kriterion 0.0.1

data/standards/stig_idsips.json

@@ -0,0 +1,257 @@
+{
+  "name": "stig_idsips",
+  "date": "2013-10-08",
+  "description": "IDS/IPS Security Technical Implementation Guide",
+  "title": "IDS/IPS Security Technical Implementation Guide",
+  "version": "8",
+  "item_syntax": "^\\w-\\d+$",
+  "section_separator": null,
+  "items": [
+    {
+      "id": "V-14646",
+      "title": "Alerts must be automatically generated to notify the administrator when log storage reaches seventy-five percent or more of its maximum capacity.",
+      "description": "Configuring the network device or syslog server to provide alerts to the administrator in the event of modification or audit log capacity being exceeded ensures administrative staff is aware of critical alerts.  Without this type of notification setup, logged audits and events could potentially fill to capacity, causing subsequent records to not be recorded and dropped without any knowledge by the administrative staff.  Other unintended consequences of filling the log storage to capacity may include a denial of service of the device itself without proper notification.",
+      "severity": "low"
+    },
+    {
+      "id": "V-14671",
+      "title": "The network element must authenticate all NTP messages received from NTP servers and peers.",
+      "description": "Since NTP is used to ensure accurate log file timestamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. \n\nTwo NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka “symmetric mode”). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client’s stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers.\n\nA hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device looses connectivity to it upstream NTP server, it will be able to choose time from one of its peers. \n\nThe NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It’s not used to authenticate NTP clients because NTP servers don’t care about the authenticity of their clients, as they never accept any time from them. \n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-14717",
+      "title": "The network element must not allow SSH Version 1 to be used for administrative access.",
+      "description": "SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to attacks, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1. ",
+      "severity": "medium"
+    },
+    {
+      "id": "V-17821",
+      "title": "The network element’s OOBM interface must be configured with an OOBM network address.",
+      "description": "The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering.  The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-18484",
+      "title": "IDPS consoles, management and database servers must reside on the management network.",
+      "description": "Sensors and agents monitor and analyze activity. The term sensor is typically used for IDPSs that monitor networks, including network-based, wireless, and network behavior analysis technologies. The term agent is typically used for host-based IDPS technologies. \n\nA management server is a centralized device that receives information from the sensors or agents and manages them. Some management servers perform analysis on the event information that the sensors or agents provide and can identify events that the individual sensors or agents cannot. Matching event information from multiple sensors or agents, such as finding events triggered by the same IP address, is known as correlation. Management servers are available as both appliance and software-only products. Some small IDPS deployments do not use any management servers, but most IDPS deployments do. In larger IDPS deployments, there are often multiple management servers, and in some cases there are two tiers of management servers.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-18489",
+      "title": "The Network IDPS administrator will ensure all Network IDPS systems are installed and operational in stealth mode —no ip address on interface with data flow.",
+      "description": "Administrators should ensure that for both passive and inline sensors, IP addresses are not\nassigned to the network interfaces used to monitor network traffic. Only networks interfaces used for IDPS management should have an IP address assigned. Operating a sensor without IP addresses assigned to its monitoring interfaces is known as operating in stealth mode. Stealth mode improves the security of the IDPS sensors because it prevents other hosts from initiating connections to them. This conceals the sensors from attackers and thus limits their exposure to attacks.  If monitoring is being performed using a switch SPAN port, it is recommended that the IDPS is configured in Stealth Mode; the NIC connected to the SPAN port would not have any network protocol stacks bound to it.  A second NIC would then be connected to an OOB network.  Stealth mode will reduce the risk of the IDPS itself being attacked.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-18501",
+      "title": "The IAO/NSO will ensure notifications are sent to the syslog server or central controller when threshold limits exceed the sensor’s capacity.",
+      "description": "Scaling IDPS sensors to avoid missed packets as a result of CPU and memory thresholds when link mbps is greater than what the engine can inspect should be an initial consideration prior to deployment. The IDPS administrator will have the sensor send notifications to the syslog server or central controller when thresholds limits do occur.\n\nAs mentioned in the guidance for Server Farms, VACLs can also be a useful tool to help scale the traffic a sensor receives. The VACL capture feature allows you to mirror traffic to ports configured to forward captured traffic. By defining the interested traffic, for instance web traffic, a copy of the http traffic only could be forwarded to the sensing interface avoiding data overflow. Additional design options such as Remote Switch Port Analyzer (RSPAN) are available and should be considered by the network engineer.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-18502",
+      "title": "The Network IDPS administrator will review whitelists and blacklists regularly and validate all entries to ensure that they are still accurate and necessary.",
