detection application must detect network services that have not been authorized or approved by the organization-defined authorization or approval processes.
  • V-241172CAT IITrend Deep Security must, when unauthorized network services are detected, log the event and alert the ISSO, ISSM, and other individuals designated by the local organization.
  • V-241173CAT IITrend Deep Security must continuously monitor inbound communications traffic for unusual or unauthorized activities or conditions.
  • V-241174CAT IITrend Deep Security must alert the ISSO, ISSM, and other individuals designated by the local organization when the following Indicators of Compromise (IOCs) or potential compromise are detected: real-time intrusion detection; threats identified by authoritative sources (e.g., CTOs); and Category I, II, IV, and VII incidents in accordance with CJCSM 6510.01B.
  • V-241175CAT IITrend Deep Security must generate audit records when successful/unsuccessful attempts to modify privileges occur.
  • V-241176CAT IITrend Deep Security must generate audit records when successful/unsuccessful attempts to modify security objects occur.
  • V-241177CAT IITrend Deep Security must generate audit records when successful/unsuccessful attempts to modify security levels occur.
  • V-241178CAT IITrend Deep Security must generate audit records when successful/unsuccessful attempts to delete privileges occur.
  • V-241179CAT IITrend Deep Security must generate audit records when successful/unsuccessful attempts to delete security objects occur.
  • V-241180CAT IITrend Deep Security must generate audit records when successful/unsuccessful logon attempts occur.
  • V-241181CAT IITrend Deep Security must generate audit records for privileged activities or other system-level access.
  • V-241182CAT IITrend Deep Security must generate audit records when successful/unsuccessful accesses to objects occur.
  • V-241183CAT IITrend Deep Security must generate audit records for all direct access to the information system.
  • V-241184CAT IITrend Deep Security must generate audit records for all account creations, modifications, disabling, and termination events.
  • V-241185CAT IITrend Deep Security must generate audit records for all kernel module load, unload, and restart events and, also for all program initiations.
  • V-241186CAT IITrend Deep Security must, at a minimum, off-load interconnected systems in real time and off-load standalone systems weekly.
  • V-241187CAT IITrend Deep Security must notify the system administrator when anomalies in the operation of the security functions are discovered.
  • V-241188CAT IITrend Deep Security must implement security safeguards when integrity violations are discovered.
  • V-241189CAT IITrend Deep Security must synchronize with Active Directory on a daily (or AO-defined) basis.
  • V-241190CAT ITrend Deep Security must reside on a Web Server configured for multifactor authentication.
  • V-241191CAT ITrend Deep Security must ensure users are authenticated with an individual authenticator prior to using a group authenticator.
  • V-259713CAT IThe version of Trend Deep Security running on the system must be a supported version.

Removed since V1R1 (85)

  • V-65857CAT IITrend Deep Security must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.
  • V-65859CAT IITrend Deep Security must initiate a session lock after a 15-minute period of inactivity.
  • V-65861CAT IITrend Deep Security must automatically audit account creation.
  • V-65863CAT IITrend Deep Security must automatically audit account modification.
  • V-65865CAT IITrend Deep Security must automatically audit account disabling actions.
  • V-65867CAT IITrend Deep Security must automatically audit account removal actions.
  • V-65869CAT IITrend Deep Security must enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.
  • V-65871CAT IITrend Deep Security must enforce approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.
  • V-65873CAT IITrend Deep Security must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period.
  • V-65875CAT IITrend Deep Security must provide audit record generation capability for DoD-defined auditable events within all application components.
  • V-65877CAT IITrend Deep Security must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
  • V-65879CAT IITrend Deep Security must generate audit records when successful/unsuccessful attempts to access privileges occur.
  • V-65881CAT IITrend Deep Security must initiate session auditing upon startup.
  • V-65883CAT IITrend Deep Security must provide the capability for authorized users to capture, record, and log all content related to a user session.
  • V-65885CAT IITrend Deep Security must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
  • V-65887CAT IITrend Deep Security must protect audit information from any type of unauthorized read access.
  • V-65889CAT IITrend Deep Security must protect audit information from unauthorized modification.
  • V-65891CAT IITrend Deep Security must protect audit information from unauthorized deletion.
  • V-65893CAT IITrend Deep Security must protect audit tools from unauthorized access.
  • V-65895CAT IITrend Deep Security must protect audit tools from unauthorized modification.
  • V-65897CAT IITrend Deep Security must protect audit tools from unauthorized deletion.
  • V-65899CAT IITrend Deep Security must back up audit records at least every seven days onto a different system or system component than the system or component being audited.
  • V-65901CAT ITrend Deep Security must use cryptographic mechanisms to protect the integrity of audit information.
  • V-65903CAT IITrend Deep Security must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
  • V-65905CAT IITrend Deep Security must scan all media used for system maintenance prior to use.
  • V-65907CAT IITrend Deep Security must provide automated mechanisms for supporting account management functions.
  • V-65909CAT IITrend Deep Security must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
  • V-65913CAT ITrend Deep Security must ensure users are authenticated with an individual authenticator prior to using a group authenticator.
  • V-65915CAT IITrend Deep Security must enforce a minimum 15-character password length.
  • V-65917CAT IITrend Deep Security must enforce password complexity by requiring that at least one upper-case character be used.
  • V-65919CAT IITrend Deep Security must enforce password complexity by requiring that at least one numeric character be used.
  • V-65921CAT IITrend Deep Security must enforce password complexity by requiring that at least one special character be used.
  • V-65925CAT IITrend Deep Security must enforce a 60-day maximum password lifetime restriction.
  • V-65927CAT IITrend Deep Security must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).
  • V-65929CAT IITrend Deep Security must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged session), the session must be terminated after 15 minutes of inactivity, except to fulfill documented and validated mission requirements.
