The Intrusion Detection and Prevention System (IDPS) software and signatures must be updated when updates are provided by the vendor.

From Network Infrastructure Policy Security Technical Implementation Guide

Part of SA has not subscribed to the vendor notifications.

Associated with: CCI-000366

SV-8566r2_rule The Intrusion Detection and Prevention System (IDPS) software and signatures must be updated when updates are provided by the vendor.

Vulnerability discussion

Keeping the IDPS software updated with the latest engine and attack signatures will allow for the IDPS to detect all forms of known attacks. Not maintaining the IDPS properly could allow for attacks to go unnoticed.

Check content

Interview the ISSO and the IDPS administrator. Have the IDPS administrator display update notifications that have been received, the build number or patch level, then search the vendor’s vulnerability database for current release and patch level. If software and signatures are not updated when updates are provided by the vendor, this is a finding.

Fix text

Have the IDPS administrator subscribe to the X-press notification or similar service offered by the vendor. Ensure the IDPS software is updated when software is available either by DISA or the vendor for security related distributions.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.