+      "description": "A blacklist is a list of discrete entities, such as hosts, TCP or UDP port numbers, ICMP types and codes, applications, usernames, URLs, filenames, or file extensions, that have been previously determined to be associated with malicious activity. Blacklists, also known as hot lists, are typically used to allow IDPSs to recognize and block activity that is highly likely to be malicious, and may also be used to assign a higher priority to alerts that match entries on the blacklists. Some IDPSs generate dynamic blacklists that are used to temporarily block recently detected threats (e.g., activity from an attacker’s IP address). A whitelist is a list of discrete entities that are known to be benign. Whitelists are typically used on a granular basis, such as protocol-by-protocol, to reduce or ignore false positives involving known benign activity from trusted hosts. Whitelists and blacklists are most commonly used in signature-based detection and stateful protocol analysis.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-18508",
+      "title": "The Network administrator will implement signatures that detect specific attacks and protocols that should not be seen on the segments containing web servers.",
+      "description": "In the Regional Enterprise Enclave different sets of sensors will see different traffic as a result of their location within the regional enclave. By establishing separate signature profiles for each set of sensors, each profile can then be tuned to generate alarms based on the traffic types seen, the attack signatures, and the specific traffic (string signatures) that is relevant to that particular set of sensors. If more than one set of sensors will see the same traffic types, then the same signature profile may be used for both sets. Alerting on specific connection signatures, general attack signatures, and specific string signatures provides focused segment analysis at Layers 4 through 7.\n\nThe IDPS system administrator will ensure the sensor monitoring the web servers is configured for application inspection and control of all web ports e.g. 80, 3128, 8000, 8010, 8080, 8888, 24326, etc. The sensor monitoring the web servers should be capable of inspecting web traffic that is not received on web ports; known as port redirection. In many implementations this is a separate signature that needs to be enabled.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-18509",
+      "title": "The Network administrator will implement signatures that detect both specific attacks on public service servers and traffic types (protocols) that should not be seen on the segments containing ftp servers.",
+      "description": "In the Regional Enterprise Enclave different sets of sensors will see different traffic as a result of their location within the regional enclave. By establishing separate signature profiles for each set of sensors, each profile can then be tuned to generate alarms based on the traffic types seen, the attack signatures, and the specific traffic (string signatures) that is relevant to that particular set of sensors. If more than one set of sensors will see the same traffic types, then the same signature profile may be used for both sets. Alerting on specific connection signatures, general attack signatures, and specific string signatures provides focused segment analysis at Layers 4 through 7.\n\nNetwork segments containing FTP servers should have sensors installed that monitor, inspect and log all recognized ftp commands, as well as unrecognized ftp commands.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-18512",
+      "title": "The Network IDPS administrator will tune the sensor to alarm if unexpected protocols for network management enter the subnet.",
+      "description": "The management network must detect all attacks on the management hosts. The management network has a various range of traffic that is permitted. Some of the following traffic is allowed on the\nManagement Hosts Segment: Trivial File Transfer Protocol (TFTP [UDP 69])—For network device configuration files from devices on the Managed Devices Segment; FTP-Data (TCP 20)—For file transfers to network devices on the Managed Devices Segment and for Internet downloads; FTP-Control (TCP 21)—For file transfers to network devices on the Managed Devices Segment and for Internet downloads; Syslog (UDP 514)—From network devices on the Managed Devices Segment; Telnet (TCP 23)—To network devices on the Managed Devices Segment; SSH (TCP 22)—To network devices on the Managed Devices Segment;  Network Time Protocol (NTP [UDP 123])—To synchronize the clocks of all network devices on the Managed Devices Segment; HTTP (TCP 80)—To the Internet and from hosts on other segments to download the host-based IPS agent software; HTTPS (TCP 443)—To network devices on the Managed Devices Segment and the Internet as well as between the host-based IPS Console and its agents;  TACACS+ (TCP 49)—For administrator authentication to devices on the Managed Devices Segment;  RADIUS (UDP 1812/1813 authentication/accounting)—For authentication of administrator remote-access VPN connections coming from the Remote Administration Segment; ICMP (IP Protocol 1)—Echo request and response to reach network devices on the Managed Devices Segment and the Internet; DNS (UDP 53)—For name translation services for management hosts as they access services on the Internet;  Simple Network Management Protocol (SNMP [UDP 161])—To query information from network devices on the\nManaged Devices Segment; SNMP-Trap (UDP 162)—To receive trap information from network devices on the Managed Devices Segment.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-18513",
+      "title": "The Network IDPS administrator will ensure IP hijacking signatures have been implemented with the common default signatures.",
+      "description": "There are a number of publicly available tools that exist to facilitate the hijacking of TCP sessions. An attacker using such tools can determine the TCP sequence and acknowledgement numbers that two hosts are using in a communication session. This information could enable the attacker to take over the legitimate network connection of an authorized user and inject commands into the session. This is particularly serious because most forms of one-time passwords do not prevent this access.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-18632",
