← Back to Intrusion Detection and Prevention Systems Security Requirements Guide

V-206864

CAT II (Medium)

The IPS must enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network.

Rule ID

SV-206864r1137714_rule

STIG

Intrusion Detection and Prevention Systems Security Requirements Guide

Version

V3R4

CCIs

CCI-001368

Discussion

Restricting the flow of communications traffic, also known as information flow control, helps prevent unauthorized access. Upon detecting malicious traffic or an anomaly, the IPS must be configured to drop, block, or redirect this traffic based on organization-defined actions in the site's security plan and the device's capabilities. This requirement also applies to Zero Trust initiatives.

Check Content

If the device being reviewed is an IDS, this is not applicable.

Verify the IPS enforces approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network.

If the IPS does not enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network, this is a finding.

Fix Text

Configure the IPS to enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network.