STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Application Layer Gateway Security Requirements Guide

Version

V2R3

Benchmark ID

Application_Layer_Gateway_SRG

Total Checks

160

Tags

application
CAT I: 0CAT II: 160CAT III: 0

This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSON

Checks (160)

V-204909MEDIUMThe ALG must enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies.V-204910MEDIUMThe ALG must enforce approved authorizations for controlling the flow of information within the network based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.V-204911MEDIUMThe ALG must restrict or block harmful or suspicious communications traffic by controlling the flow of information between interconnected networks based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.V-204912MEDIUMThe ALG must immediately use updates made to policy enforcement mechanisms such as policy filters, rules, signatures, and analysis algorithms for gateway and/or intermediary functions.V-204913MEDIUMThe ALG that is part of a CDS must apply information flow control to data transferred between security domains by means of a policy filter which consists of a set of hardware and/or software.V-204914MEDIUMThe ALG that is part of a CDS must allow privileged administrators to enable/disable all security policy filters used to enforce information flow control.V-204915MEDIUMThe ALG that is part of a CDS must allow privileged administrators to configure and make changes to all security policy filters that are used to enforce information flow control.V-204916MEDIUMThe ALG that is part of a CDS must enforce dynamic traffic flow control based on organization-defined policies.V-204917MEDIUMThe ALG that is part of a CDS must enforce organization-defined one-way information flows using hardware mechanisms.V-204918MEDIUMThe ALG that is part of a CDS must enforce information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows.V-204919MEDIUMThe ALG providing user access control intermediary services must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.V-204920MEDIUMThe ALG providing user access control intermediary services must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.V-204921MEDIUMThe ALG providing user access control intermediary services for publicly accessible applications must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.V-204922MEDIUMThe ALG providing user access control intermediary services must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.V-204923MEDIUMThe ALG providing intermediary services for remote access communications traffic must ensure inbound and outbound traffic is monitored for compliance with remote access security policies.V-204924MEDIUMThe ALG providing intermediary services for remote access communications traffic must use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.V-204925MEDIUMThe ALG that stores secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.V-204926MEDIUMThe ALG that provides intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52.V-204927MEDIUMThe ALG providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.V-204928MEDIUMThe ALG must produce audit records containing information to establish what type of events occurred.V-204929MEDIUMThe ALG must produce audit records containing information to establish when (date and time) the events occurred.V-204930MEDIUMThe ALG must produce audit records containing information to establish where the events occurred.V-204931MEDIUMThe ALG must produce audit records containing information to establish the source of the events.V-204932MEDIUMThe ALG must produce audit records containing information to establish the outcome of the events.V-204933MEDIUMThe ALG must generate audit records containing information to establish the identity of any individual or process associated with the event.V-204934MEDIUMThe ALG must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.V-204936MEDIUMThe ALG must protect audit information from unauthorized read access.V-204937MEDIUMThe ALG must protect audit information from unauthorized modification.V-204938MEDIUMThe ALG must protect audit information from unauthorized deletion.V-204939MEDIUMThe ALG must protect audit tools from unauthorized access.V-204940MEDIUMThe ALG must protect audit tools from unauthorized modification.V-204941MEDIUMThe ALG must protect audit tools from unauthorized deletion.V-204942MEDIUMThe ALG must not have unnecessary services and functions enabled.V-204943MEDIUMThe ALG must be configured to remove or disable unrelated or unneeded application proxy services.V-204944MEDIUMThe ALG must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.V-204945MEDIUMThe ALG providing user authentication intermediary services must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).V-204946MEDIUMThe ALG providing user access control intermediary services must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) which validate user account access authorizations and privileges.V-204947MEDIUMThe ALG providing user authentication intermediary services must restrict user authentication traffic to specific authentication server(s).V-204948MEDIUMThe ALG providing user authentication intermediary services must use multifactor authentication for network access to non-privileged accounts.V-204949MEDIUMThe ALG providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.V-204950MEDIUMThe ALG that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.V-204951MEDIUMThe ALG providing PKI-based user authentication intermediary services must map authenticated identities to the user account.V-204952MEDIUMThe