An Intrusion Detection and Prevention System (IDPS) sensor must be deployed to monitor the network segment hosting web, application, and database servers.

From Network Infrastructure Policy Security Technical Implementation Guide

Part of IDPS sensor is not monitoring Server Farm segments

Associated with: CCI-001097 CCI-001255 CCI-002668

SV-20027r2_rule An Intrusion Detection and Prevention System (IDPS) sensor must be deployed to monitor the network segment hosting web, application, and database servers.

Vulnerability discussion

Attacks can originate within the enclave boundary. Hence, deploying an IDPS on the network segment hosting web, application, and database servers is imperative. The servers are critical resource and the network segment hosting them will receive the most traffic within the enclave. Deploying IDPS on this network is promotes defense-in-depth principles that will enable operations to detect attacks quickly and take corrective actions.

Check content

Review topology of the network segment hosting the web, application, and database servers. If this segment is not being monitored by an IDPS sensor, this is a finding.

Fix text

Implement an IDPS strategy to monitor the network segment hosting web, application, and database servers.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.