STIGQter: STIG Summary: Juniper SRX SG IDPS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 28 Jul 2017:

The Juniper Networks SRX Series Gateway IDPS must install updates for predefined signature objects, applications signatures, IDPS policy templates, and device software when new releases are available in accordance with organizational configuration management policy and procedures.

DISA Rule

SV-80499r1_rule

Vulnerability Number

V-66009

Group Title

SRG-NET-000246-IDPS-00205

Rule Version

JUSX-IP-000010

Severity

CAT I

CCI(s)

• CCI-001240 - The organization updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures.

Weight

10

Fix Recommendation

Since DoD does not allow the management port of security devices to be connected directly to the Internet, the required security package must be uploaded using the Juniper SRX offline process.

Directions are available in the document “How to perform offline IDP and Application signature database update in SRX” on the Juniper Networks support site. DoD network policy requires a local file repository be used to automate the update for network devices.

Before uploading updates, the IDP administrator must verify the updates are approved by the site's CCB procedures and are authorized for installation. Once all files have been downloaded and approved, install the security package on SRX from root.

Request security idp security-package install source-path /var/db/idpd/sec-download

Check Contents

To check the version of the security package installed, enter the following command from the root on the device:

show security idp security-package-version

Compare the installed release with the latest available and approved release.

If a new release is available and not installed, this is a finding.

Vulnerability Number

V-66009

Documentable

False

Rule Version

JUSX-IP-000010

Severity Override Guidance

To check the version of the security package installed, enter the following command from the root on the device:

show security idp security-package-version

Compare the installed release with the latest available and approved release.

If a new release is available and not installed, this is a finding.

Check Content Reference

M

Target Key

3037

Comments