ALG providing user authentication intermediary services must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).V-204953MEDIUMThe ALG providing content filtering must block outbound traffic containing known and unknown DoS attacks to protect against the use of internal information systems to launch any Denial of Service (DoS) attacks against other networks or endpoints.V-204954MEDIUMThe ALG must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).V-204955MEDIUMThe ALG must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged session), the session must be terminated after 15 minutes of inactivity.V-204956MEDIUMThe ALG must detect, at a minimum, mobile code that is unsigned or exhibiting unusual behavior, has not undergone a risk assessment, or is prohibited for use based on a risk assessment.V-204957MEDIUMThe ALG must protect the authenticity of communications sessions.V-204958MEDIUMThe ALG must invalidate session identifiers upon user logout or other session termination.V-204959MEDIUMThe ALG must recognize only system-generated session identifiers.V-204960MEDIUMThe ALG must generate unique session identifiers using a FIPS 140-2 approved random number generator.V-204961MEDIUMThe ALG must fail to a secure state upon failure of initialization, shutdown, or abort actions.V-204962MEDIUMIn the event of a system failure of the ALG function, the ALG must save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted.V-204963MEDIUMThe ALG providing content filtering must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy.V-204964MEDIUMThe ALG providing content filtering must be configured to perform real-time scans of files from external sources at network entry/exit points as they are downloaded and prior to being opened or executed.V-204965MEDIUMThe ALG providing content filtering must block malicious code upon detection.V-204966MEDIUMThe ALG providing content filtering must delete or quarantine malicious code in response to malicious code detection.V-204967MEDIUMThe ALG providing content filtering must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection.V-204968MEDIUMThe ALG providing content filtering must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management procedures.V-204969MEDIUMThe ALG must generate error messages that provide the information necessary for corrective actions without revealing information that could be exploited by adversaries.V-204970MEDIUMThe ALG that is part of a CDS must enforce information flow control based on organization-defined metadata.V-204971MEDIUMThe ALG that is part of a CDS must block the transfer of data with malformed security attribute metadata structures.V-204972MEDIUMThe ALG that is part of a CDS must decompose information into organization-defined, policy-relevant subcomponents for submission to policy enforcement mechanisms before transferring information between different security domains.V-204973MEDIUMThe ALG that is part of a CDS, when transferring information between different security domains, must implement organization-defined security policy filters requiring fully enumerated formats that restrict data structure and content.V-204974MEDIUMThe ALG that is part of a CDS, when transferring information between different security domains, must examine the information for the presence of organization-defined unsanctioned information.V-204975MEDIUMThe ALG that is part of a CDS must prohibit the transfer of unsanctioned information in accordance with the security policy when transferring information between different security domains.V-204976MEDIUMThe ALG providing content filtering must block or restrict detected prohibited mobile code.V-204977MEDIUMThe ALG providing content filtering must prevent the download of prohibited mobile code.V-204978MEDIUMThe ALG providing intermediary services for remote access communications traffic must control remote access methods.V-204979MEDIUMThe ALG providing intermediary services for remote access communications traffic must provide the capability to immediately disconnect or disable remote access to the information system.V-204980MEDIUMTo protect against data mining, the ALG providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.V-204981MEDIUMTo protect against data mining, the ALG providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.V-204982MEDIUMTo protect against data mining, the ALG providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.V-204983MEDIUMTo protect against data mining, the ALG providing content filtering must detect code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.V-204984MEDIUMTo protect against data mining, the ALG providing content filtering must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.V-204985MEDIUMTo protect against data mining, the ALG providing content filtering as part of its intermediary services must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code.V-204986MEDIUMThe ALG that is part of a CDS must use source and destination security attributes associated with organization-defined information, source, and/or destination objects to enforce organization-defined information flow control policies as a basis for flow control decisions.V-204987MEDIUMThe ALG that is part of a CDS, when transferring information between different security domains, must use organization-defined data type identifiers to validate data essential for information flow decisions.V-204988MEDIUMThe ALG that is part of a CDS must uniquely identify and authenticate source by organization, system, application, and/or individual for information transfer.V-204989MEDIUMThe ALG that