II - Mission Support Sensitive

SRG-NET-000166-ALG-000101

The BIG-IP Core implementation providing PKI-based, user authentication intermediary services must be configured to map the authenticated identity to the user account for PKI-based authentication to virtual servers.

SRG-NET-000169-ALG-000102

The BIG-IP Core implementation must be configured to uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users) when connecting to virtual servers.

SRG-NET-000213-ALG-000107

The BIG-IP Core implementation must terminate all communications sessions at the end of the session or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity, and for user sessions (nonprivileged sessions), the session must be terminated after 15 minutes of inactivity.

SRG-NET-000230-ALG-000113

The BIG-IP Core implementation must be configured to protect the authenticity of communications sessions.

SRG-NET-000313-ALG-000010

The BIG-IP Core implementation providing intermediary services for remote access communications traffic must control remote access methods to virtual servers.

SRG-NET-000318-ALG-000014

To protect against data mining, the BIG-IP Core implementation must be configured to prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields when providing content filtering to virtual servers.

SRG-NET-000318-ALG-000151

To protect against data mining, the BIG-IP Core implementation providing content filtering must be configured to prevent code injection attacks from being launched against application objects, including, at a minimum, application URLs and application code.

SRG-NET-000318-ALG-000152

To protect against data mining, the BIG-IP Core implementation providing content filtering must be configured to prevent SQL injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, and database fields.

SRG-NET-000319-ALG-000015

To protect against data mining, the BIG-IP Core implementation providing content filtering must be configured to detect code injection attacks being launched against data storage objects.

SRG-NET-000319-ALG-000020

To protect against data mining, the BIG-IP Core implementation providing content filtering must be configured to detect SQL injection attacks being launched against data storage objects, including, at a minimum, databases, database records, and database fields.

SRG-NET-000319-ALG-000153

The BIG-IP Core implementation must be configured to detect code injection attacks being launched against application objects, including, at a minimum, application URLs and application code, when providing content filtering to virtual servers.

SRG-NET-000337-ALG-000096

The BIG-IP Core implementation must require users to reauthenticate when the user's role, the information authorizations, and/or the maximum session timeout is exceeded for the virtual server(s).

SRG-NET-000339-ALG-000090

A BIG-IP Core implementation providing user authentication intermediary services must be configured to require multifactor authentication for remote access to non-privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access.

SRG-NET-000340-ALG-000091

The BIG-IP Core implementation providing user authentication intermediary services must be configured to require multifactor authentication for remote access with privileged accounts to virtual servers in such a way that one of the factors is provided by a device separate from the system gaining access.

SRG-NET-000345-ALG-000099

The BIG-IP Core implementation must be configured to deny-by-default all PKI-based authentication to virtual servers supporting path discovery and validation if unable to access revocation information via the network.

SRG-NET-000349-ALG-000106

The BIG-IP Core implementation must be able to conform to FICAM-issued profiles when providing authentication to virtual servers.

SRG-NET-000355-ALG-000117

The F5 BIG-IP appliance providing user authentication intermediary services must only accept end entity certificates issued by DOD PKI or DOD-approved PKI Certification Authorities (CAs) for the establishment of protected sessions.

SRG-NET-000362-ALG-000112

The BIG-IP Core implementation must be configured to protect against known and unknown types of Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis when providing content filtering to virtual servers.

SRG-NET-000362-ALG-000120

The BIG-IP Core implementation must be configured to implement load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks to virtual servers.

SRG-NET-000362-ALG-000126

The BIG-IP Core implementation must be configured to protect against known types of Denial of Service (DoS) attacks by employing signatures when providing content filtering to virtual servers.

SRG-NET-000362-ALG-000155

The BIG-IP Core implementation must be configured to protect against or limit the effects of known and unknown types of Denial of Service (DoS) attacks by employing pattern recognition pre-processors when providing content filtering to virtual servers.

SRG-NET-000364-ALG-000122

The BIG-IP Core implementation must be configured to only allow incoming communications from authorized sources routed to authorized destinations.

SRG-NET-000380-ALG-000128

The BIG-IP Core implementation must be configured to handle invalid inputs in a predictable and documented manner that reflects organizational and system objectives.

SRG-NET-000390-ALG-000139

The BIG-IP Core implementation must continuously monitor inbound communications traffic crossing internal security boundaries for unusual or unauthorized activities or conditions.

SRG-NET-000401-ALG-000127

The BIG-IP Core implementation must be configured to check the validity of all data inputs except those specifically identified by the organization.