Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-34763 | SRG-NET-000250-IDPS-00177 | SV-45687r1_rule | Medium |
Description |
---|
One of the top concerns of any IDPS solution is false positives. Incorrectly identifying valid access and traffic as an attack can result in constant network traffic disruptions, inappropriately dropped packets, or unnecessary administrator alerts. Critical business activities can be delayed and additional IT resources needed to investigate and determine the nature of the false positives. Mechanisms which examine the traffic in context (stateful) or look for application and usage patterns are used by IDPS solutions to minimize false positives. |
STIG | Date |
---|---|
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide | 2012-11-19 |
Check Text ( C-43053r1_chk ) |
---|
Review the rules implemented on the IDPS to verify the system is configured to address the false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system. If the IDPS is not configured to address false positives during malicious code detection and eradication and the resulting impact on the availability of the system, this is a finding. |
Fix Text (F-39085r1_fix) |
---|
Configure the IDPS to address the receipt of false positives during malicious code detection and eradication processes. |