The Bromium Enterprise Controller (BEC) Update Interval must be set to a maximum of one hour.

From Bromium Secure Platform 4.x Security Technical Implementation Guide

Associated with: CCI-002039

SV-95167r1_rule The Bromium Enterprise Controller (BEC) Update Interval must be set to a maximum of one hour.

Vulnerability discussion

Without reauthenticating the endpoint, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.The BEC Update Interval setting controls the frequency of check-ins for policy updates, remote commands and a Bromium vSentry event data. The value set is in seconds. During the update connection with the BEC, the Bromium vSentry client's device certificate is reauthenticated.

Check content

Verify the Update Interval is set to one hour. 1. From the management console, navigate to the "Policies" menu. 2. Select the Base policy. 3. Click the "Manageability" tab. 4. Inspect the "Update Interval" parameter to reflect the desired interval (1 hour/3600 seconds is the maximum). If the BEC Update Interval is set to more than one hour, this is a finding.

Fix text

Configure the Update Internal for the BEC/vSentry client update of event data, remote commands, policy updates, and reauthenication. 1. From the management console, navigate to the "Policies" menu. 2. Select the Base policy. 3. Click the "Manageability" tab. 4. Edit the "Update Interval" parameter to reflect "3600" seconds. 5. Click "Save and Deploy". Note: A value of 1 hour/3600 seconds is the recommended setting; however, the setting may be changed to a lower interval based on mission needs.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.