kriterion 0.0.1

data/standards/stig_mcafee_move_agentless_3.03.6.1_security_virtual_appliance.json

@@ -0,0 +1,167 @@
+{
+  "name": "stig_mcafee_move_agentless_3.03.6.1_security_virtual_appliance",
+  "date": "2016-04-05",
+  "description": "The McAfee MOVE 3.0/3.6.1 Agentless SVA STIG is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the NIST 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.",
+  "title": "McAfee MOVE Agentless 3.0/3.6.1 Security Virtual Appliance STIG",
+  "version": "1",
+  "item_syntax": "^\\w-\\d+$",
+  "section_separator": null,
+  "items": [
+    {
+      "id": "V-43788",
+      "title": "The Virtual Machine must have VMware vShield Endpoint thin client installed and shown as protected in the vShield Manager.",
+      "description": "The vShield Manager is the centralized network management component of vShield, and is installed as a virtual appliance on an ESX host in a vCenter Server environment. The vShield Manager user interface or vSphere Client plug-in is used by administrators to install, configure, and maintain vShield components. \n\nvShield Endpoint offloads antivirus and anti-malware agent processing to a dedicated secure virtual appliance delivered by VMware partners. Since the secure virtual appliance (unlike a guest virtual machine) does not go offline, it can continuously update antivirus signatures thereby giving uninterrupted protection to the virtual machines on the host. Also, new virtual machines (or existing virtual machines that went offline) are immediately protected with the most current antivirus signatures when they come online. vShield Endpoint installs as a hypervisor module and security virtual appliance from a third-party antivirus\nvendor (VMware partners) on an ESX host. The hypervisor scans guest virtual machines from the outside, removing the need for agents in every virtual machine. This makes vShield Endpoint efficient in avoiding\nresource bottlenecks while optimizing memory use.\n\nMcAfee MOVE AV Agentless requires vShield Endpoint to be installed on a virtual machine in order for the McAfee MOVE Security Virtual Appliance to protect it. If the virtual machine did not have vShield Endpoint installed, the virtual machine would not be protected from malware and viruses.",
+      "severity": "high"
+    },
+    {
+      "id": "V-43957",
+      "title": "The McAfee MOVE AV Agentless SVA policy must be configured with, and managed by, the HBSS ePO server.",
+      "description": "Organizations should use centrally managed antivirus software that is controlled and monitored regularly by antivirus administrators, who are also typically responsible for acquiring, testing, approving, and delivering antivirus signature and software updates throughout the organization. Users should not be able to disable or delete antivirus software from their hosts, nor should they be able to alter critical settings. Antivirus administrators should perform continuous monitoring to confirm that hosts are using current antivirus software and that the software is configured properly. Implementing all of these recommendations should strongly support an organization in having a strong and consistent antivirus deployment across the organization.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-43958",
+      "title": "The McAfee MOVE AV Agentless SVA Authentication policy must be configured to communicate with the Hypervisor/vCenter server via HTTPS protocol.",
+      "description": "Requiring the McAfee MOVE AV Agentless SVA to authenticate to the hypervisor over HTTPs ensures the authentication is over a secure path.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-43959",
+      "title": "The McAfee MOVE AV Agentless SVA Authentication policy must be configured to authenticate to the Hypervisor/vCenter server with user name and password.",
+      "description": "Requiring the McAfee MOVE AV Agentless SVA to authenticate to the hypervisor with a username and password, coupled with HTTPs, ensures authentication is over a secure path from a valid source.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-43960",
+      "title": "The McAfee MOVE AV Agentless SVA Scan Settings policy must be configured with the SVA cache enabled.\n",
+      "description": "Enabling cache in the McAfee MOVE AV Agentless SVA will enable a more effective performance when scanning virtual machines. ",
+      "severity": "medium"
+    },
+    {
+      "id": "V-43961",
+      "title": "The McAfee MOVE AV Agentless SVA Scan Settings policy must be configured to cache scan results for files up to a file size of 1 MB.",
+      "description": "While enabling cache in the McAfee MOVE AV Agentless SVA will enable a more effective performance when scanning virtual machines, the file size of cached items needs to be restricted in order to prevent excessively large files from being cached, which would have a negative impact on performance.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-43962",
+      "title": "The McAfee MOVE AV Agentless SVA Scan Settings policy for On-Demand Client Scan time interval must be set to no more than every 7 days.",
+      "description": "Antivirus software is the most commonly used technical control for malware threat mitigation. Antivirus software on hosts should be configured to scan all hard drives regularly to identify any file system infections and to scan any removable media, if applicable, before media is inserted into the system. Not scheduling a regular scan of the hard drives of a system and/or not configuring the scan to scan all files and running processes, introduces a higher risk of threats going undetected.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-44931",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to enable On-Access scanning.",
+      "description": "Antivirus software is the most commonly used technical control for malware threat mitigation. Antivirus software should be configured to perform real-time scans of each file as it is downloaded, opened, or executed.",
+      "severity": "high"
+    },
+    {
+      "id": "V-44933",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to enforce a maximum On-Access Scan timeout of no less than 45 seconds.",
+      "description": "This setting configures the amount of time to wait for a scan to complete, in seconds. The default setting is 45 seconds. Typically, file scans are very fast. However, file scans may take longer time due to large file size, file type, or heavy load on the offload scan server. In such cases that the file scan takes longer than the scan timeout limit, the file access is allowed and a scan timeout event is generated. Setting the timeout too low may result in scans of a file terminating before the scan is completed, resulting in malware potentially going undetected.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-44935",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to enable On-Demand scanning.",