+      "title": "The IAO/NSO will ensure if DHCPV6 is not being used in the enclave it will be disabled.",
+      "description": "Currently, many vendors are not prepared for DHCPv6 stateful autoconfiguration, thus there are very few implementations of it.  DHCPv6 is a completely separate protocol than DHCPv4.  In IPV6 DHCPDISCOVER use of the unspecified address 0.0.0.0 with a broadcast address. These messages are sent with a FF02::1:2 (RFC3315) via IPv6 support of link-local autoconfiguration.  There is also DHCPv6-Prefix Delegation that allows nodes to request not just an address, but also the entire prefix.  DHCPv6-PD is primarily used by routers.  Stateful autoconfiguration offers the best auditing capabilities due to the logs being centralized at the DHCP server and may become the preferred implementation as the protocol matures.\n\nWhen DHCP is not being used in an IPv6 network, DHCP packets should be filtered at security boundaries and internally at router interfaces where possible.  The internal filtering will not completely prevent use since any on-link attacks never pass through a router, hence the IDS recommendations follow.\n\nCreate an IDS check to detect any inconsistencies in the advertised “M or O bit values” of router advertisements on a link.\n\nIf DHCP is not being used in the network, create an IDS check to detect traffic on the commonly used DHCP ports. The following port numbers for both TCP and UDP are associated with DHCP: 67, 68, 546, 547, 647, 847, and 2490. \n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-19233",
+      "title": "The IDPS device positioned to protect servers in the server farm or DMZs must provide protection from DoS SYN Flood attacks by dropping half open TCP sessions.",
+      "description": "SYN flood sends a flood of TCP/SYN packets, often with a forged sender address. Each of these packets is handled like a connection request, causing the server to spawn a half-open connection, by sending back a TCP/SYN-ACK packet, and waiting for a packet in response from the sender address. However, because the sender address is forged, the response never comes. These half-open connections saturate the number of available connections the server is able to make, keeping it from responding to legitimate requests until after the attack ends.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-19246",
+      "title": "The Network IDPS administrator will ensure the IDPS is protecting the enclave from malware and unexpected traffic by using TCP Reset signatures. ",
+      "description": "By listening to the conversation flow of inbound and outbound internet traffic for malware and malware references,  the IDPS can prevent unwanted programs entering into the enclave. When it detects unmanaged instant messaging and peer-to-peer protocols or malware coming over IM , the IDPS can prevent the unwanted computer programs from entering the network by spoofing the source and destination machine addresses to send each session partner a TCP Reset packet. The TCP Reset instructs both sender and receiver to cease the current transfer of data.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-19250",
+      "title": "The IDPS administrator will ensure LAND DoS signature has been implemented to protect the enclave. ",
+      "description": "The LAND attack is a denial-of-service (DoS) attack in which an attacker sends a TCP packet (with the SYN bit set) to a system in which the source and destination IP address (along with the source and destination port) are the same. When it was first discovered, many IP stacks crashed the system when they received a LAND attack.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-19256",
+      "title": "The IDPS Administrator will ensure Atomic Signatures are implemented to protect the enclave.",
+      "description": "Without an industry agreed-upon set of definitions for IDPS controls, the use of the term signature will apply to all IDPS technologies. Signatures are defined as identifying something, defining it and then stop it from occurring.\n\nSignatures fall into one of the following two basic categories depending on their functionality:\n- Atomic\n- Stateful\n\nAtomic signatures trigger on a single event, they do not require your intrusion system to maintain state. The entire inspection can be accomplished in an atomic operation that does not require any knowledge of past or future activities. these signatures consume minimal resources (such as memory) on the IPS/IDS device. These signatures are easy to understand because they search only for a specific event. \n\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-23747",
+      "title": "The network element must use two or more NTP servers to synchronize time.",
+      "description": "Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If logs cannot be successfully compared between each of the routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.",
+      "severity": "low"
+    },
+    {
+      "id": "V-28784",
+      "title": "A service or feature that calls home to the vendor must be disabled.  \n",
+      "description": "Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting.  The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3012",
+      "title": "The network element must be password protected.",
+      "description": "Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization’s security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network element. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network element providing opportunity for intruders to compromise resources within the network infrastructure.",
+      "severity": "high"
+    },
+    {
+      "id": "V-3013",
+      "title": "The network element must display the DoD approved login banner warning in accordance with the CYBERCOM DTM-08-060 document.",
