STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 4 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Symantec ProxySG ALG Security Technical Implementation Guide

Version

V1R3

Release Date

Mar 27, 2020

SCAP Benchmark ID

Symantec_ProxySG_ALG_STIG

Total Checks

66

Tags

other
CAT I: 9CAT II: 57CAT III: 0

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (66)

V-94217MEDIUMIf Symantec ProxySG filters externally initiated traffic, reverse proxy services must be configured.V-94219MEDIUMSymantec ProxySG providing intermediary services for remote access communications traffic must ensure outbound traffic is monitored for compliance with remote access security policies.V-94221HIGHSymantec ProxySG providing forward proxy intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52.V-94223MEDIUMSymantec ProxySG providing reverse proxy intermediary services for TLS must be configured to version 1.1 or higher with an approved cipher suite.V-94225MEDIUMSymantec ProxySG storing secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.V-94227HIGHSymantec ProxySG must implement security policies that enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies.V-94229HIGHSymantec ProxySG must restrict or block harmful or suspicious communications traffic by controlling the flow of information between interconnected networks based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.V-94231MEDIUMSymantec ProxySG must enforce approved authorizations for controlling the flow of information within the network based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.V-94233MEDIUMSymantec ProxySG must immediately use updates made to policy enforcement mechanisms such as policies and rules.V-94235MEDIUMSymantec ProxySG providing user access control intermediary services must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.V-94237MEDIUMSymantec ProxySG providing user access control intermediary services for publicly accessible applications must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.V-94239MEDIUMSymantec ProxySG providing user access control intermediary services must generate audit records when successful/unsuccessful logon attempts occur.V-94241MEDIUMSymantec ProxySG providing user access control intermediary services must generate audit records showing starting and ending time for user access to the system.V-94243MEDIUMSymantec ProxySG providing user access control intermediary services must generate audit records when successful/unsuccessful attempts to access web resources occur.V-94245MEDIUMSymantec ProxySG must produce audit records containing information to establish what type of events occurred.V-94247MEDIUMSymantec ProxySG must produce audit records containing information to establish when (date and time) the events occurred.V-94249MEDIUMSymantec ProxySG must produce audit records containing information to establish where the events occurred.V-94251MEDIUMSymantec ProxySG must produce audit records containing information to establish the source of the events.V-94253MEDIUMSymantec ProxySG must produce audit records containing information to establish the outcome of the events.V-94255MEDIUMSymantec ProxySG must generate audit records containing information to establish the identity of any individual or process associated with the event.V-94257MEDIUMSymantec ProxySG must use a centralized log server.V-94259MEDIUMSymantec ProxySG must be configured to send the access logs to the centralized log server continuously.V-94261MEDIUMSymantec ProxySG must provide an alert to, at a minimum, the SCA and ISSO of all audit failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.V-94263MEDIUMThe reverse proxy Symantec ProxySG providing intermediary services for FTP must inspect inbound FTP communications traffic for protocol compliance and protocol anomalies.V-94265MEDIUMSymantec ProxySG providing intermediary services for FTP must inspect outbound FTP communications traffic for protocol compliance and protocol anomalies.V-94267MEDIUMSymantec ProxySG providing intermediary services for HTTP must inspect inbound HTTP traffic for protocol compliance and protocol anomalies.V-94269MEDIUMSymantec ProxySG providing intermediary services for HTTP must inspect outbound HTTP traffic for protocol compliance and protocol anomalies.V-94271MEDIUMSymantec ProxySG must not have unnecessary services and functions enabled.V-94273MEDIUMSymantec ProxySG must be configured to remove or disable unrelated or unneeded application proxy services.V-94275HIGHSymantec ProxySG must be configured to prohibit or restrict the use of network services as defined in the PPSM CAL and vulnerability assessments.V-94277MEDIUMSymantec ProxySG providing user authentication intermediary services must require users to reauthenticate every 900 seconds when organization-defined circumstances or situations require reauthentication.V-94279HIGHSymantec ProxySG must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).V-94281HIGHSymantec ProxySG must be configured with a pre-established trust relationship and mechanisms with appropriate authorities that validate user account access authorizations and privileges.V-94283HIGHSymantec