STIGQter: STIG Summary: CA API Gateway ALG Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 28 Apr 2017:

The ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when new active propagation of malware infecting DoD systems or malicious code adversely affecting the operations and/or security of DoD systems is detected.

DISA Rule

SV-86085r1_rule

Vulnerability Number

V-71461

Group Title

SRG-NET-000392-ALG-000149

Rule Version

CAGW-GW-000820

Severity

CAT II

CCI(s)

• CCI-002664 - The information system alerts organization-defined personnel or roles when organization-defined compromise indicators reflect the occurrence of a compromise or a potential compromise.

Weight

10

Fix Recommendation

Open the CA API Gateway - Policy Manager and double-click any of the Registered Services that require an alert to be sent when malicious code/malware is detected.

Verify/add the "Scan Using ICAP-Enabled Antivirus" Assertion and the "Send Email Alert".

Configure the "Scan Using ICAP-Enabled Antivirus" Assertion as per organizational requirements and position the "Send Email Alert Assertion after the "ICAP-Enabled Antivirus" Assertion, with the results of the response variable set in the "ICAP-Enabled Antivirus" Assertion included in the message body of the "Send Email Alert" Assertion.

Additionally, to avoid receiving emails on all items scanned, the policy should be configured to only send an email alert upon detection of malicious code within the response of the "ICAP-Enabled AntiVirus" Assertion. If desired, these Assertions can be added to a Global Policy.

Check Contents

Open the CA API Gateway - Policy Manager and double-click any of the Registered Services that require an alert to be sent when malicious code/malware is detected.

Verify the "Scan Using ICAP-Enabled Antivirus" Assertion is included in the policy and that the "Send Email Alert" Assertion is included after the "ICAP-Enabled Antivirus" Assertion, with the results of the response variable set in the "ICAP-Enabled Antivirus" Assertion included in the message body of the Assertion.

Additionally, to avoid receiving emails on all items scanned, the policy should be configured to only send an email alert upon detection of malicious code/malware within the response of the "ICAP-Enabled AntiVirus" Assertion.

If neither Assertion is present, check to see if it has been added to a Global Policy.

If the Assertions are not present in either Global or Registered Services policy, this is a finding.

Vulnerability Number

V-71461

Documentable

False

Rule Version

CAGW-GW-000820

Severity Override Guidance

Open the CA API Gateway - Policy Manager and double-click any of the Registered Services that require an alert to be sent when malicious code/malware is detected.

Verify the "Scan Using ICAP-Enabled Antivirus" Assertion is included in the policy and that the "Send Email Alert" Assertion is included after the "ICAP-Enabled Antivirus" Assertion, with the results of the response variable set in the "ICAP-Enabled Antivirus" Assertion included in the message body of the Assertion.

Additionally, to avoid receiving emails on all items scanned, the policy should be configured to only send an email alert upon detection of malicious code/malware within the response of the "ICAP-Enabled AntiVirus" Assertion.

If neither Assertion is present, check to see if it has been added to a Global Policy.

If the Assertions are not present in either Global or Registered Services policy, this is a finding.

Check Content Reference

M

Target Key

3049

Comments