← Back to Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide

V-55375

CAT II (Medium)

The IDPS must detect network services that have not been authorized or approved by the ISSO or ISSM, at a minimum.

Rule ID

SV-69621r2_rule

STIG

Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide

Version

V2R6

CCIs

CCI-002683

Discussion

Unauthorized or unapproved network services lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services. <br /><br />Examples of network services include service-oriented architectures (SOAs), cloud-based services (e.g., infrastructure as a service, platform as a service, or software as a service), cross-domain, Voice Over Internet Protocol, Instant Messaging, auto-execute, and file sharing.<br /><br />To comply with this requirement, the IDPS may be configured to detect services either directly or indirectly (i.e., by detecting traffic associated with a service).

Check Content

Verify the IDPS detects network services that have not been authorized or approved by the ISSO or ISSM, at a minimum.<br /><br />If the IDPS does not detect network services that have not been authorized or approved by the ISSO or ISSM, at a minimum, this is a finding.

Fix Text

Configure the IDPS to detect network services that have not been authorized or approved by the ISSO or ISSM, at a minimum.