OpenControls Logo

STIG Viewer

STIGViewer Support

The Nokia router must employ organization-defined controls by type of denial of service (DoS) to achieve the DoS objective.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-283895NOKI-RT-000810SV-283895r1203934_ruleCCI-004866medium
Description
DoS events may occur due to a variety of internal and external causes, such as an attack by an adversary or a lack of planning to support organizational needs with respect to capacity and bandwidth. Such attacks can occur across a wide range of network protocols (e.g., IPv4, IPv6). A variety of technologies are available to limit or eliminate the origination and effects of DoS events. For example, boundary protection devices can filter certain types of packets to protect system components on internal networks from being directly affected by or the source of DoS attacks. Employing increased network capacity and bandwidth combined with service redundancy also reduces the susceptibility to DoS events.
STIGDate
Nokia Service Router OS 25.x Router Security Technical Implementation Guide2026-06-15

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-01Continuous Monitoring
1.00
MON-01.1Intrusion Detection & Prevention Systems (IDS & IPS)
1.00
MON-01.3Inbound & Outbound Communications Traffic
1.00
MON-01.4System Generated Alerts
1.00
MON-01.8Security Event Monitoring
1.00
NET-01Network Security Controls (NSC)
1.00
NET-02Layered Network Defenses
1.00
SEA-01Secure Engineering Principles
1.00
SEA-02Alignment With Enterprise Architecture
1.00
CAP-01Capacity & Performance Management
0.50

+3 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-4Information Flow Enforcement
1.00
CM-7Least Functionality
1.00
SC-5Denial-of-service Protection
1.00
SC-5(1)Restrict Ability to Attack Other Systems
1.00
SC-5(2)Capacity, Bandwidth, and Redundancy
1.00
SC-7Boundary Protection
1.00
SC-7(11)Restrict Incoming Communications Traffic
1.00
CCI1 mapping
CCI-004866
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-01
1.00
PR.IR-01
1.00
PR.IR-04
0.50

Who does this work

12 NICE work roles and 9 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-283895r1203934_chk)

Verify the router is configured to employ organization-defined controls by type of DoS to achieve the DoS objective. Verify CPM IP-Filter using the example below: - show system security cpm-filter ip-filter entry 10 CPM IP Filter Entry Entry Id : 10 Description : (Not Specified) ------------------------------------------------------------------------------- Filter Entry Match Criteria : ------------------------------------------------------------------------------- Log Id : n/a Src. IP : 192.168.1.1/32 Src. Port : n/a Dst. IP : n/a Dest. Port : n/a Protocol : ospf-igp Dscp : Undefined ICMP Type : Undefined ICMP Code : Undefined Fragment : Off Option-present : Off IP-Option : n/a Multiple Option : Off TCP-syn : Off TCP-ack : Off Action : Forward Match Router ID : n/a Dropped pkts : 0 Forwarded pkts : 0 Verify Distributed CPU Protection using the example below: - show system security dist-cpu-protection policy "rate-limit" detail Distributed CPU Protection Policy Policy Name : rate-limit Description : (Not Specified) Policy Type : access-network ------------------------------------------------------------------------------- Static Policer ------------------------------------------------------------------------------- Static Policer : PIM-RATE Description : (Not Specified) Kbps : 2000 kbps MBS : 200 KB Detection Time : 30 seconds Exceed-Action : None Hold-Down Time : none Log Events : enable ------------------------------------------------------------------------------- Static Policer : ICMP-RATE Description : (Not Specified) Kbps : 2000 kbps MBS : 200 KB Detection Time : 30 seconds Exceed-Action : None Hold-Down Time : none Log Events : enable ------------------------------------------------------------------------------- Static Policer : ALL-Other-Rate Description : (Not Specified) Kbps : 2000 kbps MBS : 200 KB Detection Time : 30 seconds Exceed-Action : None Hold-Down Time : none Log Events : enable ------------------------------------------------------------------------------- ------------------------------------------------------------------------------- Local Monitoring Policer ------------------------------------------------------------------------------- No Matching Entries ------------------------------------------------------------------------------- ------------------------------------------------------------------------------- Protocol (Dynamic Policer) ------------------------------------------------------------------------------- Protocol : icmp Enforcement Type : static Enforcement Plcr: ICMP-RATE Dynamic Policer Parameters -------------------------- Packets : max Within : 1 seconds Initial Delay : none Detection Time : 30 seconds Exceed-Action : None Hold-Down Time : none Log Events : enable ------------------------------------------------------------------------------- Protocol : all-unspecified Enforcement Type : static Enforcement Plcr: ALL-Other-Rate Dynamic Policer Parameters -------------------------- Packets : max Within : 1 seconds Initial Delay : none Detection Time : 30 seconds Exceed-Action : None Hold-Down Time : none Log Events : enable ------------------------------------------------------------------------------- Protocol : pim Enforcement Type : static Enforcement Plcr: PIM-RATE Dynamic Policer Parameters -------------------------- Packets : max Within : 1 seconds Initial Delay : none Detection Time : 30 seconds Exceed-Action : None Hold-Down Time : none Log Events : enable ------------------------------------------------------------------------------- If the router is not configured to employ organization-defined controls by type of DoS to achieve the DoS objective, this is a finding.