+      "description": "All network devices must present  a DoD approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required login warning banner prior to logon attempts will limit DoD’s ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA’s ability to monitor the device’s usage is limited unless a proper warning banner is displayed.\n\nDoD CIO has issued new, mandatory policy standardizing the wording of “notice and consent” banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, “Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement”, dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3014",
+      "title": "The network element must timeout management connections for administrative access after 10 minutes or less of inactivity.",
+      "description": "Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled between the managed network element and a PC or terminal server when the later has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network element as well as reduce the risk of a management session from being hijacked. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3056",
+      "title": "Group accounts must not be configured for use on the network device.\n",
+      "description": "Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account.  If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device.  Having group accounts does not allow for proper auditing of who is accessing or changing the network.",
+      "severity": "high"
+    },
+    {
+      "id": "V-3057",
+      "title": "Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.\n",
+      "description": "By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personell are trained or experienced enough to use those functions.  Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3058",
+      "title": "Unauthorized accounts must not be configured for access to the network device.",
+      "description": "A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use.  The unauthorized account may be a temporary or inactive account that is no longer needed to access the device.  Denial of Service, interception of sensitive information, or other destructive actions could potentially take place if an unauthorized account is configured to access the network device.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3069",
+      "title": "Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.",
+      "description": "Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information.  With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3070",
+      "title": "The network element must log all attempts to establish a management connection for administrative access.",
+      "description": "Audit logs are necessary to provide a trail of evidence in case the network is compromised.  Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely.  With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.",
+      "severity": "low"
+    },
+    {
+      "id": "V-3143",
+      "title": "The network element must not have any default manufacturer passwords.",
+      "description": "Network elements not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service.  Many default vendor passwords are well known; hence, not removing them prior to deploying the network element into production provides an opportunity for a malicious user to gain unauthorized access to the device.",
+      "severity": "high"
+    },
+    {
+      "id": "V-3160",
+      "title": "The network element must be running a current and supported operating system with all IAVMs addressed.",
+      "description": "Network devices not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches, as well as enhancements to IP security. Viruses, denial of service attacks, system weaknesses, back doors and other potentially harmful situations could render a system vulnerable, allowing unauthorized access to DoD assets.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3175",
+      "title": "The network device must require authentication prior to establishing a management connection for administrative access.",
+      "description": "Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.",
+      "severity": "high"
+    },
+    {
+      "id": "V-3176",
+      "title": "The IAO/NSO will ensure the IDS or firewall is configured to alert the administrator of a potential attack or system failure. ",
+      "description": "The IDS or firewall is the first device that is under the sites control that has the possibility to alarm the local staff of an ongoing attack. An alert from either of these devices can be the first indication of an attack or system failure.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3179",
+      "title": "The IAO/NSO will ensure the sensor’s monitoring application or mechanism retrieves events from the sensor before the queue becomes full.",
+      "description": "Events on the sensor are typically stored on a large input queue. The queue in the sensor is typically very large and can hold several days of logging events under normal conditions. Nevertheless, the monitoring application must retrieve events from the sensor before the queue becomes full; otherwise the sensor will start overwriting the unread events.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3196",
+      "title": "The network element must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.",
+      "description": "SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network.",
+      "severity": "high"
+    },
+    {
+      "id": "V-3210",
+      "title": "The network element must not use the default or well-known SNMP community strings public and private.",
+      "description": "Network elements may be distributed by the vendor pre-configured with an SNMP agent using the well known SNMP community strings public for read only and private for read and write authorization.  An attacker can obtain information about a network element using the read community string \"public\". In addition, an attacker can change a system configuration using the write community string \"private\".",
+      "severity": "high"
+    },
+    {
+      "id": "V-3967",
+      "title": "The network element must time out access to the console port after 10 minutes or less of inactivity.",
+      "description": "Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network element. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-4582",
+      "title": "The network device must require authentication for console access.",
