STIGQter: STIG Summary: Bromium Secure Platform 4.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 May 2018:

The Bromium Enterprise Controller (BEC) must forward an event to the central log server when isolation is disabled on any protected Bromium vSentry client.

DISA Rule

SV-95187r1_rule

Vulnerability Number

V-80479

Group Title

SRG-APP-000516

Rule Version

BROM-00-001305

Severity

CAT I

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Configure the BEC server to automatically forward events to the desired syslog destination.

1. From the management console, click on the selection arrow next to "Events".
2. Click on "Destinations".
3. Click on "Add Syslog Destination".
4. Configure syslog server parameters and verify that the Severity level for the source Isolation Host is minimally set to "Warning".
5. Click "Save".

Additional syslog destinations may be configured for forwarding events to multiple destinations simultaneously.

Check Contents

Verify that a syslog destination is configured on the BEC server.

1. From the management console, click on the selection arrow next to "Events".
2. Click on "Destinations".
3. Inspect the list of configured syslog destinations.
4. Verify that the Severity level for the source Isolation Host is minimally set to "Warning".

If the Bromium monitoring module installed on the BEC or Bromium vSentry does not generate an event and forward to the events server when anomalies in the operation of the application are discovered, this is a finding.

Vulnerability Number

V-80479

Documentable

False

Rule Version

BROM-00-001305

Severity Override Guidance

Verify that a syslog destination is configured on the BEC server.

1. From the management console, click on the selection arrow next to "Events".
2. Click on "Destinations".
3. Inspect the list of configured syslog destinations.
4. Verify that the Severity level for the source Isolation Host is minimally set to "Warning".

If the Bromium monitoring module installed on the BEC or Bromium vSentry does not generate an event and forward to the events server when anomalies in the operation of the application are discovered, this is a finding.

Check Content Reference

M

Target Key

3375

Comments