+      "description": "Antivirus software is the mostly commonly used technical control for malware threat mitigation. Antivirus software on hosts should be configured to scan all hard drives and folders regularly to identify any file system infections and to scan any removable media, if applicable, before media is inserted into the system. Not scheduling a regular scan of the hard drives of a system and/or not configuring the scan to scan all files and running processes, introduces a higher risk of threats going undetected.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-44969",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to scan files when opened.",
+      "description": "Antivirus software is the most commonly used technical control for malware threat mitigation. Real-time scanning of files as they are read from disk is a crucial first line of defense from malware attacks.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-44973",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to scan all file types.",
+      "description": "When scanning for malware, excluding specific file types will increase the risk of a malware-infected file going undetected. By configuring antivirus software to scan all file types, the scanner has a higher success rate at detecting and eradicating malware.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-44979",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to scan files when closed.",
+      "description": "Antivirus software is the most commonly used technical control for malware threat mitigation. Real-time scanning of files as they are written to disk is a crucial first line of defense from malware attacks.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-44993",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to scan inside archives.",
+      "description": "Malware is often packaged within an archive. In addition, archives might have other archives within. Not scanning archive files introduces the risk of infected files being introduced into the environment. ",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48853",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to decode MIME encoded files.",
+      "description": "Multipurpose Internet Mail Extensions (MIME) encoded files can be crafted to hide a malicious payload. When the MIME encoded file is presented to software that decodes the MIME encoded files, such as an email client, the malware is released. Scanning these files as part of the regularly scheduled scans tasks will mitigate this risk.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48855",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to find unknown macro threats.",
+      "description": "Due to the ability of malware to mutate after infection, standard antivirus signatures may not be able to catch new strains or variants of the malware. Typically, these strains and variants will share unique characteristics with others in their virus family. By using a generic signature to detect the shared characteristics, using wildcards where differences lie, the generic signature can detect viruses even if they are padded with extra, meaningless code. This method of detection is Heuristic detection.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48857",
+      "title": "The McAfee MOVE AV Agentless Scan policy for Heuristics must be configured to find unknown unwanted programs and Trojans.",
+      "description": "Due to the ability of malware to mutate after infection, standard antivirus signatures may not be able to catch new strains or variants of the malware. Typically, these strains and variants will share unique characteristics with others in their virus family. By using a generic signature to detect the shared characteristics, using wildcards where differences lie, the generic signature can detect viruses even if they are padded with extra, meaningless code. This method of detection is Heuristic detection.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48859",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to use McAfee Global Threat Intelligence file reputation set to a sensitivity level of Medium or higher.",
+      "description": "Antivirus software vendors use collective intelligence from sensors and cross-vector intelligence from web, email, and network threats to compile scores that reflect the likelihood of whether a file in question is malware. The collective intelligence is constantly being updated, more frequently than the typical daily antivirus signature files. With File Reputation lookup, a more real-time response to potential malicious code is realized than with the local-running antivirus software, since by querying the cloud-based database when a file appears to be suspicious, up-to-the-minute intelligence is provided. This type of protection reduces the threat protection time period from days to milliseconds, increases malware detection rates, and reduces downtime and remediation costs associated with malware attacks. Using File Reputation lookup is mandated by US CYBERCOM on DoD systems.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48861",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to detect unwanted programs.",
+      "description": "Due to the ability of malware to mutate after infection, standard antivirus signatures may not be able to catch new strains or variants of the malware. Typically, these strains and variants will share unique characteristics with others in their virus family. By using a generic signature to detect the shared characteristics, using wildcards where differences lie, the generic signature can detect viruses even if they are padded with extra, meaningless code. This method of detection is Heuristic detection.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48863",
+      "title": "For any path or file exclusions configured in the McAfee MOVE AV Agentless Scan policy, those exclusions must be formally documented by the System Administrator and approved by the IAO/IAM.",
+      "description": "When scanning for malware, excluding specific file types will increase the risk of a malware-infected file going undetected. By configuring antivirus software to scan all file types, the scanner has a higher success rate at detecting and eradicating malware. The excluding of files, paths, and processes from being scanned expands the potential for malware to be allowed onto the information system. While it is recognized that some file types might need to be excluded for operational reasons and/or because there is protection afforded to those files through a different mechanism, allowing those exclusions should always be vetted, documented and approved before applying.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48865",