+      "description": "Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.",
+      "severity": "high"
+    },
+    {
+      "id": "V-5611",
+      "title": "The network element must only allow management connections for administrative access from hosts residing in the management network.",
+      "description": "Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment, could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-5612",
+      "title": "The network element must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.",
+      "description": "An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for the malicious user attempting to make a connection to the network element.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-5613",
+      "title": "The network element must be configured for a maximum number of unsuccessful SSH login attempts set at 3 before resetting the interface.  ",
+      "description": "An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-5646",
+      "title": "The network device must drop half-open TCP connections through filtering thresholds or timeout periods.",
+      "description": "A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance of that acknowledgement is sent by the originator.\n\nAn attacker’s goal in this scenario is to cause a denial of service to the network or device by initiating a high volume of TCP packets, then never sending an acknowledgement, leaving connections in a half-opened state.  Without the device having a connection or time threshold for these half-opened sessions, the device risks being a victim of a denial of service attack.  Setting a TCP timeout threshold will instruct the device to shut down any incomplete connections. Services such as SSH, BGP, SNMP, LDP, etc. are some services that may be prone to these types of denial of service attacks. If the router does not have any BGP connections with BGP neighbors across WAN links, values could be set to even tighter constraints.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-7011",
+      "title": "The network element’s auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.",
+      "description": "The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network.  Additional war dial attacks on the device could degrade the device and the production network.\n\nSecured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place.  The modem will provide full encryption capability (Triple DES) or stronger.  The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.).  The token provides a method of strong (two-factor) user authentication.  The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals.  The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.",
+      "severity": "low"
+    }
+  ]
+}

data/standards/stig_iis6_server.json

@@ -0,0 +1,221 @@
+{
+  "name": "stig_iis6_server",
+  "date": "2015-06-01",
+  "description": "None",
+  "title": "IIS6 Server",
+  "version": "None",
+  "item_syntax": "^\\w-\\d+$",
+  "section_separator": null,
+  "items": [
+    {
+      "id": "V-13591",
+      "title": "Classified web servers must be afforded physical security commensurate with the classification of its content.",
+      "description": "When data of a classified nature is migrated to a web server, fundamental principles applicable to the safeguarding of classified material must be followed. A classified web server needs to be afforded physical security commensurate with the classification of its content to ensure the protection of the data it houses.",
+      "severity": "high"
+    },
+    {
+      "id": "V-13613",
+      "title": "The site software used with the web server must have all applicable security patches applied and documented.",
+      "description": "The IAVM process does not address all patches that have been identified for the host operating system or, in this case, the web server software environment. Many vendors have subscription services available to notify users of known security threats. The site needs to be aware of these fixes and make determinations based on local policy and what software features are installed, if these patches need to be applied. \n\nIn some cases, patches also apply to middleware and database systems. Maintaining the security of web servers requires frequent reviews of security notices. Many security notices mandate the installation of a software patch to overcome security vulnerabilities. \n\nSAs and ISSOs should regularly check the vendor support web site for patches and information related to the web server software. All applicable security patches will be applied to the operating system and to the web server software. Security patches are deemed applicable if the product is installed, even if it is not used or is disabled.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-13621",
+      "title": "All web server documentation, sample code, example applications, and tutorials must be removed from a production web server.",
+      "description": "Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server. A production web server may only contain components that are operationally necessary (e.g., compiled code, scripts, web-content, etc.). Delete all directories containing samples and any scripts used to execute the samples.",
+      "severity": "high"
+    },
+    {
+      "id": "V-13698",
+      "title": "The IISADMPWD directory must be removed from the Web server.",
+      "description": "The IISADMPWD directory is included by default with IIS. It allows users to reset Windows passwords. The use of userid and passwords is a far less secure solution for controlling user access to web applications than a PKI solution with subscriber certificates. The capability to be able to change passwords externally gives potential intruders an easier mechanism to access the system in an effort to compromise user IDs and passwords.",
+      "severity": "high"
+    },
+    {
+      "id": "V-13700",
+      "title": "The File System Object component, if not required, must be disabled.",
+      "description": "Some COM components are not required for most applications and should be removed if possible.  Most notably, consider disabling the File System Object component; however, this will also remove the Dictionary object.  Be aware some programs may require components that are being disabled, so it is highly recommended this be tested completely before implementing on your production Web servers.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-13701",
