SYMP-AG-000010 - If Symantec ProxySG filters externally initiated traffic, reverse proxy services must be configured.

800-53|AC-17(1)

CAT|II

CCI|CCI-000067

Rule-ID|SV-104171r1_rule

STIG-ID|SYMP-AG-000010

Vuln-ID|V-94217

SYMP-AG-000020 - Symantec ProxySG providing intermediary services for remote access communications traffic must ensure outbound traffic is monitored for compliance with remote access security policies.

Rule-ID|SV-104173r1_rule

STIG-ID|SYMP-AG-000020

Vuln-ID|V-94219

SYMP-AG-000030 - Symantec ProxySG providing forward proxy intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52 - client.connection.negotiated_cipher

800-53|AC-17(2)

CAT|I

CCI|CCI-000068

Rule-ID|SV-104175r1_rule

STIG-ID|SYMP-AG-000030

Vuln-ID|V-94221

SYMP-AG-000030 - Symantec ProxySG providing forward proxy intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52 - client.connection.negotiated_ssl_version

SYMP-AG-000030 - Symantec ProxySG providing forward proxy intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52 - server.connection.negotiated_cipher

SYMP-AG-000030 - Symantec ProxySG providing forward proxy intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52 - server.connection.negotiated_ssl_version

SYMP-AG-000040 - Symantec ProxySG providing reverse proxy intermediary services for TLS must be configured to version 1.1 or higher with an approved cipher suite.

Rule-ID|SV-104177r1_rule

STIG-ID|SYMP-AG-000040

Vuln-ID|V-94223

SYMP-AG-000050 - Symantec ProxySG storing secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.

Rule-ID|SV-104179r2_rule

STIG-ID|SYMP-AG-000050

Vuln-ID|V-94225

SYMP-AG-000060 - Symantec ProxySG must implement security policies that enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies.

800-53|AC-3

CCI|CCI-000213

Rule-ID|SV-104181r1_rule

STIG-ID|SYMP-AG-000060

Vuln-ID|V-94227

SYMP-AG-000070 - Symantec ProxySG must restrict or block harmful or suspicious communications traffic by controlling the flow of information between interconnected networks based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic - SSL

800-53|AC-4

CCI|CCI-001414

Rule-ID|SV-104183r1_rule

STIG-ID|SYMP-AG-000070

Vuln-ID|V-94229

SYMP-AG-000070 - Symantec ProxySG must restrict or block harmful or suspicious communications traffic by controlling the flow of information between interconnected networks based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic - Web Access

SYMP-AG-000080 - Symantec ProxySG must enforce approved authorizations for controlling the flow of information within the network based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.

CCI|CCI-001368

Rule-ID|SV-104185r1_rule

STIG-ID|SYMP-AG-000080

Vuln-ID|V-94231

SYMP-AG-000090 - Symantec ProxySG must immediately use updates made to policy enforcement mechanisms such as policies and rules - SSL

Rule-ID|SV-104187r1_rule

STIG-ID|SYMP-AG-000090

Vuln-ID|V-94233

SYMP-AG-000090 - Symantec ProxySG must immediately use updates made to policy enforcement mechanisms such as policies and rules - Web Access

SYMP-AG-000100 - Symantec ProxySG providing user access control intermediary services must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.

800-53|AC-8a.

CCI|CCI-000048

Rule-ID|SV-104189r2_rule

STIG-ID|SYMP-AG-000100

Vuln-ID|V-94235

SYMP-AG-000110 - Symantec ProxySG providing user access control intermediary services for publicly accessible applications must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.

800-53|AC-8c.1.

800-53|AC-8c.2.

800-53|AC-8c.3.

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-104191r1_rule

STIG-ID|SYMP-AG-000110

Vuln-ID|V-94237

SYMP-AG-000120 - Symantec ProxySG providing user access control intermediary services must generate audit records when successful/unsuccessful logon attempts occur - enabled

800-53|AU-12c.

CCI|CCI-000172

Rule-ID|SV-104193r1_rule

STIG-ID|SYMP-AG-000120

Vuln-ID|V-94239

SYMP-AG-000120 - Symantec ProxySG providing user access control intermediary services must generate audit records when successful/unsuccessful logon attempts occur - policy rules

SYMP-AG-000130 - Symantec ProxySG providing user access control intermediary services must generate audit records showing starting and ending time for user access to the system.

