FGFW-ND-000005 - The FortiGate device must automatically audit account creation. - event

CAT|II

CCI|CCI-000018

Rule-ID|SV-234162r628777_rule

STIG-ID|FGFW-ND-000005

Vuln-ID|V-234162

FGFW-ND-000005 - The FortiGate device must automatically audit account creation. - system

FGFW-ND-000010 - The FortiGate device must automatically audit account modification. - event

CCI|CCI-001403

Rule-ID|SV-234163r628777_rule

STIG-ID|FGFW-ND-000010

Vuln-ID|V-234163

FGFW-ND-000010 - The FortiGate device must automatically audit account modification. - system

FGFW-ND-000010 - The FortiGate device must automatically audit account modification. - user

FGFW-ND-000020 - The FortiGate device must automatically audit account removal actions. - event

CCI|CCI-001405

Rule-ID|SV-234164r628777_rule

STIG-ID|FGFW-ND-000020

Vuln-ID|V-234164

FGFW-ND-000020 - The FortiGate device must automatically audit account removal actions. - system

FGFW-ND-000030 - The FortiGate device must have only one local account to be used as the account of last resort in the event the authentication server is unavailable.

CCI|CCI-001358

CCI|CCI-002111

Rule-ID|SV-234165r628777_rule

STIG-ID|FGFW-ND-000030

Vuln-ID|V-234165

FGFW-ND-000035 - The FortiGate device must allow full access to only those individuals or roles designated by the ISSM.

CCI|CCI-001368

Rule-ID|SV-234166r628777_rule

STIG-ID|FGFW-ND-000035

Vuln-ID|V-234166

FGFW-ND-000040 - The FortiGate device must audit the execution of privileged functions. - event

CCI|CCI-002234

Rule-ID|SV-234167r628777_rule

STIG-ID|FGFW-ND-000040

Vuln-ID|V-234167

FGFW-ND-000040 - The FortiGate device must audit the execution of privileged functions. - system

FGFW-ND-000045 - The FortiGate device must enforce the limit of three consecutive invalid logon attempts, after which time it must lock out the user account from accessing the device for 15 minutes. - admin-lockout-duration

CCI|CCI-000044

Rule-ID|SV-234168r628777_rule

STIG-ID|FGFW-ND-000045

Vuln-ID|V-234168

FGFW-ND-000045 - The FortiGate device must enforce the limit of three consecutive invalid logon attempts, after which time it must lock out the user account from accessing the device for 15 minutes. - admin-lockout-threshold

FGFW-ND-000050 - The FortiGate device must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

CCI|CCI-000048

Rule-ID|SV-234169r628777_rule

STIG-ID|FGFW-ND-000050

Vuln-ID|V-234169

FGFW-ND-000055 - The FortiGate device must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.

CCI|CCI-000050

Rule-ID|SV-234170r628777_rule

STIG-ID|FGFW-ND-000055

Vuln-ID|V-234170

FGFW-ND-000060 - The FortiGate device must log all user activity.

CCI|CCI-000166

Rule-ID|SV-234171r628777_rule

STIG-ID|FGFW-ND-000060

Vuln-ID|V-234171

FGFW-ND-000065 - The FortiGate device must generate audit records when successful/unsuccessful attempts to modify administrator privileges occur. - event

CCI|CCI-000172

Rule-ID|SV-234172r628777_rule

STIG-ID|FGFW-ND-000065

Vuln-ID|V-234172

FGFW-ND-000065 - The FortiGate device must generate audit records when successful/unsuccessful attempts to modify administrator privileges occur. - system

FGFW-ND-000070 - The FortiGate device must generate audit records when successful/unsuccessful attempts to delete administrator privileges occur. - event

Rule-ID|SV-234173r628777_rule

STIG-ID|FGFW-ND-000070

Vuln-ID|V-234173

FGFW-ND-000070 - The FortiGate device must generate audit records when successful/unsuccessful attempts to delete administrator privileges occur. - system

FGFW-ND-000075 - The FortiGate device must generate audit records when successful/unsuccessful logon attempts occur. - event

