ForeScout CounterACT NDM Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000065-NDM-000214
Group -
SRG-APP-000068-NDM-000215
Group -
CounterACT must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.
Display of the DoD-approved use notification before granting access to CounterACT ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Order...Rule Low Severity -
SRG-APP-000168-NDM-000256
Group -
CounterACT must enforce password complexity by requiring that at least one numeric character be used.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...Rule Medium Severity -
SRG-APP-000174-NDM-000261
Group -
SRG-APP-000165-NDM-000253
Group -
CounterACT must prohibit password reuse for a minimum of five generations.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. To meet password policy requirements, passwords need to...Rule Medium Severity -
SRG-APP-000164-NDM-000252
Group -
CounterACT must enforce a minimum 15-character password length.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to d...Rule Medium Severity -
SRG-APP-000516-NDM-000335
Group -
CounterACT must enforce access restrictions associated with changes to the system components.
Changes to the hardware or software components of the network device can have significant effects on the overall security of the network. Therefore, only qualified and authorized individuals should...Rule Medium Severity -
SRG-APP-000516-NDM-000334
Group -
CounterACT must generate audit log events for a locally developed list of auditable events.
Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity th...Rule Low Severity -
SRG-APP-000516-NDM-000340
Group -
SRG-APP-000516-NDM-000341
Group -
CounterACT must support organizational requirements to conduct backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner.
Information system backup is a critical step in maintaining data assurance and availability. Information system and security-related documentation contains information pertaining to system configur...Rule Low Severity -
SRG-APP-000516-NDM-000344
Group -
CounterACT must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
For user certificates, each organization obtains certificates from an approved, shared service provider, as required by OMB policy. For federal agencies operating a legacy public key infrastructure...Rule Medium Severity -
SRG-APP-000516-NDM-000344
Group -
SRG-APP-000516-NDM-000333
Group -
CounterACT must enable Threat Protection notifications to alert security personnel to Cyber events detected by a CounterACT IAW CJCSM 6510.01B.
CJCSM 6510.01B, "Cyber Incident Handling Program", in subsection e.(6)(c) sets forth requirements for Cyber events detected by an automated system. By immediately displaying an alarm message, pote...Rule Medium Severity -
SRG-APP-000408-NDM-000314
Group -
SRG-APP-000516-NDM-000337
Group -
SRG-APP-000142-NDM-000245
Group -
CounterACT must disable all unnecessary and/or nonsecure plugins.
CounterACT is capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operatio...Rule High Severity -
SRG-APP-000190-NDM-000267
Group -
SRG-APP-000190-NDM-000267
Group -
CounterACT must terminate all network connections associated with an SSH connection session upon Exit, session disconnection, or after 10 minutes of inactivity, except where prevented by documented and validated mission requirements.
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port th...Rule Medium Severity -
SRG-APP-000231-NDM-000271
Group -
CounterACT must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).
If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis. Time stamps generated by the application include date and time. Tim...Rule Medium Severity -
SRG-APP-000373-NDM-000298
Group -
SRG-APP-000125-NDM-000241
Group -
If any logs are stored locally which are not sent to the centralized audit server, CounterACT must back up audit records at least every seven days onto a different system or system component than the system or component being audited.
Protection of log data includes ensuring log data is not accidentally lost or deleted. Regularly backing up audit records to a different system or onto separate media than the system being audited ...Rule Medium Severity -
SRG-APP-000133-NDM-000244
Group -
CounterACT must limit privileges to change the software resident within software libraries.
Changes to any software components of the network device can have significant effects on the overall security of the network. Therefore, only qualified and authorized individuals should be allowed ...Rule Medium Severity -
SRG-APP-000169-NDM-000257
Group -
SRG-APP-000515-NDM-000325
Group -
CounterACT must sent audit logs to a centralized audit server (i.e., syslog server).
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.Rule Medium Severity -
SRG-APP-000374-NDM-000299
Group -
SRG-APP-000148-NDM-000346
Group -
SRG-APP-000353-NDM-000292
Group -
SRG-APP-000395-NDM-000310
Group -
CounterACT must authenticate any endpoint used for network management before establishing a local, remote, and/or network connection using cryptographically based bidirectional authentication.
Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Bidirectional authentication provides stronger safeguards to validate the...Rule Medium Severity -
SRG-APP-000395-NDM-000310
Group -
CounterACT must authenticate SNMPv3 endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Bidirectional authentication provides stronger safeguards to validate the...Rule High Severity -
SRG-APP-000345-NDM-000290
Group -
CounterACT must automatically lock the account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are exceeded.
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the a...Rule Medium Severity -
SRG-APP-000317-NDM-000282
Group -
The network device must terminate shared/group account credentials when members leave the group.
A shared/group account credential is a shared form of authentication that allows multiple individuals to access the network device using a single account. If shared/group account credentials are no...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.