STIGQter: STIG Summary: Network Infrastructure Policy Security Technical Implementation Guide Version: 9 Release: 10 Benchmark Date: 24 Jan 2020:

If the site has a non-DoD external connection (i.e. Approved Gateway), an Intrusion Detection and Prevention System (IDPS) must be located between the sites Approved Gateway and the perimeter router.

DISA Rule

SV-15259r4_rule

Vulnerability Number

V-14634

Group Title

External IDS/IPS must be installed in AG architecture.

Rule Version

NET0168

Severity

CAT II

CCI(s)

• CCI-001101 - The organization limits the number of external network connections to the information system.
• CCI-001121 - The organization protects against unauthorized physical connections at organization-defined managed interfaces.

Weight

10

Fix Recommendation

Install and configure an IDPS between the site’s Approved Gateway and the premise router.

Check Contents

Inspect the network topology and physical connectivity to verify compliance.

If the site has a non-DoD external connection and does not have an IDPS located between the site’s Approved Gateway and the perimeter router, this is a finding.

Note: An Approved Gateway (AG) is any external connection from a DoD NIPRNet enclave to an Internet Service Provider, or network owned by a contractor, or non-DoD federal agency that has been approved by either the DoD CIO or the DoD Component CIO. This AG requirement does not apply to commercial cloud connections when the Cloud Service Provider (CSP) network is connected via the NIPRNet Boundary Cloud Access Point (BCAP).

Vulnerability Number

V-14634

Documentable

False

Rule Version

NET0168

Severity Override Guidance

Inspect the network topology and physical connectivity to verify compliance.

If the site has a non-DoD external connection and does not have an IDPS located between the site’s Approved Gateway and the perimeter router, this is a finding.

Note: An Approved Gateway (AG) is any external connection from a DoD NIPRNet enclave to an Internet Service Provider, or network owned by a contractor, or non-DoD federal agency that has been approved by either the DoD CIO or the DoD Component CIO. This AG requirement does not apply to commercial cloud connections when the Cloud Service Provider (CSP) network is connected via the NIPRNet Boundary Cloud Access Point (BCAP).

Check Content Reference

M

Target Key

838

Comments