+      "title": "When a threat is found by the McAfee MOVE AV Agentless On-Access Scan, the Scan policy must be configured to delete files automatically as first action.",
+      "description": "Malware incident containment has two major components: stopping the spread of malware and preventing further damage to hosts. Disinfecting a file is generally preferable to quarantining it because the malware is removed and the original file restored; however, many infected files cannot be disinfected. The primary goal of eradication is to remove malware from infected hosts.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48867",
+      "title": "When a threat is found by the McAfee MOVE AV Agentless On-Access Scan, the Scan policy must be configured to deny access to files if first action fails.",
+      "description": "Malware incident containment has two major components:  stopping the spread of malware and preventing further damage to hosts. Disinfecting a file is generally preferable to quarantining it because the malware is removed and the original file restored; however, many infected files cannot be disinfected. The primary goal of eradication is to remove malware from infected hosts.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48869",
+      "title": "When a threat is found by the McAfee MOVE AV Agentless On-Demand Scan, the Scan policy must be configured to delete files automatically as first action.",
+      "description": "Malware incident containment has two major components: stopping the spread of malware and preventing further damage to hosts. Disinfecting a file is generally preferable to quarantining it because the malware is removed and the original file restored; however, many infected files cannot be disinfected. The primary goal of eradication is to remove malware from infected hosts.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48871",
+      "title": "When a threat is found by the McAfee MOVE AV Agentless On-Demand Scan, the Scan policy must be configured to notify only if first action fails.",
+      "description": "Malware incident containment has two major components:  stopping the spread of malware and preventing further damage to hosts. Disinfecting a file is generally preferable to quarantining it because the malware is removed and the original file restored; however, many infected files cannot be disinfected. The primary goal of eradication is to remove malware from infected hosts.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48873",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to enable the quarantine.",
+      "description": "Malware incident containment has two major components: stopping the spread of malware and preventing further damage to hosts. Disinfecting a file is generally preferable to quarantining it because the malware is removed and the original file restored; however, many infected files cannot be disinfected. Accordingly, antivirus software should be configured to attempt to disinfect infected files and to either quarantine or delete files that cannot be disinfected. By enabling the Quarantine, organizations will have the ability to submit copies of unknown malware to their security software vendors for analysis and will able to conduct internal forensic evaluation.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49679",
+      "title": "The McAfee MOVE AV Agentless SVAadmin account password must be changed from the default.",
+      "description": "The pre-configured Security Virtual Appliance (SVA)  comes with a default password for the SVAadmin account. This account has root privileges to the Linux O/S of the appliance. By not changing the password from the default, the appliance will be subject to access by unauthorized individuals.\n",
+      "severity": "high"
+    }
+  ]
+}

data/standards/stig_mcafee_move_agentless_3.0_security_virtual_appliance.json

@@ -0,0 +1,167 @@
+{
+  "name": "stig_mcafee_move_agentless_3.0_security_virtual_appliance",
+  "date": "2015-10-06",
+  "description": "The McAfee MOVE 3.0 Agentless SVA STIG is published The McAfee MOVE 2.6 Multi-Platform Client STIG is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the NIST 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\n",
+  "title": "McAfee MOVE Agentless 3.0 Security Virtual Appliance STIG",
+  "version": "1",
+  "item_syntax": "^\\w-\\d+$",
+  "section_separator": null,
+  "items": [
+    {
+      "id": "V-43788",
+      "title": "The Virtual Machine must have VMware vShield Endpoint thin client installed and shown as protected in the vShield Manager.",
+      "description": "The vShield Manager is the centralized network management component of vShield, and is installed as a virtual appliance on an ESX host in a vCenter Server environment. The vShield Manager user interface or vSphere Client plug-in is used by administrators to install, configure, and maintain vShield components. \n\nvShield Endpoint offloads antivirus and anti-malware agent processing to a dedicated secure virtual appliance delivered by VMware partners. Since the secure virtual appliance (unlike a guest virtual machine) does not go offline, it can continuously update antivirus signatures thereby giving uninterrupted protection to the virtual machines on the host. Also, new virtual machines (or existing virtual machines that went offline) are immediately protected with the most current antivirus signatures when they come online. vShield Endpoint installs as a hypervisor module and security virtual appliance from a third-party antivirus\nvendor (VMware partners) on an ESX host. The hypervisor scans guest virtual machines from the outside, removing the need for agents in every virtual machine. This makes vShield Endpoint efficient in avoiding\nresource bottlenecks while optimizing memory use.\n\nMcAfee MOVE AV Agentless requires vShield Endpoint to be installed on a virtual machine in order for the McAfee MOVE Security Virtual Appliance to protect it. If the virtual machine did not have vShield Endpoint installed, the virtual machine would not be protected from malware and viruses.",
+      "severity": "high"
+    },
+    {
+      "id": "V-43957",
+      "title": "The McAfee MOVE AV Agentless SVA policy must be configured with, and managed by, the HBSS ePO server.",
+      "description": "Organizations should use centrally managed antivirus software that is controlled and monitored regularly by antivirus administrators, who are also typically responsible for acquiring, testing, approving, and delivering antivirus signature and software updates throughout the organization. Users should not be able to disable or delete antivirus software from their hosts, nor should they be able to alter critical settings. Antivirus administrators should perform continuous monitoring to confirm that hosts are using current antivirus software and that the software is configured properly. Implementing all of these recommendations should strongly support an organization in having a strong and consistent antivirus deployment across the organization.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-43958",
