I - Mission Critical Classified

SRG-NET-000318-IDPS-00068

To protect against unauthorized data mining, the TPS must prevent code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

SRG-NET-000318-IDPS-00182

To protect against unauthorized data mining, the TPS must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.

SRG-NET-000318-IDPS-00183

To protect against unauthorized data mining, the TPS must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.

SRG-NET-000319-IDPS-00184

To protect against unauthorized data mining, the TPS must detect code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

SRG-NET-000319-IDPS-00185

To protect against unauthorized data mining, the TPS must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code.

SRG-NET-000319-IDPS-00186

To protect against unauthorized data mining, the TPS must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.

SRG-NET-000018-IDPS-00018

The Trend Micro TippingPoint Security Management System (SMS) must be configured to send security IPS policy to the Trend Micro Threat Protection System (TPS).

SRG-NET-000019-IDPS-00187

The Trend Micro TPS must immediately use updates made to policy filters, rules, signatures, and anomaly analysis algorithms for traffic detection and prevention functions which are all contained in the Digital Vaccine (DV) updates.

SRG-NET-000113-IDPS-00013

The TPS must provide audit record generation capability for detection events based on implementation of policy filters, rules, signatures, and anomaly analysis.

SRG-NET-000113-IDPS-00082

The TPS must provide audit record generation capability for events where communication traffic is blocked or restricted based on policy filters, rules, signatures, and anomaly analysis.

SRG-NET-000089-IDPS-00069

In the event of a logging failure caused by the lack of audit record storage capacity, the SMS must continue generating and storing audit records, overwriting the oldest audit records in a first-in-first-out manner using Audit Log maintenance.

SRG-NET-000091-IDPS-00193

The SMS and TPS must provide log information in a format that can be extracted and used by centralized analysis tools.

SRG-NET-000131-IDPS-00011

The SMS must be configured to remove or disable nonessential capabilities on SMS and TPS, which are not required for operation or not related to IDPS functionality.

SRG-NET-000228-IDPS-00196

The TPS must detect, at a minimum, mobile code that is unsigned or exhibiting unusual behavior, has not undergone a risk assessment, or is prohibited for use based on a risk assessment.

SRG-NET-000229-IDPS-00163

The TPS must block any prohibited mobile code at the enclave boundary when it is detected.

SRG-NET-000235-IDPS-00169

The TPS must fail to a secure state which maintains access control mechanisms when the IDPS hardware, software, or firmware fails on initialization/shutdown or experiences a sudden abort during normal operation (also known as "Fail closed").

SRG-NET-000362-IDPS-00198

The TPS must protect against or limit the effects of known types of denial-of-service (DoS) attacks by employing signatures.

SRG-NET-000192-IDPS-00140

The TPS must block outbound traffic containing known and unknown denial-of-service (DoS) attacks by ensuring that security policies, signatures, rules, and anomaly detection techniques are applied to outbound communications traffic.

SRG-NET-000273-IDPS-00198

The TPS must block outbound ICMP Destination Unreachable, Redirect, and Address Mask reply messages.

SRG-NET-000273-IDPS-00204

The TPS must block malicious ICMP packets by properly configuring ICMP signatures and rules.

SRG-NET-000251-IDPS-00178

The TPS must automatically install updates to signature definitions, detection heuristics, and vendor-provided rules.

SRG-NET-000246-IDPS-00205

The SMS must install updates on the TPS for application software files, signature definitions, detection heuristics, and vendor-provided rules when new releases are available in accordance with organizational configuration management policy and procedures.

SRG-NET-000249-IDPS-00176

The TPS must block malicious code.

SRG-NET-000248-IDPS-00206

The TPS must generate a log record so an alert can be configured to, at a minimum, the system administrator when malicious code is detected.

SRG-NET-000384-IDPS-00209

The TPS must detect network services that have not been authorized or approved by the ISSO or ISSM, at a minimum, through use of a site-approved TPS device profile.