STIGQter: STIG Summary: Symantec ProxySG ALG Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Apr 2020:

Symantec ProxySG must identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems.

DISA Rule

SV-104283r1_rule

Vulnerability Number

V-94329

Group Title

SRG-NET-000370-ALG-000125

Rule Version

SYMP-AG-000580

Severity

CAT II

CCI(s)

• CCI-002400 - The information system audits the identity of internal users associated with denied outgoing communications traffic posing a threat to external information systems.

Weight

10

Fix Recommendation

Configure the ProxySG to log user web traffic for auditing.

1. Log on to the Web Management Console.
2. Browse to "Configuration" and click "Access Logging". Check the "Enable Access Logging" option and click "Apply".
3. Click Policy >> Visual Policy Manager >> Launch.
4. For each Web Access Layer, right-click the "Track" column for each rule that has "Action" set to "Deny" and "Destination" defined as a restricted set of potentially threatening destinations and select "Set".
5. Click "New" and select "Event Log".

Check Contents

Verify that the ProxySG is configured to log user web traffic for auditing.

1. Log on to the Web Management Console.
2. Browse to "Configuration" and click "Access Logging". Verify that "Enable Access Logging" is checked.
3. Click Policy >> Visual Policy Manager >> Launch.
4. For each Web Access Layer, verify that each rule that has "Action" set to "Deny" and "Destination" defined as a restricted set of potentially threatening destinations has a value other than "none" in the "Track".

If Symantec ProxySG does not identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems, this is a finding.

Vulnerability Number

V-94329

Documentable

False

Rule Version

SYMP-AG-000580

Severity Override Guidance

Verify that the ProxySG is configured to log user web traffic for auditing.

1. Log on to the Web Management Console.
2. Browse to "Configuration" and click "Access Logging". Verify that "Enable Access Logging" is checked.
3. Click Policy >> Visual Policy Manager >> Launch.
4. For each Web Access Layer, verify that each rule that has "Action" set to "Deny" and "Destination" defined as a restricted set of potentially threatening destinations has a value other than "none" in the "Track".

If Symantec ProxySG does not identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems, this is a finding.

Check Content Reference

M

Target Key

3515

Comments