Riverbed Optimization System (RiOS) must not have unnecessary services and functions enabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-62827	RICX-AG-000087	SV-77317r1_rule		Medium

Description
Unrelated or unneeded proxy services increase the attack vector and add excessive complexity to the securing of Riverbed Optimization System (RiOS) version 8.x.x. Multiple application proxies can be installed on many ALGs. However, proxy types must be limited to related functions. At a minimum, the web and email gateway represent different security domains/trust levels. Organizations should also consider separation of gateways that service the DMZ and the trusted network.

Description

Unrelated or unneeded proxy services increase the attack vector and add excessive complexity to the securing of Riverbed Optimization System (RiOS) version 8.x.x. Multiple application proxies can be installed on many ALGs. However, proxy types must be limited to related functions. At a minimum, the web and email gateway represent different security domains/trust levels. Organizations should also consider separation of gateways that service the DMZ and the trusted network.

STIG	Date
Riverbed SteelHead CX v8 ALG Security Technical Implementation Guide	2015-11-30

Details

Check Text ( C-63621r1_chk )
Verify that the Riverbed Optimization System (RiOS) is configured to disable unrelated or unneeded application proxy services. Obtain documentation for which applications are approved/disapproved for optimization by the organization. Navigate to the device Management Console Navigate to Optimize >> Optimization Verify that the approved or disapproved applications are enabled or disabled according to organization requirements. If optimization features are not enabled or disabled according to the organizations requirements, this is a finding.

Check Text ( C-63621r1_chk )

Verify that the Riverbed Optimization System (RiOS) is configured to disable unrelated or unneeded application proxy services.

Obtain documentation for which applications are approved/disapproved for optimization by the organization.

Navigate to the device Management Console
Navigate to Optimize >> Optimization

Verify that the approved or disapproved applications are enabled or disabled according to organization requirements.

If optimization features are not enabled or disabled according to the organizations requirements, this is a finding.

Fix Text (F-68745r2_fix)
Check to see if services other than the authorized services are enabled for optimization. Obtain documentation for which applications are approved/disapproved for optimization by the organization. Navigate to the device Management Console Navigate to Optimize >> Optimization Set the approved or disapproved applications to enabled or disabled according to organization requirements.