  • V-65931CAT IITrend Deep Security must isolate security functions from non-security functions.
  • V-65933CAT IITrend Deep Security must restrict the ability of individuals to use information systems to launch organization-defined Denial of Service (DoS) attacks against other information systems.
  • V-65935CAT IITrend Deep Security must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks.
  • V-65937CAT IITrend Deep Security must automatically update malicious code protection mechanisms.
  • V-65939CAT IITrend Deep Security must notify ISSO and ISSM of failed security verification tests.
  • V-65941CAT IITrend Deep Security must update malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures.
  • V-65943CAT IITrend Deep Security must configure malicious code protection mechanisms to perform periodic scans of the information system every seven (7) days.
  • V-65945CAT IITrend Deep Security must be configured to perform real-time malicious code protection scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy.
  • V-65947CAT IITrend Deep Security must be configured to block and quarantine malicious code upon detection, then send an immediate alert to appropriate individuals.
  • V-65949CAT IITrend Deep Security must notify System Administrators and Information System Security Officers when accounts are created.
  • V-65951CAT IITrend Deep Security must notify System Administrators and Information System Security Officers when accounts are modified.
  • V-65953CAT IITrend Deep Security must notify System Administrators and Information System Security Officers for account disabling actions.
  • V-65955CAT IITrend Deep Security must notify System Administrators and Information System Security Officers for account removal actions.
  • V-65957CAT IITrend Deep Security must automatically audit account enabling actions.
  • V-65959CAT IITrend Deep Security must notify SA and ISSO of account enabling actions.
  • V-65967CAT IITrend Deep Security must audit the execution of privileged functions.
  • V-65969CAT IITrend Deep Security must off-load audit records onto a different system or media than the system being audited.
  • V-65971CAT IITrend Deep Security must provide an immediate warning to the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.
  • V-65973CAT IITrend Deep Security must provide an immediate real-time alert to the SA and ISSO, at a minimum, of all audit failure events requiring real-time alerts.
  • V-65975CAT IITrend Deep Security must alert the ISSO, ISSM, and other designated personnel (deemed appropriate by the local organization) when the unauthorized installation of software is detected.
  • V-65977CAT IITrend Deep Security must prohibit user installation of software without explicit privileged status.
  • V-65979CAT IITrend Deep Security must implement organization-defined automated security responses if baseline configurations are changed in an unauthorized manner.
  • V-65981CAT IITrend Deep Security must enforce access restrictions associated with changes to application configuration.
  • V-65983CAT IITrend Deep Security must audit the enforcement actions used to restrict access associated with changes to the application.
  • V-65985CAT IITrend Deep Security must only allow the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions.
  • V-65987CAT IITrend Deep Security must maintain a separate execution domain for each executing process.
  • V-65989CAT IITrend Deep Security must protect against or limit the effects of all types of Denial of Service (DoS) attacks by employing organization-defined security safeguards.
  • V-65991CAT IITrend Deep Security must implement organization-defined security safeguards to protect its memory from unauthorized code execution.
  • V-65993CAT IITrend Deep Security must install security-relevant software updates within the time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).
  • V-65995CAT IITrend Deep Security detection application must detect network services that have not been authorized or approved by the organization-defined authorization or approval processes.
  • V-65997CAT IITrend Deep Security must, when unauthorized network services are detected, log the event and alert the ISSO, ISSM, and other individuals designated by the local organization.
  • V-65999CAT IITrend Deep Security must continuously monitor inbound communications traffic for unusual or unauthorized activities or conditions.
  • V-66001CAT IITrend Deep Security must alert the ISSO, ISSM, and other individuals designated by the local organization when the following Indicators of Compromise (IOCs) or potential compromise are detected: real-time intrusion detection; threats identified by authoritative sources (e.g., CTOs); and Category I, II, IV, and VII incidents in accordance with CJCSM 6510.01B.
  • V-66005CAT IITrend Deep Security must notify the system administrator when anomalies in the operation of the security functions are discovered.
  • V-66007CAT IITrend Deep Security must implement security safeguards when integrity violations are discovered.
  • V-66011CAT IITrend Deep Security must generate audit records when successful/unsuccessful attempts to modify privileges occur.
  • V-66013CAT IITrend Deep Security must generate audit records when successful/unsuccessful attempts to modify security objects occur.
  • V-66017CAT IITrend Deep Security must generate audit records when successful/unsuccessful attempts to modify security levels occur.
  • V-66019CAT IITrend Deep Security must generate audit records when successful/unsuccessful attempts to delete privileges occur.
  • V-66023CAT IITrend Deep Security must generate audit records when successful/unsuccessful attempts to delete security objects occur.
  • V-66025CAT IITrend Deep Security must generate audit records when successful/unsuccessful logon attempts occur.
  • V-66027CAT IITrend Deep Security must generate audit records for privileged activities or other system-level access.
  • V-66029CAT IITrend Deep Security must generate audit records when successful/unsuccessful accesses to objects occur.
  • V-66031CAT IITrend Deep Security must generate audit records for all direct access to the information system.
  • V-66033CAT IITrend Deep Security must generate audit records for all account creations, modifications, disabling, and termination events.
  • V-66035CAT IITrend Deep Security must generate audit records for all kernel module load, unload, and restart events and, also for all program initiations.
  • V-66037CAT IITrend Deep Security must, at a minimum, off-load interconnected systems in real time and off-load standalone systems weekly.
  • V-66043CAT IITrend Deep Security must synchronize with Active Directory on a daily (or AO-defined) basis.
  • V-66045CAT ITrend Deep Security must reside on a Web Server configured for multifactor authentication.
  • V-66047CAT IITrend Deep Security must enforce password complexity by requiring that at least one lower-case character be used.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R1 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.