Rule-ID|SV-104195r1_rule

STIG-ID|SYMP-AG-000130

Vuln-ID|V-94241

SYMP-AG-000140 - Symantec ProxySG providing user access control intermediary services must generate audit records when successful/unsuccessful attempts to access web resources occur.

Rule-ID|SV-104197r1_rule

STIG-ID|SYMP-AG-000140

Vuln-ID|V-94243

SYMP-AG-000150 - Symantec ProxySG must produce audit records containing information to establish what type of events occurred.

800-53|AU-3

CCI|CCI-000130

Rule-ID|SV-104199r1_rule

STIG-ID|SYMP-AG-000150

Vuln-ID|V-94245

SYMP-AG-000160 - Symantec ProxySG must produce audit records containing information to establish when (date and time) the events occurred.

CCI|CCI-000131

Rule-ID|SV-104201r1_rule

STIG-ID|SYMP-AG-000160

Vuln-ID|V-94247

SYMP-AG-000170 - Symantec ProxySG must produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-104203r1_rule

STIG-ID|SYMP-AG-000170

Vuln-ID|V-94249

SYMP-AG-000180 - Symantec ProxySG must produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-104205r1_rule

STIG-ID|SYMP-AG-000180

Vuln-ID|V-94251

SYMP-AG-000190 - Symantec ProxySG must produce audit records containing information to establish the outcome of the events.

CCI|CCI-000134

Rule-ID|SV-104207r1_rule

STIG-ID|SYMP-AG-000190

Vuln-ID|V-94253

SYMP-AG-000200 - Symantec ProxySG must generate audit records containing information to establish the identity of any individual or process associated with the event.

CCI|CCI-001487

Rule-ID|SV-104209r1_rule

STIG-ID|SYMP-AG-000200

Vuln-ID|V-94255

SYMP-AG-000210 - Symantec ProxySG must use a centralized log server.

800-53|AU-4(1)

CCI|CCI-001851

Rule-ID|SV-104211r1_rule

STIG-ID|SYMP-AG-000210

Vuln-ID|V-94257

SYMP-AG-000220 - Symantec ProxySG must be configured to send the access logs to the centralized log server continuously.

Rule-ID|SV-104213r1_rule

STIG-ID|SYMP-AG-000220

Vuln-ID|V-94259

SYMP-AG-000230 - Symantec ProxySG must provide an alert to, at a minimum, the SCA and ISSO of all audit failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server - Enabled

800-53|AU-5(2)

CCI|CCI-001858

Rule-ID|SV-104215r1_rule

STIG-ID|SYMP-AG-000230

Vuln-ID|V-94261

SYMP-AG-000230 - Symantec ProxySG must provide an alert to, at a minimum, the SCA and ISSO of all audit failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server - From

SYMP-AG-000230 - Symantec ProxySG must provide an alert to, at a minimum, the SCA and ISSO of all audit failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server - Server

SYMP-AG-000240 - The reverse proxy Symantec ProxySG providing intermediary services for FTP must inspect inbound FTP communications traffic for protocol compliance and protocol anomalies - Forwarding Host

800-53|CM-6b.

800-53|SC-7(17)

CCI|CCI-000366

CCI|CCI-001125

Rule-ID|SV-104217r1_rule

STIG-ID|SYMP-AG-000240

Vuln-ID|V-94263

SYMP-AG-000240 - The reverse proxy Symantec ProxySG providing intermediary services for FTP must inspect inbound FTP communications traffic for protocol compliance and protocol anomalies - Policy Rules

SYMP-AG-000240 - The reverse proxy Symantec ProxySG providing intermediary services for FTP must inspect inbound FTP communications traffic for protocol compliance and protocol anomalies - Review Proxies

SYMP-AG-000250 - Symantec ProxySG providing intermediary services for FTP must inspect outbound FTP communications traffic for protocol compliance and protocol anomalies.