Rule-ID|SV-234174r628777_rule

STIG-ID|FGFW-ND-000075

Vuln-ID|V-234174

FGFW-ND-000075 - The FortiGate device must generate audit records when successful/unsuccessful logon attempts occur. - system

FGFW-ND-000080 - The FortiGate device must generate audit records for privileged activities or other system-level access. - event

Rule-ID|SV-234175r628777_rule

STIG-ID|FGFW-ND-000080

Vuln-ID|V-234175

FGFW-ND-000080 - The FortiGate device must generate audit records for privileged activities or other system-level access. - system

FGFW-ND-000085 - The FortiGate device must generate audit records showing starting and ending time for administrator access to the system. - event

Rule-ID|SV-234176r628777_rule

STIG-ID|FGFW-ND-000085

Vuln-ID|V-234176

FGFW-ND-000085 - The FortiGate device must generate audit records showing starting and ending time for administrator access to the system. - system

FGFW-ND-000090 - The FortiGate device must generate audit records when concurrent logons from different workstations occur. - event

Rule-ID|SV-234177r628777_rule

STIG-ID|FGFW-ND-000090

Vuln-ID|V-234177

FGFW-ND-000090 - The FortiGate device must generate audit records when concurrent logons from different workstations occur. - system

FGFW-ND-000095 - The FortiGate device must generate audit records containing information that establishes the identity of any individual or process associated with the event.

CCI|CCI-001487

Rule-ID|SV-234178r628777_rule

STIG-ID|FGFW-ND-000095

Vuln-ID|V-234178

FGFW-ND-000100 - The FortiGate device must generate audit records containing the full-text recording of privileged commands.

CCI|CCI-000135

Rule-ID|SV-234179r628777_rule

STIG-ID|FGFW-ND-000100

Vuln-ID|V-234179

FGFW-ND-000105 - The FortiGate device must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements. - diskfull overwrite

CCI|CCI-001849

Rule-ID|SV-234180r628777_rule

STIG-ID|FGFW-ND-000105

Vuln-ID|V-234180

FGFW-ND-000105 - The FortiGate device must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements. - max-log-file-size

FGFW-ND-000110 - The FortiGate device must off-load audit records on to a different system or media than the system being audited.

CCI|CCI-001851

Rule-ID|SV-234181r628777_rule

STIG-ID|FGFW-ND-000110

Vuln-ID|V-234181

FGFW-ND-000115 - The FortiGate device must generate an immediate real-time alert of all audit failure events requiring real-time alerts.

CCI|CCI-001858

Rule-ID|SV-234182r628777_rule

STIG-ID|FGFW-ND-000115

Vuln-ID|V-234182

FGFW-ND-000120 - The FortiGate device must synchronize internal information system clocks using redundant authoritative time sources. - ntp server 1

CCI|CCI-000366

CCI|CCI-001893

Rule-ID|SV-234183r628777_rule

STIG-ID|FGFW-ND-000120

Vuln-ID|V-234183

FGFW-ND-000120 - The FortiGate device must synchronize internal information system clocks using redundant authoritative time sources. - ntp server 2

FGFW-ND-000125 - The FortiGate device must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

CCI|CCI-001890

Rule-ID|SV-234184r628777_rule

STIG-ID|FGFW-ND-000125

Vuln-ID|V-234184

FGFW-ND-000130 - The FortiGate device must protect audit information from unauthorized deletion.

CCI|CCI-000164

Rule-ID|SV-234185r628777_rule

STIG-ID|FGFW-ND-000130

Vuln-ID|V-234185

FGFW-ND-000135 - The FortiGate device must protect audit tools from unauthorized access.

CCI|CCI-001493

Rule-ID|SV-234186r628777_rule

STIG-ID|FGFW-ND-000135

Vuln-ID|V-234186

FGFW-ND-000140 - The FortiGate device must protect audit tools from unauthorized modification.

CCI|CCI-001494

Rule-ID|SV-234187r628777_rule

STIG-ID|FGFW-ND-000140

Vuln-ID|V-234187

FGFW-ND-000145 - The FortiGate device must prohibit installation of software without explicit privileged status.