+      "title": "The command shell options must be disabled.",
+      "description": "The command shell can be used to call arbitrary commands at the web server from within an HTML page.  ",
+      "severity": "high"
+    },
+    {
+      "id": "V-13714",
+      "title": "The AllowRestrictedChars registry key must be disabled.",
+      "description": "IIS6 Http.sys is the kernel mode driver that handles HTTP requests.  There are several registry keys associated with http.sys.  If the AllowRestrictedChars key is set to a nonzero value, Http.sys accepts hex-escaped chars in request URLs that decode to U+0000 – U+001F and U+007F – U+009F ranges. If this capability is enabled it allows malicious characters to be hex-encoded by an attacker in an attempt to bypass input validation routines.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-13715",
+      "title": "The EnableNonUTF8 registry key must be disabled.",
+      "description": "Http.sys is the kernel mode driver that handles HTTP requests.  There are several registry keys associated with http.sys.  The EnableNonUTF8 registry key expands the amount of character types the web server accepts.  Hackers can use this capability to submit content in a URL that can execute in the CPU by means of a buffer overflow.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-13716",
+      "title": "The FavorUTF8 registry key must be set properly.",
+      "description": "Http.sys is the kernel mode driver that handles HTTP requests.  There are several registry keys associated with http.sys.  The FavorUTF8 registry key allows URLs to be decoded as UTF-8 before any other encoding.\n\nOverlong encoding forms have been used to bypass security validations in high profile products including Microsoft's IIS web server. Therefore, great care must be taken to avoid security issues if validation is performed before conversion from UTF-8, and it is generally much simpler to handle overlong forms before any input validation is done.\n\nTo maintain security in the case of invalid input, there are two options. The first is to decode the UTF-8 before doing any input validation checks. The second is to use a decoder that, in the event of invalid input, returns either an error or text the application considers to be harmless. Another possibility is to avoid conversion out of UTF-8 altogether but this relies on any other software that the data is passed to safely handling the invalid data.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-13717",
+      "title": "The MaxFieldLength registry entry must be set properly.",
+      "description": "By default, the MaxFieldLength registry entry is not present. This registry entry specifies the maximum size of any individual HTTP client request. Typically, this registry entry is configured together with the MaxRequestBytes registry entry.   Setting this value to high, when the application does not require it to operate, may cause performance problems as well as Denial of Service issues for the web server.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-13718",
+      "title": "The MaxRequestBytes registry entry must be set properly.",
+      "description": "Http.sys is the kernel mode driver that handles HTTP requests.  There are several registry keys associated with http.sys.  The MaxRequestBytes registry key determines the upper limit for the total size of the HTTP request line and headers. If this value is set too high, performance or Denial of Service conditions may appear.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-13719",
+      "title": "The UrlSegmentMaxLength registry entry must be set properly.",
+      "description": "Http.sys is the kernel mode driver that handles HTTP requests.  There are several registry keys associated with http.sys.  The UrlSegmentMaxLength key sets the maximum number of characters in a URL path segment (the area between the slashes in the URL). Setting this value too large may cause performance or a Denial of Service condition on the web server.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-13720",
+      "title": "The PercentUAllowed registry entry must be set properly.",
+      "description": "Http.sys is the kernel mode driver that handles HTTP requests.  There are several registry keys associated with http.sys.  The PercentUAllowed key allows the web server to accept Unicode character syntax via ASCII (i.e., through the URL). Allowing this type of notation, opens the web server to encoding attacks.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-13721",
+      "title": "The UriMaxUriBytes registry entry must be set properly.",
+      "description": "Http.sys is the kernel mode driver that handles HTTP requests.  There are several registry keys associated with http.sys.  The UriMaxUriBytes key is used to set size limits on what is cached in the kernel response cache. Setting this value to large may cause performance or Denial of Service conditions on the web server.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-13722",
+      "title": "The UrlSegmentMaxCount registry entry must be set properly.",
+      "description": "Http.sys is the kernel mode driver that handles HTTP requests.  There are several registry keys associated with http.sys.  The UrlSegmentMaxCount value determines the maximum number of URL path segments accepted by the server. It effectively limits the number of slashes that can be included by the user in a request URL.  It is recommended to set fairly stringent limits on this value based on the depth of the web document root tree to protect the server from a file system traversal attack.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2232",
+      "title": "The web server service password(s) must be entrusted to the SA or Web Manager.",
