STIGQter: STIG Summary: CA API Gateway ALG Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 28 Apr 2017:

The CA API Gateway providing content filtering must integrate with an ICAP-enabled Intrusion Detection System that updates malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.

DISA Rule

SV-85999r1_rule

Vulnerability Number

V-71375

Group Title

SRG-NET-000246-ALG-000132

Rule Version

CAGW-GW-000430

Severity

CAT II

CCI(s)

• CCI-001240 - The organization updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures.

Weight

10

Fix Recommendation

Open the CA API GW - Policy Manager and double-click any of the Registered Services that did not have the "Scan Using ICAP-Enabled Antivirus" Assertion.

Add the "Scan Using ICAP-Enabled Antivirus" Assertion.

Add the list of ICAP Scanning servers to the Server list in the following format: "icap://<servername:port/avscan", and configure the additional parameters for the Assertion in accordance with organizational requirements.

Click the "Save and Activate" button.

If the organization requires that all Registered Services require this ability, consider adding the "Scan Using ICAP-Enabled Antivirus" Assertion to a Global Policy to meet this requirement.

Check Contents

Open the CA API GW - Policy Manager and double-click any of the Registered Services that require updating of malicious code mechanisms and signatures.

Verify the "Scan Using ICAP-Enabled Antivirus" Assertion is included in the policy. Check that the list of ICAP Servers has been configured to include servers listed in the following format: "icap://<servername:port/avscan".

Also, verify all other options have been configured in accordance with organizational requirements. If not, check to see if the assertion has been added to a Global Policy and configured properly.

If the "Scan Using ICAP-Enabled Antivirus" Assertion is not present in either Global or Registered Services policy, this is a finding.

Vulnerability Number

V-71375

Documentable

False

Rule Version

CAGW-GW-000430

Severity Override Guidance

Open the CA API GW - Policy Manager and double-click any of the Registered Services that require updating of malicious code mechanisms and signatures.

Verify the "Scan Using ICAP-Enabled Antivirus" Assertion is included in the policy. Check that the list of ICAP Servers has been configured to include servers listed in the following format: "icap://<servername:port/avscan".

Also, verify all other options have been configured in accordance with organizational requirements. If not, check to see if the assertion has been added to a Global Policy and configured properly.

If the "Scan Using ICAP-Enabled Antivirus" Assertion is not present in either Global or Registered Services policy, this is a finding.

Check Content Reference

M

Target Key

3049

Comments