Description
Libreswan provides an implementation of IPsec
and IKE, which permits the creation of secure tunnels over
untrusted networks. As such, IPsec can be used to circumvent certain
network requirements such as filtering. Verify that if any IPsec connection
(conn) configured in /etc/ipsec.conf and /etc/ipsec.d
exists is an approved organizational connection.
warning alert:
Warning
Automatic remediation of this control is not available due to the unique
requirements of each system.
Rationale
IP tunneling mechanisms can be used to bypass network filtering.
- ID
xccdf_org.ssgproject.content_rule_libreswan_approved_tunnels
- References
CSC: Critical Security Controls
COBIT®: Control Objectives for Information and Related Technologies
CCI: Control Correlation Identifier
HIPAA: Health Insurance Portability and Accountability Act
ISA-62443-2-1-2009, Security for Industrial Automation and Control Systems Part 2-1: Establishing an Industrial Automation and Control Systems Security Program
ANSI/ISA-62443-3-3 (99.03.03)-2013 Security for industrial automation and control systems Part 3-3: System security requirements and security levels
NIST Special Publication 800-53 (Revision 4): Security and Privacy Controls for Federal Information Systems and Organizations
Framework for Improving Critical Infrastructure Cybersecurity
GPOS SRG: General Purpose Operating System Security Requirements Guide
STIG: Security Technical Implementation Guides for UNIX/Linux Operating Systems
STIG References, Finding IDs and Rule IDs
CCE: Common Configuration Enumeration