+      "description": "Normally, a service account is established for the web server. This is because a privileged account is not desirable and the server is designed to run for long uninterrupted periods of time. The SA or Web Manager will need password access to the web server to restart the service in the event of an emergency as the web server is not to restart automatically after an unscheduled interruption.  If the password is not entrusted to an SA or web manager the ability to ensure the availability of the web server is compromised.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2234",
+      "title": "Public web server resources must not be shared with private assets.",
+      "description": "It is important to segregate public web server resources from private resources located behind the DoD DMZ in order to protect private assets. When folders, drives or other resources are directly shared between the public web server and private servers the intent of data and resource segregation can be compromised.  Resources such as printers, files, and folders/directories must not be shared between public web servers and assets located within the internal network.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2235",
+      "title": "The service account ID used to run the web service must have its password changed at least annually.",
+      "description": "Normally, a service account is established for the web service to run under rather than permitting it to run as system or root. The password on such accounts must be changed at least annually. It is a fundamental tenet of security that passwords are not to be null and not to be set to never expire.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2236",
+      "title": "A compiler must not be installed on a production web server.",
+      "description": "The presence of a compiler on a production server facilitates the malicious user’s task of creating custom versions of programs and installing Trojan Horses or viruses.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2242",
+      "title": "A public web server, if hosted on the NIPRNet, must be isolated in an accredited DoD DMZ Extension.",
+      "description": "To minimize exposure of private assets to unnecessary risk by attackers, public web servers must be isolated from internal systems.  Public web servers are by nature more vulnerable to attack from publically based sources, such as the public Internet. Once compromised, a public web server might be used as a base for further attack on private resources, unless additional layers of protection are implemented. Public web servers must be located in a DoD DMZ Extension, if hosted on the NIPRNet, with carefully controlled access. Failure to isolate resources in this way increase risk that private assets are exposed to attacks from public sources.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2243",
+      "title": "A private web server must be located on a separate controlled access subnet.",
+      "description": "Private web servers, which host sites serving controlled access data, must be protected from outside threats in addition to insider threats. Insider threat may be accidental or intentional but, in either case, can cause a disruption in service of the web server. To protect the private web server from these threats, it must be located on a separate controlled access subnet and must not be a part of the public DMZ that houses the public web servers. It also cannot be located inside the enclave as part of the local general population LAN.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2246",
+      "title": "The web server must use a vendor-supported version of the web server software.",
+      "description": "The web server Software, IIS 6, is no longer supported by Microsoft for security updates and is not evaluated or updated for vulnerabilities, leaving it open to potential attack. Organizations must transition to a supported IIS release to ensure continued support.",
+      "severity": "high"
+    },
+    {
+      "id": "V-2247",
+      "title": "Non-administrators must not be allowed access to the directory tree, the shell, or other operating system functions and utilities.",
+      "description": "As a rule, accounts on a web server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the web server. This is in addition to the anonymous web user account. The resources to which these accounts have access must also be closely monitored and controlled. Only the SA needs access to all the system’s capabilities, while the web administrator and associated staff require access and control of the web content and web server configuration files. The anonymous web user account must not have access to system resources as that account could then control the server.",
+      "severity": "high"
+    },
+    {
+      "id": "V-2248",
+      "title": "Access to web administration tools must be restricted to the Web Manager and the Web Manager’s designees.",
+      "description": "The key web service administrative and configuration tools must only be accessible by the web server staff. All users granted this authority will be documented and approved by the ISSO. Access to the IIS Manager will be limited to authorized users and administrators.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2251",
+      "title": "Programs and features not necessary for operations must be removed.",
+      "description": "Just as running unneeded services and protocols increase the attack surface of the web server, running unneeded utilities and programs is also an added risk to the web server.",
+      "severity": "low"
+    },
+    {
+      "id": "V-2257",
+      "title": "Administrative users and groups with access privilege to the web server must be documented.",
+      "description": "There are typically several individuals and groups involved in running a production web site. In most cases, several types of users on a web server can be identified such as SA's, Web Managers, Auditors, Authors, Developers, and the Clients. Nonetheless, only necessary user and administrative accounts will be allowed on the web server. Accounts will be restricted to those who are necessary to maintain web services, review the server’s operation and the OS. Owing to the sensitivity of web servers, a detailed record of these accounts must be maintained.",
+      "severity": "low"
+    },
+    {
+      "id": "V-2259",
+      "title": "Web server system files must conform to minimum file permission requirements.",