+      "title": "The McAfee MOVE AV Agentless SVA Authentication policy must be configured to communicate with the Hypervisor/vCenter server via HTTPS protocol.",
+      "description": "Requiring the McAfee MOVE AV Agentless SVA to authenticate to the hypervisor over HTTPs ensures the authentication is over a secure path.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-43959",
+      "title": "The McAfee MOVE AV Agentless SVA Authentication policy must be configured to authenticate to the Hypervisor/vCenter server with user name and password.",
+      "description": "Requiring the McAfee MOVE AV Agentless SVA to authenticate to the hypervisor with a username and password, coupled with HTTPs, ensures authentication is over a secure path from a valid source.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-43960",
+      "title": "The McAfee MOVE AV Agentless SVA Scan Settings policy must be configured with the SVA cache enabled.\n",
+      "description": "Enabling cache in the McAfee MOVE AV Agentless SVA will enable a more effective performance when scanning virtual machines. ",
+      "severity": "medium"
+    },
+    {
+      "id": "V-43961",
+      "title": "The McAfee MOVE AV Agentless SVA Scan Settings policy must be configured to cache scan results for files up to a file size of 1 MB.",
+      "description": "While enabling cache in the McAfee MOVE AV Agentless SVA will enable a more effective performance when scanning virtual machines, the file size of cached items needs to be restricted in order to prevent excessively large files from being cached, which would have a negative impact on performance.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-43962",
+      "title": "The McAfee MOVE AV Agentless SVA Scan Settings policy for On-Demand Client Scan time interval must be set to no more than every 7 days.",
+      "description": "Antivirus software is the most commonly used technical control for malware threat mitigation. Antivirus software on hosts should be configured to scan all hard drives regularly to identify any file system infections and to scan any removable media, if applicable, before media is inserted into the system. Not scheduling a regular scan of the hard drives of a system and/or not configuring the scan to scan all files and running processes, introduces a higher risk of threats going undetected.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-44931",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to enable On-Access scanning.",
+      "description": "Antivirus software is the most commonly used technical control for malware threat mitigation. Antivirus software should be configured to perform real-time scans of each file as it is downloaded, opened, or executed.",
+      "severity": "high"
+    },
+    {
+      "id": "V-44933",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to enforce a maximum On-Access Scan timeout of no less than 45 seconds.",
+      "description": "This setting configures the amount of time to wait for a scan to complete, in seconds. The default setting is 45 seconds. Typically, file scans are very fast. However, file scans may take longer time due to large file size, file type, or heavy load on the offload scan server. In such cases that the file scan takes longer than the scan timeout limit, the file access is allowed and a scan timeout event is generated. Setting the timeout too low may result in scans of a file terminating before the scan is completed, resulting in malware potentially going undetected.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-44935",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to enable On-Demand scanning.",
+      "description": "Antivirus software is the mostly commonly used technical control for malware threat mitigation. Antivirus software on hosts should be configured to scan all hard drives and folders regularly to identify any file system infections and to scan any removable media, if applicable, before media is inserted into the system. Not scheduling a regular scan of the hard drives of a system and/or not configuring the scan to scan all files and running processes, introduces a higher risk of threats going undetected.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-44969",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to scan files when opened.",
+      "description": "Antivirus software is the most commonly used technical control for malware threat mitigation. Real-time scanning of files as they are read from disk is a crucial first line of defense from malware attacks.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-44973",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to scan all file types.",
+      "description": "When scanning for malware, excluding specific file types will increase the risk of a malware-infected file going undetected. By configuring antivirus software to scan all file types, the scanner has a higher success rate at detecting and eradicating malware.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-44979",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to scan files when closed.",
+      "description": "Antivirus software is the most commonly used technical control for malware threat mitigation. Real-time scanning of files as they are written to disk is a crucial first line of defense from malware attacks.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-44993",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to scan inside archives.",
+      "description": "Malware is often packaged within an archive. In addition, archives might have other archives within. Not scanning archive files introduces the risk of infected files being introduced into the environment. ",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48853",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to decode MIME encoded files.",
+      "description": "Multipurpose Internet Mail Extensions (MIME) encoded files can be crafted to hide a malicious payload. When the MIME encoded file is presented to software that decodes the MIME encoded files, such as an email client, the malware is released. Scanning these files as part of the regularly scheduled scans tasks will mitigate this risk.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48855",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to find unknown macro threats.",
