Intrusion Detection and Prevention Systems Security Requirements Guide

SRG-NET-000249

The IDPS must block malicious code.

SRG-NET-000249

The IDPS must quarantine and/or delete malicious code.

SRG-NET-000249

The IDPS must send an immediate (within seconds) alert to, at a minimum, the system administrator when malicious code is detected.

SRG-NET-000251

The IDPS must block outbound ICMP Destination Unreachable, Redirect, and Address Mask reply messages.

SRG-NET-000273

The IDPS must block malicious ICMP packets by properly configuring ICMP signatures and rules.

SRG-NET-000318

To protect against unauthorized data mining, the IDPS must prevent code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

SRG-NET-000318

To protect against unauthorized data mining, the IDPS must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.

SRG-NET-000318

The IDPS must off-load log records to a centralized log server.

To protect against unauthorized data mining, the IDPS must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.

SRG-NET-000319

To protect against unauthorized data mining, the IDPS must detect code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

SRG-NET-000319

To protect against unauthorized data mining, the IDPS must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code.

SRG-NET-000319

To protect against unauthorized data mining, the IDPS must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.

SRG-NET-000334

SRG-NET-000335

The IDPS must provide an alert to, at a minimum, the system administrator and ISSO when any audit failure events occur.

SRG-NET-000335

The IDPS must assign a critical severity level to all audit processing failures.

SRG-NET-000362

The IDPS must protect against or limit the effects of known and unknown types of Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis.

SRG-NET-000362

The IDPS must protect against or limit the effects of known and unknown types of Denial of Service (DoS) attacks by employing anomaly-based attack detection.

SRG-NET-000362

The IDPS must protect against or limit the effects of known types of Denial of Service (DoS) attacks by employing signatures.

SRG-NET-000383

IDPS components, including sensors, event databases, and management consoles must integrate with a network-wide monitoring capability.

SRG-NET-000384

The IDPS must detect network services that have not been authorized or approved by the ISSO or ISSM, at a minimum.

SRG-NET-000385

The IDPS must generate a log record when unauthorized network services are detected.

SRG-NET-000385

The IDPS must generate an alert to the ISSM and ISSO, at a minimum, when unauthorized network services are detected.

SRG-NET-000390

The IDPS must continuously monitor inbound communications traffic for unusual/unauthorized activities or conditions.

SRG-NET-000391

The IDPS must continuously monitor outbound communications traffic for unusual/unauthorized activities or conditions.

SRG-NET-000392

The IDSP must send an alert to, at a minimum, the ISSM and ISSO when intrusion detection events are detected which indicate a compromise or potential for compromise.

SRG-NET-000392

The IDPS must send an alert to, at a minimum, the ISSM and ISSO when threats identified by authoritative sources (e.g., IAVMs or CTOs) are detected which indicate a compromise or potential for compromise.