+      "description": "This check verifies the key web server system configuration files are owned by the SA or Web Manager controlled account. These same files which control the configuration of the web server, and thus its behavior, must also be accessible by the account which runs the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2261",
+      "title": "A public web server must limit e-mail to outbound only.",
+      "description": "Incoming e-mails have been known to provide hackers with access to servers. Disabling the incoming mail service prevents this type of attacks. Additionally, e-mail is a specialized application requiring the dedication of server resources. A production web server should only provide hosting services for web sites. Supporting mail services on a web server opens the server to the risk of abuse as an e-mail relay.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2264",
+      "title": "Wscript.exe and Cscript.exe must not be accessible by users other than the SA and Web Manager.",
+      "description": "Windows Scripting Host (WSH) is installed under either a Typical or Custom installation option of a Microsoft Network Server. This technology permits the execution of powerful script files from the Windows NT command line. This technology is also classified as a Category I Mobile Code. If the access to these files is not tightly controlled, a malicious user could readily compromise the server by using a form to send input to these scripting engines. This is a web-related vulnerability that could exist on any NT / Win 2000 system regardless of the web server software being used on the platform.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2271",
+      "title": "Monitoring software must include CGI type files or equivalent programs.",
+      "description": "By their very nature, CGI type files permit the anonymous web user to interact with data and perhaps store data on the web server. In many cases, CGI scripts exercise system-level control over the server’s resources. These files make appealing targets for the malicious user. If these files can be modified or exploited, the web server can be compromised. CGI or equivalent files must be monitored by a security tool alerting the Web Admin of any unauthorized changes.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-6485",
+      "title": "Web server content and configuration files must be part of a routine backup program.",
+      "description": "Backing up web server data and web server application software after upgrades or maintenance ensures that recovery can be accomplished up to the current version. It also provides a means to determine and recover from subsequent unauthorized changes to the software and data.\n\nA tested and verifiable backup strategy will be implemented for web server software as well as all web server data files. Backup and recovery procedures will be documented and the Web Manager or SA for the specific application will be responsible for the design, test, and implementation of the procedures.\n      \nThe site will have a contingency processing plan/disaster recovery plan that includes web servers. The contingency plan will be periodically tested in accordance with DoDI 8500.2 requirements.\n\nThe site will identify an off-site storage facility in accordance with DoDI 8500.2 requirements. Off-site backups will be updated on a regular basis and the frequency will be documented in the contingency plan.\n",
+      "severity": "low"
+    },
+    {
+      "id": "V-6537",
+      "title": "Anonymous access accounts must be restricted.",
+      "description": "Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data that are stored on the web server need to be evaluated and a determination made concerning authorized access to information and programs on the server. In most cases, we can identify several types of users on a web server. These are system SAs, web administrators, auditors, authors, developers, and clients (web users, either anonymous or authenticated). Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.",
+      "severity": "high"
+    },
+    {
+      "id": "V-6577",
+      "title": "A web server must not be co-hosted with other services",
+      "description": "A detailed web server installation and configuration plan should be followed to provide standardization during the installation process. The installation and configuration plan should not support the co-hosting of multiple services such as Domain Name Service (DNS), e-mail, databases, search engines, indexing, or streaming media on the same server providing the web publishing service.\n\nDisallowed or restricted services in the context of this vulnerability apply to services not directly associated with the delivery of web content. An operating system that supports a web server will not provide other services (e.g., domain controller, e-mail server, database server, etc.). Only those services necessary to support the web server and its hosted sites are specifically allowed and may include, but are not limited to, operating system, logging, anti-virus, host intrusion detection, administrative maintenance, or network requirements. Any unnecessary services or protocols should be removed.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-6724",
+      "title": "Web server and/or operating system information must be protected.",
+      "description": "The web server response header of an HTTP response can contain several fields of information including the requested HTML page. The information included in this response can be web server type and version, operating system and version, and ports associated with the web server. This provides the malicious user valuable information without the use of extensive tools.",
+      "severity": "low"
+    },
+    {
+      "id": "V-6754",
+      "title": "The IIS Internet Printing Protocol must be disabled.",
+      "description": "The use of Internet Printing Protocol (IPP) on an IIS web server allows client’s access to shared printers. This privileged access could allow remote code execution by increasing the web servers attack surface. Additionally, IPP does not support SSL adding to its risk posture.",
+      "severity": "medium"
+    }
+  ]
+}