+      "description": "Due to the ability of malware to mutate after infection, standard antivirus signatures may not be able to catch new strains or variants of the malware. Typically, these strains and variants will share unique characteristics with others in their virus family. By using a generic signature to detect the shared characteristics, using wildcards where differences lie, the generic signature can detect viruses even if they are padded with extra, meaningless code. This method of detection is Heuristic detection.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48857",
+      "title": "The McAfee MOVE AV Agentless Scan policy for Heuristics must be configured to find unknown unwanted programs and Trojans.",
+      "description": "Due to the ability of malware to mutate after infection, standard antivirus signatures may not be able to catch new strains or variants of the malware. Typically, these strains and variants will share unique characteristics with others in their virus family. By using a generic signature to detect the shared characteristics, using wildcards where differences lie, the generic signature can detect viruses even if they are padded with extra, meaningless code. This method of detection is Heuristic detection.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48859",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to use McAfee Global Threat Intelligence file reputation set to a sensitivity level of Medium or higher.",
+      "description": "Antivirus software vendors use collective intelligence from sensors and cross-vector intelligence from web, email, and network threats to compile scores that reflect the likelihood of whether a file in question is malware. The collective intelligence is constantly being updated, more frequently than the typical daily antivirus signature files. With File Reputation lookup, a more real-time response to potential malicious code is realized than with the local-running antivirus software, since by querying the cloud-based database when a file appears to be suspicious, up-to-the-minute intelligence is provided. This type of protection reduces the threat protection time period from days to milliseconds, increases malware detection rates, and reduces downtime and remediation costs associated with malware attacks. Using File Reputation lookup is mandated by US CYBERCOM on DoD systems.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48861",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to detect unwanted programs.",
+      "description": "Due to the ability of malware to mutate after infection, standard antivirus signatures may not be able to catch new strains or variants of the malware. Typically, these strains and variants will share unique characteristics with others in their virus family. By using a generic signature to detect the shared characteristics, using wildcards where differences lie, the generic signature can detect viruses even if they are padded with extra, meaningless code. This method of detection is Heuristic detection.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48863",
+      "title": "For any path or file exclusions configured in the McAfee MOVE AV Agentless Scan policy, those exclusions must be formally documented by the System Administrator and approved by the IAO/IAM.",
+      "description": "When scanning for malware, excluding specific file types will increase the risk of a malware-infected file going undetected. By configuring antivirus software to scan all file types, the scanner has a higher success rate at detecting and eradicating malware. The excluding of files, paths, and processes from being scanned expands the potential for malware to be allowed onto the information system. While it is recognized that some file types might need to be excluded for operational reasons and/or because there is protection afforded to those files through a different mechanism, allowing those exclusions should always be vetted, documented and approved before applying.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48865",
+      "title": "When a threat is found by the McAfee MOVE AV Agentless On-Access Scan, the Scan policy must be configured to delete files automatically as first action.",
+      "description": "Malware incident containment has two major components: stopping the spread of malware and preventing further damage to hosts. Disinfecting a file is generally preferable to quarantining it because the malware is removed and the original file restored; however, many infected files cannot be disinfected. The primary goal of eradication is to remove malware from infected hosts.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48867",
+      "title": "When a threat is found by the McAfee MOVE AV Agentless On-Access Scan, the Scan policy must be configured to deny access to files if first action fails.",
+      "description": "Malware incident containment has two major components:  stopping the spread of malware and preventing further damage to hosts. Disinfecting a file is generally preferable to quarantining it because the malware is removed and the original file restored; however, many infected files cannot be disinfected. The primary goal of eradication is to remove malware from infected hosts.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48869",
+      "title": "When a threat is found by the McAfee MOVE AV Agentless On-Demand Scan, the Scan policy must be configured to delete files automatically as first action.",
+      "description": "Malware incident containment has two major components: stopping the spread of malware and preventing further damage to hosts. Disinfecting a file is generally preferable to quarantining it because the malware is removed and the original file restored; however, many infected files cannot be disinfected. The primary goal of eradication is to remove malware from infected hosts.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48871",
+      "title": "When a threat is found by the McAfee MOVE AV Agentless On-Demand Scan, the Scan policy must be configured to notify only if first action fails.",
+      "description": "Malware incident containment has two major components:  stopping the spread of malware and preventing further damage to hosts. Disinfecting a file is generally preferable to quarantining it because the malware is removed and the original file restored; however, many infected files cannot be disinfected. The primary goal of eradication is to remove malware from infected hosts.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48873",
+      "title": "The McAfee MOVE AV Agentless Scan policy must be configured to enable the quarantine.",
+      "description": "Malware incident containment has two major components: stopping the spread of malware and preventing further damage to hosts. Disinfecting a file is generally preferable to quarantining it because the malware is removed and the original file restored; however, many infected files cannot be disinfected. Accordingly, antivirus software should be configured to attempt to disinfect infected files and to either quarantine or delete files that cannot be disinfected. By enabling the Quarantine, organizations will have the ability to submit copies of unknown malware to their security software vendors for analysis and will able to conduct internal forensic evaluation.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49679",
+      "title": "The McAfee MOVE AV Agentless SVAadmin account password must be changed from the default.",
+      "description": "The pre-configured Security Virtual Appliance (SVA)  comes with a default password for the SVAadmin account. This account has root privileges to the Linux O/S of the appliance. By not changing the password from the default, the appliance will be subject to access by unauthorized individuals.\n",
+      "severity": "high"
+    }
+  ]
+}

data/standards/stig_mcafee_move_agentless_3.0_vsel_1.9sva.json

@@ -0,0 +1,203 @@
+{
+  "name": "stig_mcafee_move_agentless_3.0_vsel_1.9sva",
+  "date": "2014-05-08",
+  "description": "The McAfee MOVE 3.0 Agentless VSEL for SVA STIG is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the NIST 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.letterkenny.FSO.mbx.stig-customer-support-mailbox@mail.mil.",
+  "title": "McAfee MOVE Agentless 3.0 VSEL 1.9 for SVA STIG",
+  "version": "1",
+  "item_syntax": "^\\w-\\d+$",
+  "section_separator": null,
+  "items": [
+    {
+      "id": "V-43936",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 Web UI must be disabled.",
+      "description": "If the Web UI was left enabled, the system to which the VSEL has been installed would be vulnerable for Web attacks. Disabling the Web UI will prevent the system from listening on HTTP.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48995",
+      "title": "The antivirus signature file age must not exceed 7 days.",
+      "description": "Antivirus signature files are updated almost daily by antivirus software vendors. These files are made available to antivirus clients as they are published. Keeping virus signature files as current as possible is vital to the security of any system. By configuring a system to attempt an antivirus update on a daily basis, the system is ensured of maintaining an antivirus signature age of 7 days or less. If the update attempt were to be configured for only once a week, and that attempt failed, the system would be immediately out of date.",
+      "severity": "high"
+    },
+    {
+      "id": "V-48997",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 must be configured to receive automatic signature updates.",
+      "description": "Antivirus signature files are updated almost daily by antivirus software vendors. These files are made available to antivirus clients as they are published. Keeping virus signature files as current as possible is vital to the security of any system. The antivirus software product must be configured to receive those updates automatically in order to afford the expected protection.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-48999",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 must be configured to enable On-Access scanning.",
+      "description": "For antivirus software to be effective, it must be running at all times, beginning from the point of the system's initial startup. Otherwise, the risk is greater for viruses, Trojans, and other malware infecting the system during that startup phase.",
+      "severity": "high"
+    },
+    {
+      "id": "V-49003",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be configured to decompress archives when scanning.",
+      "description": "Malware is often packaged within an archive. In addition, archives may have other archives within. Not scanning archive files introduces the risk of infected files being introduced into the environment.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49015",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be configured to find unknown program viruses.",
+      "description": "Due to the ability of malware to mutate after infection, standard antivirus signatures may not be able to catch new strains or variants of the malware. Typically, these strains and variants will share unique characteristics with others in their virus family. By using a generic signature to detect the shared characteristics, using wildcards where differences lie, the generic signature can detect viruses even if they are padded with extra, meaningless code. This method of detection is Heuristic detection.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49027",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be configured to find unknown macro viruses.",
+      "description": "Interpreted viruses are executed by an application. Within this subcategory, macro viruses take advantage of the capabilities of applications' macro programming language to infect application documents and document templates, while scripting viruses infect scripts that are understood by scripting languages processed by services on the OS. Many attackers use toolkits containing several different types of utilities and scripts that can be used to probe and attack hosts. Scanning for unknown macro viruses will mitigate zero-day attacks.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49029",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be configured to find potentially unwanted programs.",
+      "description": "Potentially Unwanted Programs (PUPs) include Spyware, Adware, Remote Administration Tools, Dialers, Password Crackers, Jokes, and Key Loggers. While PUPs do not typically have any infection capability on their own, they rely on malware or other attach mechanisms to be installed onto target hosts, after which they will collect and transfer data from the host to an external host and/or will be used as attach mechanisms. Configuring the antivirus software to attempt to clean the file first will allow for the possibility of a false positive. In most cases, however, the secondary action of delete will be used, mitigating the risk of the PUPs being installed and used maliciously.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49031",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be configured to scan files when being written to disk.",
+      "description": "Antivirus software is the most commonly used technical control for malware threat mitigation. Real-time scanning of files as they are written to disk is a crucial first line of defense from malware attacks.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49033",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be configured to scan files when being read from disk.",
+      "description": "Antivirus software is the most commonly used technical control for malware threat mitigation. Real-time scanning of files as they are read from disk is a crucial first line of defense from malware attacks.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49035",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be configured to scan all file types.",
+      "description": "When scanning for malware, excluding specific file types will increase the risk of a malware-infected file going undetected. By configuring antivirus software to scan all file types, the scanner has a higher success rate at detecting and eradicating malware.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49037",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner maximum scan time must not be less than 45 seconds.",
+      "description": "When antivirus software is not configured to limit the amount of time spent trying to scan a file, the total effectiveness of the antivirus software, and performance on the system being scanned, will be degraded. By limiting the amount of time the antivirus software uses when scanning a file, the scan will be able to complete in a timely manner. ",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49039",
+      "title": "Any paths and files excluded by the McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be formally documented with, and approved by, the IAO/IAM.",
+      "description": "When scanning for malware, excluding specific files will increase the risk of a malware-infected file going undetected. By configuring antivirus software without any exclusions, the scanner has a higher success rate at detecting and eradicating malware.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49041",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be configured to Clean infected files automatically as first action when a virus or Trojan is detected.",
+      "description": "Malware may have infected a file that is necessary to the user. By configuring the antivirus software to first attempt cleaning the infected file, availability to the file is not sacrificed. If a cleaning attempt is not successful, however, deleting the file is the only safe option to ensure the malware is not introduced onto the system or network.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49043",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be configured to Move infected files to the quarantine directory if first action fails when a virus or Trojan is detected.",
+      "description": "Malware may have infected a file that is necessary to the user. By configuring the antivirus software to first attempt cleaning the infected file, availability to the file is not sacrificed. If a cleaning attempt is not successful, however, deleting the file is the only safe option to ensure the malware is not introduced onto the system or network.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49047",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be configured to Clean infected files automatically as first action when programs and jokes are found.",
+      "description": "Potentially Unwanted Programs (PUPs) include Spyware, Adware, Remote Administration Tools, Dialers, Password Crackers, Jokes, and Key Loggers. While PUPs do not typically have any infection capability on their own, they rely on malware or other attach mechanisms to be installed onto target hosts, after which they will collect and transfer data from the host to an external host and/or will be used as attach mechanisms. Configuring the antivirus software to attempt to clean the file first will allow for the possibility of a false positive. In most cases, however, the secondary action of delete will be used, mitigating the risk of the PUPs being installed and used maliciously.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49049",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be configured to Move infected files to the quarantine directory if first action fails when programs and jokes are found.",
+      "description": "Potentially Unwanted Programs (PUPs) include Spyware, Adware, Remote Administration Tools, Dialers, Password Crackers, Jokes, and Key Loggers. While PUPs do not typically have any infection capability on their own, they rely on malware or other attach mechanisms to be installed onto target hosts, after which they will collect and transfer data from the host to an external host and/or will be used as attach mechanisms. Configuring the antivirus software to attempt to clean the file first will allow for the possibility of a false positive. In most cases, however, the secondary action of delete will be used, mitigating the risk of the PUPs being installed and used maliciously.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49051",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be configured to deny access to the file if scanning fails.",
+      "description": "Antivirus software is the most commonly used technical control for malware threat mitigation. Real-time scanning of files as they are read from disk is a crucial first line of defense from malware attacks.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49055",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On-Access scanner must be configured to allow access to files if scanning times out.",
+      "description": "Antivirus software is the most commonly used technical control for malware threat mitigation. Real-time scanning of files as they are read from disk is a crucial first line of defense from malware attacks.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49059",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 must be configured to run a scheduled On Demand scan at least once a week.",
+      "description": "Antivirus software is the most commonly used technical control for malware threat mitigation. Real-time scanning of files as they are read from disk is a crucial first line of defense from malware attacks but to ensure all files are frequently scanned, a regularly scheduled full scan will ensure malware missed by the real-time scanning will be detected and mitigated.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49061",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On Demand scanner must be configured to find unknown program viruses.",
+      "description": "Due to the ability of malware to mutate after infection, standard antivirus signatures may not be able to catch new strains or variants of the malware. Typically, these strains and variants will share unique characteristics with others in their virus family. By using a generic signature to detect the shared characteristics, using wildcards where differences lie, the generic signature can detect viruses even if they are padded with extra, meaningless code. This method of detection is Heuristic detection.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49063",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On Demand scanner must be configured to find unknown macro viruses.",
+      "description": "Interpreted viruses are executed by an application. Within this subcategory, macro viruses take advantage of the capabilities of applications' macro programming language to infect application documents and document templates, while scripting viruses infect scripts that are understood by scripting languages processed by services on the OS. Many attackers use toolkits containing several different types of utilities and scripts that can be used to probe and attack hosts. Scanning for unknown macro viruses will mitigate zero-day attacks.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49065",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On Demand scanner must be configured to find potentially unwanted programs.",
+      "description": "Potentially Unwanted Programs (PUPs) include Spyware, Adware, Remote Administration Tools, Dialers, Password Crackers, Jokes, and Key Loggers. While PUPs do not typically have any infection capability on their own, they rely on malware or other attach mechanisms to be installed onto target hosts, after which they will collect and transfer data from the host to an external host and/or will be used as attach mechanisms. Configuring the antivirus software to attempt to clean the file first will allow for the possibility of a false positive. In most cases, however, the secondary action of delete will be used, mitigating the risk of the PUPs being installed and used maliciously.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49067",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On Demand scanner must be configured to scan all file types.",
+      "description": "When scanning for malware, excluding specific file types will increase the risk of a malware-infected file going undetected. By configuring antivirus software to scan all file types, the scanner has a higher success rate at detecting and eradicating malware.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49075",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On Demand scanner must be configured to Clean infected files automatically as first action for when Viruses and Trojans are found.",
+      "description": "Malware may have infected a file that is necessary to the user. By configuring the antivirus software to first attempt cleaning the infected file, availability to the file is not sacrificed. If a cleaning attempt is not successful, however, deleting the file is the only safe option to ensure the malware is not introduced onto the system or network.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49083",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On Demand scanner must be configured to Move infected files to the quarantine directory if first action fails for when Viruses and Trojans are found.",
+      "description": "Malware may have infected a file that is necessary to the user. By configuring the antivirus software to first attempt cleaning the infected file, availability to the file is not sacrificed. If a cleaning attempt is not successful, however, deleting the file is the only safe option to ensure the malware is not introduced onto the system or network.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49089",
+      "title": "Any paths and files excluded by the McAfee VirusScan Enterprise for Linux 1.9.0 On Demand scanner must be documented with, and approved by, the IAO/IAM.",
+      "description": "When scanning for malware, excluding specific files will increase the risk of a malware-infected file going undetected. By configuring antivirus software without any exclusions, the scanner has a higher success rate at detecting and eradicating malware.\n",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49099",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On Demand scanner must be configured to Clean infected files automatically as first action when programs and jokes are found.",
+      "description": "Potentially Unwanted Programs (PUPs) include Spyware, Adware, Remote Administration Tools, Dialers, Password Crackers, Jokes, and Key Loggers. While PUPs do not typically have any infection capability on their own, they rely on malware or other attach mechanisms to be installed onto target hosts, after which they will collect and transfer data from the host to an external host and/or will be used as attach mechanisms. Configuring the antivirus software to attempt to clean the file first will allow for the possibility of a false positive. In most cases, however, the secondary action of delete will be used, mitigating the risk of the PUPs being installed and used maliciously.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49103",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On Demand scanner must be configured to Move infected files to the quarantine directory if first action fails when programs and jokes are found.",
+      "description": "Potentially Unwanted Programs (PUPs) include Spyware, Adware, Remote Administration Tools, Dialers, Password Crackers, Jokes, and Key Loggers. While PUPs do not typically have any infection capability on their own, they rely on malware or other attach mechanisms to be installed onto target hosts, after which they will collect and transfer data from the host to an external host and/or will be used as attach mechanisms. Configuring the antivirus software to attempt to clean the file first will allow for the possibility of a false positive. In most cases, however, the secondary action of delete will be used, mitigating the risk of the PUPs being installed and used maliciously.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49109",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On Demand scanner must be configured to include all local drives and their sub-directories.",
+      "description": "When scanning for malware, excluding specific file types will increase the risk of a malware-infected file going undetected. By configuring antivirus software to scan all file types, the scanner has a higher success rate at detecting and eradicating malware.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49243",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On Demand scanner must be configured to decompress archives when scanning.",
+      "description": "Malware is often packaged within an archive. In addition, archives might have other archives within. Not scanning archive files introduces the risk of infected files being introduced into the environment.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-49245",
+      "title": "The McAfee VirusScan Enterprise for Linux 1.9.0 On Demand scanner must be configured to decode MIME encoded files.",
+      "description": "Malware is often packaged within an archive. In addition, archives might have other archives within. Not scanning archive files introduces the risk of infected files being introduced into the environment.",
+      "severity": "medium"
+    }
+  ]
+}