STIGQter: STIG Summary: Symantec ProxySG ALG Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Apr 2020:

Symantec ProxySG must block outbound traffic containing known and unknown denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.

DISA Rule

SV-104275r1_rule

Vulnerability Number

V-94321

Group Title

SRG-NET-000192-ALG-000121

Rule Version

SYMP-AG-000540

Severity

CAT II

CCI(s)

• CCI-001094 - The information system restricts the ability of individuals to launch organization-defined denial of service attacks against other information systems.

Weight

10

Fix Recommendation

Enable the Attack Detection function.

1. SSH into the ProxySG console and type "enable".
2. Enter the correct password and type "configure terminal".
3. Press "Enter" and type "attack-detection".
4. Type "client" and press "Enter". Type "enable-limits" and press "Enter".

Note: See the ProxySG Administration Guide, Chapter 73: Preventing Denial of Service Attacks, to understand the functionality before proceeding. Fine-tune the default client limits if there is an operational impact.

Check Contents

Verify that Attack Detection is enabled.

1. SSH into the ProxySG console and type "enable".
2. Enter the correct password and type "configure terminal".
3. Press "Enter" and type "show attack-detection configuration".
4. Verify that "client limits enabled" equals "true".

If Symantec ProxySG does not block outbound traffic containing known and unknown DoS attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints, this is a finding.

Vulnerability Number

V-94321

Documentable

False

Rule Version

SYMP-AG-000540

Severity Override Guidance

Verify that Attack Detection is enabled.

1. SSH into the ProxySG console and type "enable".
2. Enter the correct password and type "configure terminal".
3. Press "Enter" and type "show attack-detection configuration".
4. Verify that "client limits enabled" equals "true".

If Symantec ProxySG does not block outbound traffic containing known and unknown DoS attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints, this is a finding.

Check Content Reference

M

Target Key

3515

Comments