CCI|CCI-001812

Rule-ID|SV-234188r628777_rule

STIG-ID|FGFW-ND-000145

Vuln-ID|V-234188

FGFW-ND-000150 - The FortiGate device must enforce access restrictions associated with changes to device configuration.

CCI|CCI-001813

Rule-ID|SV-234189r628777_rule

STIG-ID|FGFW-ND-000150

Vuln-ID|V-234189

FGFW-ND-000155 - The FortiGate device must limit privileges to change the software resident within software libraries.

CCI|CCI-001499

Rule-ID|SV-234190r628777_rule

STIG-ID|FGFW-ND-000155

Vuln-ID|V-234190

FGFW-ND-000160 - The FortiGate device must enforce access restrictions associated with changes to the system components.

CCI|CCI-000345

Rule-ID|SV-234191r628777_rule

STIG-ID|FGFW-ND-000160

Vuln-ID|V-234191

FGFW-ND-000165 - The FortiGate device must use LDAP for authentication.

CCI|CCI-000370

Rule-ID|SV-234192r628777_rule

STIG-ID|FGFW-ND-000165

Vuln-ID|V-234192

FGFW-ND-000170 - The FortiGate device must be running an operating system release that is currently supported by the vendor.

CAT|I

Rule-ID|SV-234193r628777_rule

STIG-ID|FGFW-ND-000170

Vuln-ID|V-234193

FGFW-ND-000175 - The FortiGate device must generate log records for a locally developed list of auditable events. - eventfilter

CCI|CCI-000169

Rule-ID|SV-234194r628777_rule

STIG-ID|FGFW-ND-000175

Vuln-ID|V-234194

FGFW-ND-000175 - The FortiGate device must generate log records for a locally developed list of auditable events. - log setting

FGFW-ND-000180 - The FortiGate device must conduct backups of system-level information contained in the information system when changes occur.

CCI|CCI-000537

Rule-ID|SV-234195r628777_rule

STIG-ID|FGFW-ND-000180

Vuln-ID|V-234195

FGFW-ND-000185 - The FortiGate device must support organizational requirements to conduct backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner.

CCI|CCI-000539

Rule-ID|SV-234196r628777_rule

STIG-ID|FGFW-ND-000185

Vuln-ID|V-234196

FGFW-ND-000190 - FortiGate devices performing maintenance functions must restrict use of these functions to authorized personnel only.

CCI|CCI-002883

Rule-ID|SV-234197r628777_rule

STIG-ID|FGFW-ND-000190

Vuln-ID|V-234197

FGFW-ND-000195 - The FortiGate device must use DoD-approved Certificate Authorities (CAs) for public key certificates.

CCI|CCI-001159

Rule-ID|SV-234198r628777_rule

STIG-ID|FGFW-ND-000195

Vuln-ID|V-234198

FGFW-ND-000200 - The FortiGate device must prohibit the use of all unnecessary and/or non-secure functions, ports, protocols, and/or services.

Detections

Analytics

DISA Fortigate Firewall NDM STIG v1r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Functional Update

Miscellaneous

Revision 1.1

Miscellaneous

Revision 1.0

Miscellaneous


Revision 1.3 Mar 3, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.2 Jan 9, 2023 Functional Update FGFW-ND-000220 - The FortiGate device must enforce a minimum 15-character password length. FGFW-ND-000225 - The FortiGate device must enforce password complexity by requiring that at least one uppercase character be used. FGFW-ND-000230 - The FortiGate device must enforce password complexity by requiring that at least one lowercase character be used. FGFW-ND-000235 - The FortiGate device must enforce password complexity by requiring at least one numeric character be used. FGFW-ND-000240 - The FortiGate device must enforce password complexity by requiring that at least one special character be used. FGFW-ND-000311 - The FortiGate device must require that when a password is changed, the characters are changed in at least eight of the positions within the password. Miscellaneous Metadata updated. Variables updated.
Revision 1.1 Dec 7, 2022 Miscellaneous Metadata updated.
Revision 1.0 Jul 27, 2022 Miscellaneous Metadata updated.