is part of a CDS must uniquely identify and authenticate destination by organization, system, application, and/or individual for information transfer.V-204991MEDIUMThe ALG that is part of a CDS, when transferring information between different security domains, must apply the same security policy filtering to metadata as it applies to data payloads.V-204992MEDIUMThe ALG that is part of a CDS must enforce the use of human reviews for organization-defined information flows under organization-defined conditions.V-204993MEDIUMThe ALG providing user access control intermediary services must provide the capability for authorized users to select a user session to capture or view.V-204995MEDIUMThe ALG must off-load audit records onto a centralized log server.V-204996MEDIUMThe ALG must provide an immediate real-time alert to, at a minimum, the SCA and ISSO, of all audit failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.V-204997MEDIUMThe ALG providing user authentication intermediary services must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.V-204998MEDIUMThe ALG providing user authentication intermediary services must implement multifactor authentication for remote access to nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access.V-204999MEDIUMThe ALG providing user authentication intermediary services must implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.V-205000MEDIUMThe ALG must prohibit the use of cached authenticators after an organization-defined time period.V-205001MEDIUMThe ALG providing user authentication intermediary services using PKI-based user authentication must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.V-205002MEDIUMThe ALG providing user authentication intermediary services must conform to Federal Identity, Credential, and Access Management (FICAM)-issued profiles.V-205003MEDIUMThe ALG providing user authentication intermediary services using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of protected sessions.V-205004MEDIUMThe ALG providing content filtering must protect against known and unknown types of Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis.V-205005MEDIUMThe ALG must implement load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks.V-205006MEDIUMThe ALG providing content filtering must protect against known types of Denial of Service (DoS) attacks by employing signatures.V-205007MEDIUMThe ALG providing content filtering must protect against or limit the effects of known and unknown types of Denial of Service (DoS) attacks by employing pattern recognition pre-processors.V-205008MEDIUMThe ALG must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.V-205009MEDIUMThe ALG must fail securely in the event of an operational failure.V-205010MEDIUMThe ALG must identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems.V-205011MEDIUMThe ALG must behave in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.V-205012MEDIUMThe ALG providing content filtering must be configured to integrate with a system-wide intrusion detection system.V-205013MEDIUMThe ALG providing content filtering must detect use of network services that have not been authorized or approved by the ISSM and ISSO, at a minimum.V-205014MEDIUMThe ALG providing content filtering must generate a log record when unauthorized network services are detected.V-205015MEDIUMThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when unauthorized network services are detected.V-205016MEDIUMThe ALG providing content filtering must continuously monitor inbound communications traffic crossing internal security boundaries for unusual or unauthorized activities or conditions.V-205017MEDIUMThe ALG providing content filtering must continuously monitor outbound communications traffic crossing internal security boundaries for unusual/unauthorized activities or conditions.V-205018MEDIUMThe ALG providing content filtering must send an alert to, at a minimum, the ISSO and ISSM when detection events occur.V-205019MEDIUMThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources (e.g., IAVMs or CTOs) are detected.V-205020MEDIUMThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when root level intrusion events which provide unauthorized privileged access are detected.V-205021MEDIUMThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when user level intrusions which provide non-privileged access are detected.V-205022MEDIUMThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when denial of service incidents are detected.V-205023MEDIUMThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when new active propagation of malware infecting DoD systems or malicious code adversely affecting the operations and/or security of DoD systems is detected.V-205024MEDIUMThe ALG that implements spam protection mechanisms must be updated automatically.V-205026MEDIUMThe ALG providing user authentication intermediary services must transmit only encrypted representations of passwords.V-205027MEDIUMThe ALG must check the validity of all data inputs except those specifically identified by the organization.V-205028MEDIUMThe ALG must reveal error messages only to the ISSO, ISSM, and SCA.V-205029MEDIUMThe ALG must generate audit records when successful/unsuccessful attempts to access security objects occur.V-205030MEDIUMThe ALG that is part of a CDS must generate audit records when successful/unsuccessful attempts to access security levels occur.V-205031MEDIUMThe ALG must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur.V-205032MEDIUMThe ALG providing user access control intermediary services must generate audit records