Rule-ID|SV-104219r1_rule

STIG-ID|SYMP-AG-000250

Vuln-ID|V-94265

SYMP-AG-000260 - Symantec ProxySG providing intermediary services for HTTP must inspect inbound HTTP traffic for protocol compliance and protocol anomalies - Explicit

Rule-ID|SV-104221r1_rule

STIG-ID|SYMP-AG-000260

Vuln-ID|V-94267

SYMP-AG-000260 - Symantec ProxySG providing intermediary services for HTTP must inspect inbound HTTP traffic for protocol compliance and protocol anomalies - External

SYMP-AG-000260 - Symantec ProxySG providing intermediary services for HTTP must inspect inbound HTTP traffic for protocol compliance and protocol anomalies - Internal

SYMP-AG-000270 - Symantec ProxySG  providing intermediary services for HTTP must inspect outbound HTTP traffic for protocol compliance and protocol anomalies - Explicit

Rule-ID|SV-104223r1_rule

STIG-ID|SYMP-AG-000270

Vuln-ID|V-94269

SYMP-AG-000270 - Symantec ProxySG  providing intermediary services for HTTP must inspect outbound HTTP traffic for protocol compliance and protocol anomalies - External

SYMP-AG-000270 - Symantec ProxySG  providing intermediary services for HTTP must inspect outbound HTTP traffic for protocol compliance and protocol anomalies - Internal

SYMP-AG-000280 - Symantec ProxySG must not have unnecessary services and functions enabled.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-104225r1_rule

STIG-ID|SYMP-AG-000280

Vuln-ID|V-94271

SYMP-AG-000290 - Symantec ProxySG must be configured to remove or disable unrelated or unneeded application proxy services.

Rule-ID|SV-104227r1_rule

STIG-ID|SYMP-AG-000290

Vuln-ID|V-94273

SYMP-AG-000300 - Symantec ProxySG must be configured to prohibit or restrict the use of network services as defined in the PPSM CAL and vulnerability assessments. - Destination

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-104229r1_rule

STIG-ID|SYMP-AG-000300

Vuln-ID|V-94275

SYMP-AG-000300 - Symantec ProxySG must be configured to prohibit or restrict the use of network services as defined in the PPSM CAL and vulnerability assessments. - Source

SYMP-AG-000310 - Symantec ProxySG providing user authentication intermediary services must require users to reauthenticate every 900 seconds when organization-defined circumstances or situations require reauthentication - coreid

800-53|IA-11

CCI|CCI-002038

Rule-ID|SV-104231r1_rule

STIG-ID|SYMP-AG-000310

Vuln-ID|V-94277

SYMP-AG-000310 - Symantec ProxySG providing user authentication intermediary services must require users to reauthenticate every 900 seconds when organization-defined circumstances or situations require reauthentication - iwa

SYMP-AG-000310 - Symantec ProxySG providing user authentication intermediary services must require users to reauthenticate every 900 seconds when organization-defined circumstances or situations require reauthentication - LDAP

SYMP-AG-000310 - Symantec ProxySG providing user authentication intermediary services must require users to reauthenticate every 900 seconds when organization-defined circumstances or situations require reauthentication - RADIUS

SYMP-AG-000310 - Symantec ProxySG providing user authentication intermediary services must require users to reauthenticate every 900 seconds when organization-defined circumstances or situations require reauthentication - siteminder

SYMP-AG-000310 - Symantec ProxySG providing user authentication intermediary services must require users to reauthenticate every 900 seconds when organization-defined circumstances or situations require reauthentication - xml

SYMP-AG-000310 - Symantec ProxySG providing user authentication intermediary services must require users to reauthenticate every 900 seconds when organization-defined circumstances or situations require reauthentication.

SYMP-AG-000320 - Symantec ProxySG must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users) - Domain Exists

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-104233r1_rule

STIG-ID|SYMP-AG-000320

Vuln-ID|V-94279

SYMP-AG-000320 - Symantec ProxySG must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users) - Domain Joined

SYMP-AG-000330 - Symantec ProxySG must be configured with a pre-established trust relationship and mechanisms with appropriate authorities that validate user account access authorizations and privileges - Domain Exists

Rule-ID|SV-104235r1_rule

STIG-ID|SYMP-AG-000330

Vuln-ID|V-94281

SYMP-AG-000330 - Symantec ProxySG must be configured with a pre-established trust relationship and mechanisms with appropriate authorities that validate user account access authorizations and privileges - Domain joined

Detections

Analytics

Revision 1.9

Mar 7, 2023

Miscellaneous