ProxySG providing user authentication intermediary services must restrict user authentication traffic to specific authentication servers.V-94285MEDIUMSymantec ProxySG providing user authentication intermediary services must implement multifactor authentication for remote access to nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access.V-94287MEDIUMSymantec ProxySG providing user authentication intermediary services must implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.V-94289MEDIUMSymantec ProxySG providing user authentication intermediary services must use multifactor authentication for network access to nonprivileged accounts.V-94291MEDIUMSymantec ProxySG providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.V-94293MEDIUMSymantec ProxySG must prohibit the use of cached authenticators after 300 seconds at a minimum.V-94295MEDIUMSymantec ProxySG, when configured for reverse proxy/WAF services and providing PKI-based user authentication intermediary services, must map the client certificate to the authentication server store.V-94297MEDIUMSymantec ProxySG providing user authentication intermediary services using PKI-based user authentication must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.V-94299MEDIUMSymantec ProxySG providing user authentication intermediary services must conform to Federal Identity, Credential, and Access Management (FICAM)-issued profiles.V-94301HIGHSymantec ProxySG must terminate all network connections associated with a communications session at the end of the session or terminate user sessions (nonprivileged session) after 15 minutes of inactivity.V-94303MEDIUMSymantec ProxySG providing forward proxy encryption intermediary services must use NIST FIPS-validated cryptography to implement encryption services.V-94305MEDIUMSymantec ProxySG providing reverse proxy encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes.V-94307MEDIUMSymantec ProxySG providing reverse proxy encryption intermediary services must implement NIST FIPS-validated cryptography for digital signatures.V-94309MEDIUMSymantec ProxySG providing reverse proxy encryption intermediary services must use NIST FIPS-validated cryptography to implement encryption services.V-94311HIGHSymantec ProxySG must use Transport Layer Security (TLS) to protect the authenticity of communications sessions.V-94313MEDIUMIf reverse proxy is used for validating and restricting certs from external entities, and this function is required by the SSP, Symantec ProxySG providing user authentication intermediary services using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of protected sessions.V-94315MEDIUMSymantec ProxySG must fail to a secure state upon failure of initialization, shutdown, or abort actions.V-94317MEDIUMSymantec ProxySG providing content filtering must protect against known and unknown types of denial-of-service (DoS) attacks by employing rate-based attack prevention behavior analysis.V-94319MEDIUMSymantec ProxySG must implement load balancing to limit the effects of known and unknown types of denial-of-service (DoS) attacks.V-94321MEDIUMSymantec ProxySG must block outbound traffic containing known and unknown denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.V-94323MEDIUMSymantec ProxySG must allow incoming communications only from organization-defined authorized sources routed to organization-defined authorized destinations.V-94325MEDIUMSymantec ProxySG must fail securely in the event of an operational failure.V-94327MEDIUMSymantec ProxySG must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).V-94329MEDIUMSymantec ProxySG must identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems.V-94331MEDIUMSymantec ProxySG must tailor the Exceptions messages to generate error messages that provide the information necessary for corrective actions without revealing information that could be exploited by adversaries.V-94333MEDIUMSymantec ProxySG providing content filtering must be configured to integrate with a system-wide intrusion detection system.V-94335MEDIUMSymantec ProxySG providing content filtering must detect use of network services that have not been authorized or approved by the ISSM and ISSO, at a minimum.V-94337MEDIUMSymantec ProxySG providing content filtering must generate a log record when access attempts to unauthorized websites and/or services are detected.V-94339MEDIUMSymantec ProxySG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when access attempts to unauthorized websites and/or services are detected.V-94341MEDIUMReverse proxy Symantec ProxySG providing content filtering must continuously monitor inbound communications traffic crossing internal security boundaries for unusual or unauthorized activities or conditions.V-94343MEDIUMSymantec ProxySG providing content filtering must continuously monitor outbound communications traffic crossing internal security boundaries for unusual/unauthorized activities or conditions.V-94345MEDIUMSymantec ProxySG providing content filtering must send an alert to, at a minimum, the ISSO and ISSM when detection events occur.V-94347MEDIUMSymantec ProxySG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected.