DISA_F5_BIG-IP_ASM_v2r1.audit from DISA F5 BIG-IP Application Security Manager v2r1 STIG

F5BI-AS-000031 - The BIG-IP ASM module supporting intermediary services for remote access communications traffic must ensure inbound traffic is monitored for compliance with remote access security policies.

CAT|II

CCI|CCI-000067

Rule-ID|SV-214504r395904_rule

STIG-ID|F5BI-AS-000031

STIG-Legacy|SV-74497

STIG-Legacy|V-60067

Vuln-ID|V-214504

F5BI-AS-000039 - The BIG-IP ASM module must be configured to produce ASM Event Logs containing information to establish what type of unauthorized events occurred.

CCI|CCI-000130

Rule-ID|SV-214505r395919_rule

STIG-ID|F5BI-AS-000039

STIG-Legacy|SV-74499

STIG-Legacy|V-60069

Vuln-ID|V-214505

F5BI-AS-000109 - The BIG-IP ASM module must be configured to update malicious code protection mechanisms and signature definitions when providing content filtering to virtual servers for whenever new releases are available in accordance with organizational configuration management policy and procedures.

CCI|CCI-001240

Rule-ID|SV-214506r396024_rule

STIG-ID|F5BI-AS-000109

STIG-Legacy|SV-74501

STIG-Legacy|V-60071

Vuln-ID|V-214506

F5BI-AS-000119 - The BIG-IP ASM module must be configured to automatically update malicious code protection mechanisms when providing content filtering to virtual servers.

CCI|CCI-001247

Rule-ID|SV-214507r396039_rule

STIG-ID|F5BI-AS-000119

STIG-Legacy|SV-74503

STIG-Legacy|V-60073

Vuln-ID|V-214507

F5BI-AS-000157 - To protect against data mining, the BIG-IP ASM module must be configured to prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields when providing content filtering to virtual servers.

CCI|CCI-002346

Rule-ID|SV-214508r831452_rule

STIG-ID|F5BI-AS-000157

STIG-Legacy|SV-74505

STIG-Legacy|V-60075

Vuln-ID|V-214508

F5BI-AS-000159 - To protect against data mining, the BIG-IP ASM module must be configured to prevent code injection attacks launched against application objects, including, at a minimum, application URLs and application code when providing content filtering to virtual servers.

Rule-ID|SV-214509r831453_rule

STIG-ID|F5BI-AS-000159

STIG-Legacy|SV-74507

STIG-Legacy|V-60077

Vuln-ID|V-214509

F5BI-AS-000161 - To protect against data mining, The BIG-IP ASM module must be configured to prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields when providing content filtering to virtual servers.

Rule-ID|SV-214510r831454_rule

STIG-ID|F5BI-AS-000161

STIG-Legacy|SV-74509

STIG-Legacy|V-60079

Vuln-ID|V-214510

F5BI-AS-000163 - To protect against data mining, The BIG-IP ASM module must be configured to detect code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields when providing content filtering to virtual servers.

CCI|CCI-002347

Rule-ID|SV-214511r831455_rule

STIG-ID|F5BI-AS-000163

STIG-Legacy|SV-74511

STIG-Legacy|V-60081

Vuln-ID|V-214511

F5BI-AS-000165 - To protect against data mining, The BIG-IP ASM module must be configured to detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields when providing content filtering to virtual servers.

Rule-ID|SV-214512r831456_rule

STIG-ID|F5BI-AS-000165

STIG-Legacy|SV-74513

STIG-Legacy|V-60083

Vuln-ID|V-214512

F5BI-AS-000167 - The BIG-IP ASM module must be configured to detect code injection attacks launched against application objects including, at a minimum, application URLs and application code, when providing content filtering to virtual servers.

Rule-ID|SV-214513r831457_rule

STIG-ID|F5BI-AS-000167

STIG-Legacy|SV-74515

STIG-Legacy|V-60085

Vuln-ID|V-214513

F5BI-AS-000229 - The BIG-IP ASM module must be configured to handle invalid inputs in a predictable and documented manner that reflects organizational and system objectives.

CCI|CCI-002754

Rule-ID|SV-214514r831458_rule

STIG-ID|F5BI-AS-000229

STIG-Legacy|SV-74517

STIG-Legacy|V-60087

Vuln-ID|V-214514

F5BI-AS-000239 - The BIG-IP ASM module must continuously monitor inbound communications traffic crossing internal security boundaries for unusual or unauthorized activities or conditions.

CCI|CCI-002661

Rule-ID|SV-214515r831459_rule

STIG-ID|F5BI-AS-000239

STIG-Legacy|SV-74519

STIG-Legacy|V-60089

Vuln-ID|V-214515

F5BI-AS-000261 - The BIG-IP ASM module must check the validity of all data inputs except those specifically identified by the organization.

Detections

Analytics

DISA F5 BIG-IP Application Security Manager STIG v2r1

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous