STIGQter: STIG Summary: CA API Gateway ALG Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 28 Apr 2017:

The CA API Gateway providing content filtering must be configured to perform real-time scans of files from external sources at network entry/exit points as they are downloaded and prior to being opened or executed.

DISA Rule

SV-86001r1_rule

Vulnerability Number

V-71377

Group Title

SRG-NET-000248-ALG-000133

Rule Version

CAGW-GW-000440

Severity

CAT II

CCI(s)

• CCI-001242 - The organization configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy.

Weight

10

Fix Recommendation

Open the CA API Gateway - Policy Manager and double-click any of the Registered Services that did not have the "Scan Using ICAP-Enabled Antivirus" Assertion.

Add the "Scan Using ICAP-Enabled Antivirus" Assertion, configure the parameters for the Assertion in accordance with organizational requirements, and click the "Save and Activate" button.

If the organization requires that all Registered Services require the ability to scan files in real time, consider adding the "Scan Using ICAP-Enabled Antivirus" Assertion to a Global Policy to meet this requirement.

Check Contents

Open the CA API Gateway - Policy Manager and double-click any of the Registered Services that require real-time scanning.

Verify the "Scan Using ICAP-Enabled Antivirus" Assertion is included in the policy. If it is not, check to see if it has been added to a Global Policy.

If the Assertion is not present in either Global or Registered Services policy, this is a finding.

Vulnerability Number

V-71377

Documentable

False

Rule Version

CAGW-GW-000440

Severity Override Guidance

Open the CA API Gateway - Policy Manager and double-click any of the Registered Services that require real-time scanning.

Verify the "Scan Using ICAP-Enabled Antivirus" Assertion is included in the policy. If it is not, check to see if it has been added to a Global Policy.

If the Assertion is not present in either Global or Registered Services policy, this is a finding.

Check Content Reference

M

Target Key

3049

Comments