Cisco ASA Firewall Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-NET-000019-FW-000003
Group -
The Cisco ASA must be configured to filter outbound traffic, allowing only authorized ports and services.
Information flow control regulates where information is allowed to travel within a network and between interconnected networks. Blocking or restricting detected harmful or suspicious communications...Rule High Severity -
The Cisco ASA must immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones.
Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the Ports, Protocols, Services Management (P...Rule Medium Severity -
The Cisco ASA must be configured to generate traffic log entries containing information to establish what type of events occurred.
Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit event content that may be neces...Rule Medium Severity -
The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable.
It is critical that when the network element is at risk of failing to process traffic logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware ...Rule Medium Severity -
The Cisco ASA must be configured to enable threat detection to mitigate risks of denial-of-service (DoS) attacks.
A firewall experiencing a DoS attack will not be able to handle production traffic load. The high utilization and CPU caused by a DoS attack will also have an effect on control keep-alives and time...Rule Medium Severity -
The Cisco ASA must be configured to filter outbound traffic on all internal interfaces.
If outbound communications traffic is not filtered, hostile activity intended to harm other networks or packets from networks destined to unauthorized networks may not be detected and prevented. A...Rule Medium Severity -
The Cisco ASA must be configured to inspect all inbound and outbound traffic at the application layer.
Application inspection enables the firewall to control traffic based on different parameters that exist within the packets such as enforcing application-specific message and field length. Inspectio...Rule Medium Severity -
The Cisco ASA must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).
A compromised host in an enclave can be used by a malicious platform to launch cyberattacks on third parties. This is a common practice in "botnets", which are a collection of compromised computers...Rule Medium Severity -
The Cisco ASA must be configured to implement scanning threat detection.
In a port scanning attack, an unauthorized application is used to scan the host devices for available services and open ports for subsequent use in an attack. This type of scanning can be used as a...Rule High Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.