An Intrusion Detection and Prevention System (IDPS) sensor must be deployed to monitor all Demilitarized Zone (DMZ) segments housing public servers.

From Network Infrastructure Policy Security Technical Implementation Guide

Part of IDPS sensor is not monitoring DMZ segments

Associated with: CCI-001097 CCI-001255 CCI-002668

SV-20025r2_rule An Intrusion Detection and Prevention System (IDPS) sensor must be deployed to monitor all Demilitarized Zone (DMZ) segments housing public servers.

Vulnerability discussion

The initial step in IDPS deployment is determining where sensors should be placed. Because attacks originate at the enclave perimeter and within the enclave boundary an IDPS implementation at the enclave perimeter only will not suffice. By placing IDPS technology throughout the Enterprise Regional enclaves and stand-alone enclaves, system administrators can track the spread of attacks and take corrective actions to prevent attacks reaching critical resources.

Check content

Review the DMZ topology and verify public servers are being monitored by an IDPS. If an IDPS sensor is not deployed to monitor all DMZ segments housing public servers, this is a finding.

Fix text

Place an IDPS sensor in the enclave to monitor public servers.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.