The BIG-IP Core implementation must be configured to inspect for protocol compliance and protocol anomalies in inbound HTTP and HTTPS traffic to virtual servers.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-60387	F5BI-LT-000307	SV-74817r1_rule		Medium

Description
Application protocol anomaly detection examines application layer protocols such as HTTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols. Since protocol anomaly analysis examines the application payload for patterns or anomalies, an HTTP proxy must be included in the ALG. This ALG will be configured to inspect inbound HTTP and HTTPS communications traffic to detect protocol anomalies such as malformed message and command insertion attacks. Note that if mutual authentication is enabled, there will be no way to inspect HTTPS traffic with MITM.

Description

Application protocol anomaly detection examines application layer protocols such as HTTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols. Since protocol anomaly analysis examines the application payload for patterns or anomalies, an HTTP proxy must be included in the ALG. This ALG will be configured to inspect inbound HTTP and HTTPS communications traffic to detect protocol anomalies such as malformed message and command insertion attacks. Note that if mutual authentication is enabled, there will be no way to inspect HTTPS traffic with MITM.

STIG	Date
F5 BIG-IP Local Traffic Manager 11.x Security Technical Implementation Guide	2015-06-02

Details

Check Text ( C-61309r1_chk )
If the BIG-IP Core does not provide intermediary/proxy services for HTTP and HTTPS communications traffic for virtual servers, this is not applicable. When intermediary/proxy services for HTTP and HTTPS communications traffic are provided, verify the BIG-IP Core is configured as follows: Verify the BIG-IP LTM module is configured to inspect for protocol compliance and protocol anomalies in inbound HTTP and HTTPS communications traffic. Navigate to the BIG-IP System manager >> Security >> Protocol Security >> Security Profiles >> HTTP. Verify there is at least one profile for managing HTTP traffic. Select a Profile from the list to verify. Review each of the following tabs to verify the proper criteria are selected and are set to "Alarm" at a minimum: "HTTP Protocol Checks" "Request Checks" "Blocking Page" If the BIG-IP Core does not inspect inbound HTTP and HTTPS communications traffic for protocol compliance and protocol anomalies, this is a finding.

Check Text ( C-61309r1_chk )

If the BIG-IP Core does not provide intermediary/proxy services for HTTP and HTTPS communications traffic for virtual servers, this is not applicable.

When intermediary/proxy services for HTTP and HTTPS communications traffic are provided, verify the BIG-IP Core is configured as follows:

Verify the BIG-IP LTM module is configured to inspect for protocol compliance and protocol anomalies in inbound HTTP and HTTPS communications traffic.

Navigate to the BIG-IP System manager >> Security >> Protocol Security >> Security Profiles >> HTTP.

Verify there is at least one profile for managing HTTP traffic.

Select a Profile from the list to verify.

Review each of the following tabs to verify the proper criteria are selected and are set to "Alarm" at a minimum:

"HTTP Protocol Checks"
"Request Checks"
"Blocking Page"

If the BIG-IP Core does not inspect inbound HTTP and HTTPS communications traffic for protocol compliance and protocol anomalies, this is a finding.

Fix Text (F-66001r1_fix)
If the BIG-IP Core provides intermediary/proxy services for HTTP and HTTPS communications traffic, configure the BIG-IP Core to inspect inbound HTTP and HTTPS communications traffic for protocol compliance and protocol anomalies.