STIGQter: STIG Summary: Riverbed SteelHead CX v8 NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 25 Oct 2019:

Riverbed Optimization System (RiOS) must generate alerts that can be forwarded to the administrators and ISSO when accounts are disabled.

DISA Rule

SV-77341r1_rule

Vulnerability Number

V-62851

Group Title

SRG-APP-000293-NDM-000277

Rule Version

RICX-DM-000013

Severity

CAT III

CCI(s)

• CCI-001685 - The information system notifies organization-defined personnel or roles for account disabling actions.

Weight

10

Fix Recommendation

Configure RiOS to use automated mechanisms to alert security personnel to threats identified by authoritative sources.

Navigate to the device Management Console
Navigate to Configure >> System Settings >> SNMP Basic
Click "Add a New Trap Receiver"
Set "Receiver IP Address" to the address of the trap receiver
Set "Destination Port:" to the port that the Trap Receiver is listening on
Set "Receiver Type:" to v3
Set "Remote User:" to the user name on the Trap Receiver
Set "Authentication:" to <Supply a key based>
Set "Authentication Protocol:" to SHA
SHA Key: <enter the SHA key>
Set "Security Level:" to Auth/Priv
Set "Privacy Protocol:" to "AES"
Set "Privacy:" to Select "same as Authentication Key"
Set "Enable Receiver"
Click "Add"

Navigate to the top of the web page and click "Save" to save these settings permanently.

Check Contents

Verify that RiOS uses automated mechanisms to alert security personnel to threats identified by authoritative sources.

Navigate to the device Management Console
Navigate to Configure >> System Settings >> SNMP Basic

Verify that Host Servers are defined in the section "Trap Receivers"

If there are no Host Servers defined in "Trap Receivers", this is a finding.

Vulnerability Number

V-62851

Documentable

False

Rule Version

RICX-DM-000013

Severity Override Guidance

Verify that RiOS uses automated mechanisms to alert security personnel to threats identified by authoritative sources.

Navigate to the device Management Console
Navigate to Configure >> System Settings >> SNMP Basic

Verify that Host Servers are defined in the section "Trap Receivers"

If there are no Host Servers defined in "Trap Receivers", this is a finding.

Check Content Reference

M

Target Key

2931

Comments