Skip to content
ATO Pathways
  Log In

CA API Gateway ALG Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-NET-000018-ALG-000017

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-NET-000101-ALG-000059

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway must off-load audit records onto a centralized log server.

    &lt;VulnDiscussion&gt;Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common...
    Rule Medium Severity
    Show

  • SRG-NET-000337-ALG-000096

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway must enforce approved authorizations for controlling the flow of information within the network based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.

    &lt;VulnDiscussion&gt;Information flow control regulates where information is allowed to travel within a network. The flow of all network traffic m...
    Rule Medium Severity
    Show

  • SRG-NET-000019-ALG-000018

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway must restrict or block harmful or suspicious communications traffic by controlling the flow of information between interconnected networks based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.

    &lt;VulnDiscussion&gt;Information flow control regulates where information is allowed to travel within a network and between interconnected network...
    Rule Medium Severity
    Show

  • SRG-NET-000041-ALG-000022

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway providing user access control intermediary services must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.

    &lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the network ensures privacy and security no...
    Rule Medium Severity
    Show

  • SRG-NET-000042-ALG-000023

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway providing user access control intermediary services must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.

    &lt;VulnDiscussion&gt;The banner must be acknowledged by the user prior to allowing the user access to the network. This provides assurance that th...
    Rule Medium Severity
    Show

  • SRG-NET-000043-ALG-000024

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway providing user access control intermediary services for publicly accessible applications must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.

    &lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the publicly accessible network element ens...
    Rule Medium Severity
    Show

  • SRG-NET-000053-ALG-000001

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway providing user access control intermediary services must limit users to two concurrent sessions.

    &lt;VulnDiscussion&gt;Network element management includes the ability to control the number of users and user sessions that utilize a network eleme...
    Rule Medium Severity
    Show

  • SRG-NET-000062-ALG-000011

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway providing intermediary services for remote access communications traffic must use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.

    &lt;VulnDiscussion&gt;Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote...
    Rule Medium Severity
    Show

  • SRG-NET-000062-ALG-000092

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway that stores secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.

    &lt;VulnDiscussion&gt;Private key data is used to prove the entity presenting a public key certificate is the certificate's rightful owner. Comprom...
    Rule Medium Severity
    Show

  • SRG-NET-000062-ALG-000150

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway that provides intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52.

    &lt;VulnDiscussion&gt;SP 800-52 provides guidance on using the most secure version and configuration of the TLS/SSL protocol. Using older unauthori...
    Rule Medium Severity
    Show

  • SRG-NET-000063-ALG-000012

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.

    &lt;VulnDiscussion&gt;Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote acce...
    Rule Medium Severity
    Show

  • SRG-NET-000077-ALG-000046

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway must produce audit records containing information to establish the source of the events.

    &lt;VulnDiscussion&gt;Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up...
    Rule Medium Severity
    Show

  • SRG-NET-000078-ALG-000047

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway must produce audit records containing information to establish the outcome of the events.

    &lt;VulnDiscussion&gt;Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attac...
    Rule Medium Severity
    Show

  • SRG-NET-000079-ALG-000048

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway must generate audit records containing information to establish the identity of any individual or process associated with the event.

    &lt;VulnDiscussion&gt;Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associ...
    Rule Medium Severity
    Show

  • SRG-NET-000098-ALG-000056

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway must protect audit information from unauthorized read access.

    &lt;VulnDiscussion&gt;Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means...
    Rule Medium Severity
    Show

  • SRG-NET-000100-ALG-000058

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway must protect audit information from unauthorized deletion.

    &lt;VulnDiscussion&gt;If audit data becomes compromised, forensic analysis and discovery of the true source of potentially malicious system activit...
    Rule Medium Severity
    Show

  • The CA API Gateway must protect audit tools from unauthorized access.

    &lt;VulnDiscussion&gt;Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, pro...
    Rule Medium Severity
    Show

  • SRG-NET-000131-ALG-000085

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway must not have unnecessary services and functions enabled.

    &lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions (capabilities or processes) and services. Some of th...
    Rule Medium Severity
    Show

  • SRG-NET-000131-ALG-000086

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway must be configured to remove or disable unrelated or unneeded application proxy services.

    &lt;VulnDiscussion&gt;Unrelated or unneeded proxy services increase the attack vector and add excessive complexity to the securing of the ALG. Mult...
    Rule Medium Severity
    Show

  • SRG-NET-000132-ALG-000087

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments.

    &lt;VulnDiscussion&gt;In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e....
    Rule Medium Severity
    Show

  • SRG-NET-000138-ALG-000063

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway providing user authentication intermediary services must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

    &lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to pre...
    Rule Medium Severity
    Show

  • SRG-NET-000138-ALG-000088

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway providing user access control intermediary services must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) that validate user account access authorizations and privileges.

    &lt;VulnDiscussion&gt;User account and privilege validation must be centralized in order to prevent unauthorized access using changed or revoked pr...
    Rule Medium Severity
    Show

  • SRG-NET-000138-ALG-000089

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway providing user authentication intermediary services must restrict user authentication traffic to specific authentication server(s).

    &lt;VulnDiscussion&gt;User authentication can be used as part of the policy filtering rule sets. Some URLs or network resources can be restricted t...
    Rule Medium Severity
    Show

  • SRG-NET-000140-ALG-000094

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ALG providing user authentication intermediary services must use multifactor authentication for network access to non-privileged accounts.

    &lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to ...
    Rule Medium Severity
    Show

  • SRG-NET-000147-ALG-000095

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA API Gateway providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.

    &lt;VulnDiscussion&gt;A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authen...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules