Trend Micro TippingPoint IDPS Security Technical Implementation Guide

SRG-NET-000318-IDPS-00182

To protect against unauthorized data mining, the TPS must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.

SRG-NET-000318-IDPS-00183

In the event of a logging failure caused by the lack of audit record storage capacity, the SMS must continue generating and storing audit records, overwriting the oldest audit records in a first-in-first-out manner using Audit Log maintenance.

SRG-NET-000091-IDPS-00193

To protect against unauthorized data mining, the TPS must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.

SRG-NET-000319-IDPS-00184

To protect against unauthorized data mining, the TPS must detect code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

SRG-NET-000319-IDPS-00185

To protect against unauthorized data mining, the TPS must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code.

SRG-NET-000319-IDPS-00186

To protect against unauthorized data mining, the TPS must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.

SRG-NET-000018-IDPS-00018

The Trend Micro TippingPoint Security Management System (SMS) must be configured to send security IPS policy to the Trend Micro Threat Protection System (TPS).

SRG-NET-000019-IDPS-00187

The Trend Micro TPS must immediately use updates made to policy filters, rules, signatures, and anomaly analysis algorithms for traffic detection and prevention functions which are all contained in the Digital Vaccine (DV) updates.

SRG-NET-000113-IDPS-00013

The TPS must provide audit record generation capability for detection events based on implementation of policy filters, rules, signatures, and anomaly analysis.

SRG-NET-000113-IDPS-00082

The TPS must provide audit record generation capability for events where communication traffic is blocked or restricted based on policy filters, rules, signatures, and anomaly analysis.

SRG-NET-000074-IDPS-00059

The SMS and TPS must provide log information in a format that can be extracted and used by centralized analysis tools.

SRG-NET-000131-IDPS-00011

The SMS must produce audit records containing sufficient information to establish what type of event occurred, including, at a minimum, event descriptions, policy filter, rule or signature invoked, port, protocol, and criticality level/alert code or description by sending all audit and system logs to a centralized syslog server.

SRG-NET-000075-IDPS-00060

The SMS must produce audit records containing information to establish when (date and time) the events occurred by sending all audit and system logs to a centralized syslog server.

SRG-NET-000076-IDPS-00061

The SMS must produce audit records containing information to establish where the event was detected, including, at a minimum, network segment, destination address, and TPS component which detected the event by sending all audit and system logs to a centralized syslog server.

SRG-NET-000077-IDPS-00062

The SMS must produce audit records containing information to establish the source of the event, including, at a minimum, originating source address by sending all audit and system logs to a centralized syslog server.

SRG-NET-000078-IDPS-00063

The SMS must be configured to remove or disable non-essential capabilities on SMS and TPS which are not required for operation or not related to IDPS functionality (e.g., web server, SSH, telnet, and TAXII).

The SMS must produce audit records containing information to establish the outcome of events associated with detected harmful or potentially harmful traffic, including, at a minimum, capturing all associated communications traffic by sending all audit and system logs to a centralized syslog server.

SRG-NET-000333-IDPS-00190

TPS must support centralized management and configuration of the content captured in audit records generated by all TPS components by using the Security Management System (SMS).

SRG-NET-000334-IDPS-00191

The TPS and SMS must off-load log records to a centralized log server.

SRG-NET-000089-IDPS-00010

In the event of a logging failure, caused by loss of communications with the central logging server, the SMS must queue audit records locally by using the syslog over TCP protocol until communication is restored or until the audit records are retrieved manually or using automated synchronization tools.

SRG-NET-000089-IDPS-00069

SRG-NET-000228-IDPS-00196

The TPS must detect, at a minimum, mobile code that is unsigned or exhibiting unusual behavior, has not undergone a risk assessment, or is prohibited for use based on a risk assessment.

SRG-NET-000229-IDPS-00163

The TPS must block any prohibited mobile code at the enclave boundary when it is detected.

SRG-NET-000235-IDPS-00169

The TPS must fail to a secure state which maintains access control mechanisms when the IDPS hardware, software, or firmware fails on initialization/shutdown or experiences a sudden abort during normal operation (also known as "Fail closed").

SRG-NET-000362-IDPS-00198

The TPS must protect against or limit the effects of known types of Denial of Service (DoS) attacks by employing signatures.

SRG-NET-000192-IDPS-00140

The TPS must block outbound traffic containing known and unknown DoS attacks by ensuring that security policies, signatures, rules, and anomaly detection techniques are applied to outbound communications traffic.