The IDPS must provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-278979 | SRG-NET-000775-IDPS-00170 | SV-278979r1137725_rule | CCI-004982 | medium |
| Description | ||||
| Encrypted traffic, asymmetric routing architectures, capacity and latency limitations, and transitioning from older to newer technologies (e.g., IPv4 to IPv6 network protocol transition) may result in blind spots for organizations when analyzing network traffic. Collecting, decrypting, pre-processing, and distributing only relevant traffic to monitoring devices can streamline the efficiency and use of devices and optimize traffic analysis. This requirement also applies to Zero Trust initiatives. | ||||
| STIG | Date | |||
| Intrusion Detection and Prevention Systems Security Requirements Guide | 2025-09-22 | |||
Details
Check Text (C-278979r1137725_chk)
Verify the IDPS is configured to provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.
If the IDPS does not provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices, this is a finding.
Fix Text (F-83432r1137724_fix)
Configure the IDPS to provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.