STIGQter STIGQter: STIG Summary: Symantec ProxySG ALG Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Apr 2020:

Symantec ProxySG providing forward proxy intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52.

DISA Rule

SV-104175r1_rule

Vulnerability Number

V-94221

Group Title

SRG-NET-000062-ALG-000150

Rule Version

SYMP-AG-000030

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure TLS forward proxy intermediary services to comply with NIST SP 800-52 TLS settings.

1. Log on to the Web Management Console.
2. Click Configuration >> Visual Policy Manager.
3. Click "Launch". While in the Visual Policy Manager, click Policy >> Add SSL Access Layer.
4. Right-click the "Source" field of the existing rule and select "Set". Click "New" and select "Combined Source Object".
5. Click "New" and select "Client Negotiated Cipher". Select all ciphers that should be permitted and click "OK".
6. Click the upper "Add" button and click the "Negate" checkbox.
7. Click "New" and select "Client Negotiated SSL Version". Select all SSL versions that should be permitted and click "OK".
8. Click the upper "Add" button.
9. Click "OK" and then "OK" again.
10. Repeat steps 4 to 9 for the "Destination" field, using the "Server Negotiated Cipher" and "Server Negotiated SSL Version" objects.
11. Right-click the "Action" field of the rule, click "Set", and select "Deny".
12. Click File >> Install Policy on SG Appliance.

Check Contents

Verify that TLS forward proxy intermediary services are configured to comply with NIST 800-52 TLS settings.

1. Log on to the Web Management Console.
2. Click Configuration >> Visual Policy Manager.
3. Click "Launch". While in the Visual Policy Manager, for each SSL Access Layer that is configured, Verify there is a rule with an action set to "Deny" that also has "Source" and "Destination" fields that contain restricted SSL/TLS protocols and ciphers.

If Symantec ProxySG providing forward proxy intermediary services for TLS is not configured to comply with the required TLS settings in NIST SP 800-52, this is a finding.

Vulnerability Number

V-94221

Documentable

False

Rule Version

SYMP-AG-000030

Severity Override Guidance

Verify that TLS forward proxy intermediary services are configured to comply with NIST 800-52 TLS settings.

1. Log on to the Web Management Console.
2. Click Configuration >> Visual Policy Manager.
3. Click "Launch". While in the Visual Policy Manager, for each SSL Access Layer that is configured, Verify there is a rule with an action set to "Deny" that also has "Source" and "Destination" fields that contain restricted SSL/TLS protocols and ciphers.

If Symantec ProxySG providing forward proxy intermediary services for TLS is not configured to comply with the required TLS settings in NIST SP 800-52, this is a finding.

Check Content Reference

M

Target Key

3515

Comments