STIGQter: STIG Summary: Juniper SRX SG IDPS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 28 Jul 2017:

The Juniper Networks SRX Series Gateway IDPS must detect, at a minimum, mobile code that is unsigned or exhibiting unusual behavior, has not undergone a risk assessment, or is prohibited for use based on a risk assessment.

DISA Rule

SV-80893r1_rule

Vulnerability Number

V-66403

Group Title

SRG-NET-000228-IDPS-00196

Rule Version

JUSX-IP-000008

Severity

CAT II

CCI(s)

• CCI-001166 - The information system identifies organization-defined unacceptable mobile code.

Weight

10

Fix Recommendation

Specify a name for the attack. Specify common properties for the attack. Specify the attack type and context. Specify the attack direction and the shellcode flag. Set the protocol and its fields. Specify the protocol binding and ports. Specify the direction.

[edit]
edit security idp custom-attack <signature-name>
set severity major
set recommended-action drop-packet
set time-binding scope source count 10
set attack-type signature context packet
set attack-type signature shellcode intel
set attack-type signature protocol ip ttl value 128 match equal
set attack-type signature protocol-binding tcp minimum-port 50 maximum-port 100
set attack-type signature direction any

Check Contents

From operational mode, enter the following command to verify that the signature-based attack object was created:

show security idp policies

If signature-based attack objects are not created and used, this is a finding.

Vulnerability Number

V-66403

Documentable

False

Rule Version

JUSX-IP-000008

Severity Override Guidance

From operational mode, enter the following command to verify that the signature-based attack object was created:

show security idp policies

If signature-based attack objects are not created and used, this is a finding.

Check Content Reference

M

Target Key

3037

Comments