when successful/unsuccessful attempts to modify privileges occur.V-205033MEDIUMThe ALG must generate audit records when successful/unsuccessful attempts to modify security objects occur.V-205034MEDIUMThe ALG must generate audit records when successful/unsuccessful attempts to modify security levels occur.V-205035MEDIUMThe ALG must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur.V-205036MEDIUMThe ALG providing user access control intermediary services must generate audit records when successful/unsuccessful attempts to delete privileges occur.V-205037MEDIUMThe ALG must generate audit records when successful/unsuccessful attempts to delete security levels occur.V-205038MEDIUMThe ALG must generate audit records when successful/unsuccessful attempts to delete security objects occur.V-205039MEDIUMThe ALG must generate audit records when successful/unsuccessful attempts to delete categories of information (e.g., classification levels) occur.V-205040MEDIUMThe ALG providing user access control intermediary services must generate audit records when successful/unsuccessful logon attempts occur.V-205041MEDIUMThe ALG providing user access control intermediary services must generate audit records showing starting and ending time for user access to the system.V-205042MEDIUMThe ALG providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes.V-205043MEDIUMThe ALG providing encryption intermediary services must implement NIST FIPS-validated cryptography for digital signatures.V-205044MEDIUMThe ALG providing encryption intermediary services must use NIST FIPS-validated cryptography to implement encryption services.V-205045MEDIUMThe ALG must off-load audit records onto a centralized log server in real time.V-205046MEDIUMThe ALG that is part of a CDS must have the capability to implement journaling.V-205047MEDIUMThe ALG must be configured in accordance with the security configuration settings based on DoD security policy and technology-specific security best practices.V-205048MEDIUMThe ALG that provides intermediary services for SMTP must inspect inbound and outbound SMTP and Extended SMTP communications traffic for protocol compliance and protocol anomalies.V-205049MEDIUMThe ALG that provides intermediary services for FTP must inspect inbound and outbound FTP communications traffic for protocol compliance and protocol anomalies.V-205050MEDIUMThe ALG that provides intermediary services for HTTP must inspect inbound and outbound HTTP traffic for protocol compliance and protocol anomalies.V-205051MEDIUMThe ALG providing user access control intermediary services must generate audit records when successful/unsuccessful attempts to access privileges occur.V-205052MEDIUMThe ALG providing user access control intermediary services must initiate a session lock after a 15-minute period of inactivity.V-205053MEDIUMThe ALG providing user access control intermediary services must provide the capability for users to directly initiate a session lock.V-205054MEDIUMThe ALG providing user access control intermediary services must retain the session lock until the user reestablishes access using established identification and authentication procedures.V-205055MEDIUMThe ALG providing user access control intermediary services must automatically terminate a user session when organization-defined conditions or trigger events that require a session disconnect occur.V-205056MEDIUMThe ALG providing user access control intermediary services must provide a logoff capability for user-initiated communications sessions.V-205057MEDIUMThe ALG providing user access control intermediary services must display an explicit logoff message to users indicating the reliable termination of authenticated communications sessions.V-205058MEDIUMThe ALG providing user access control intermediary services must conceal, via the session lock, information previously visible on the display with a publicly viewable image.V-263540MEDIUMThe ALG must prevent or restrict changes to the configuration of the system under organization-defined circumstances.V-263541MEDIUMThe ALG must employ organization-defined controls by type of denial of service (DoS) to achieve the DoS objective.V-263542MEDIUMThe ALG must implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.V-263543MEDIUMThe ALG must implement antispoofing mechanisms to prevent adversaries from falsifying the security attributes indicating the successful application of the security process.V-263544MEDIUMThe ALG must include only approved trust anchors in trust stores or certificate stores managed by the organization.V-263545MEDIUMThe ALG must provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.V-263546MEDIUMThe ALG must establish organization-defined alternate communications paths for system operations organizational command and control.V-263547MEDIUMThe ALG must implement signature based and/or nonsignature based malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code.V-263548MEDIUMThe ALG must configure malicious code protection mechanisms to send alerts to organization-defined personnel in response to malicious code detection.V-278954MEDIUMThe ALG must validate the integrity of transmitted security attributes.V-278955MEDIUMThe ALG must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network.V-278956MEDIUMThe ALG must be configured to use cryptographic algorithms approved by NSA to protect NSS for remote access to a classified network.V-278957MEDIUMThe ALG must use a FIPS-validated cryptographic module to provision digital signatures.V-278958MEDIUMThe ALG must use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.