Fix Text (F-88365r1203933_fix)

Configure the router to employ organization-defined controls by type of DoS to achieve the DoS objective using the example below: Create a CPM-Filter: - configure system security cpm-filter - config>sys>security>cpm-filter# default-action drop - config>sys>security>cpm-filter# ip-filter - config>sys>sec>cpm>ip-filter# - config>sys>sec>cpm>ip-filter# entry 10 create - cfg>sys>sec>cpm>ip-filter>entry# match protocol "ospf-igp" - cfg>sys>sec>cpm>ip-filter>entry>match# src-ip 192.168.1.1/32 - cfg>sys>sec>cpm>ip-filter>entry>match# exit - cfg>sys>sec>cpm>ip-filter>entry# action accept - cfg>sys>sec>cpm>ip-filter>entry# exit - config>sys>sec>cpm>ip-filter# entry 20 create - cfg>sys>sec>cpm>ip-filter>entry# match protocol "pim" - cfg>sys>sec>cpm>ip-filter>entry>match# src-ip 192.168.1.2/32 - cfg>sys>sec>cpm>ip-filter>entry>match# exit - cfg>sys>sec>cpm>ip-filter>entry# action accept - cfg>sys>sec>cpm>ip-filter>entry# exit - config>sys>sec>cpm>ip-filter# entry 30 create - cfg>sys>sec>cpm>ip-filter>entry# match protocol "igmp" - cfg>sys>sec>cpm>ip-filter>entry>match# src-ip 224.0.0.0/4 - cfg>sys>sec>cpm>ip-filter>entry>match# exit - cfg>sys>sec>cpm>ip-filter>entry# action accept - cfg>sys>sec>cpm>ip-filter>entry# exit - config>sys>sec>cpm>ip-filter# entry 40 create - cfg>sys>sec>cpm>ip-filter>entry# match protocol "tcp" - cfg>sys>sec>cpm>ip-filter>entry>match# src-ip 192.168.100.1/32 - cfg>sys>sec>cpm>ip-filter>entry>match# dst-ip 192.168.100.2/32 - cfg>sys>sec>cpm>ip-filter>entry>match# src-port 179 - cfg>sys>sec>cpm>ip-filter>entry>match# exit - cfg>sys>sec>cpm>ip-filter>entry# action accept - cfg>sys>sec>cpm>ip-filter>entry# exit - config>sys>sec>cpm>ip-filter# entry 50 create - cfg>sys>sec>cpm>ip-filter>entry# match protocol "icmp" - cfg>sys>sec>cpm>ip-filter>entry>match# exit - cfg>sys>sec>cpm>ip-filter>entry# action accept - cfg>sys>sec>cpm>ip-filter>entry# exit - config>sys>sec>cpm>ip-filter# entry 60 create - cfg>sys>sec>cpm>ip-filter>entry# match protocol "udp" - cfg>sys>sec>cpm>ip-filter>entry>match# dst-port 161 - cfg>sys>sec>cpm>ip-filter>entry>match# exit - cfg>sys>sec>cpm>ip-filter>entry# action accept - cfg>sys>sec>cpm>ip-filter>entry# exit - config>sys>sec>cpm>ip-filter# entry 70 create - cfg>sys>sec>cpm>ip-filter>entry# match protocol "udp" - cfg>sys>sec>cpm>ip-filter>entry>match# dst-port 162 - cfg>sys>sec>cpm>ip-filter>entry>match# exit - cfg>sys>sec>cpm>ip-filter>entry# action accept - cfg>sys>sec>cpm>ip-filter>entry# exit - config>sys>sec>cpm>ip-filter# entry 80 create - cfg>sys>sec>cpm>ip-filter>entry# match protocol "tcp" - cfg>sys>sec>cpm>ip-filter>entry>match# dst-port 22 - cfg>sys>sec>cpm>ip-filter>entry>match# exit - cfg>sys>sec>cpm>ip-filter>entry# action accept - cfg>sys>sec>cpm>ip-filter>entry# exit - config>sys>sec>cpm>ip-filter# entry 90 create - cfg>sys>sec>cpm>ip-filter>entry# match protocol "tcp" - cfg>sys>sec>cpm>ip-filter>entry>match# dst-port 23 - cfg>sys>sec>cpm>ip-filter>entry>match# exit - cfg>sys>sec>cpm>ip-filter>entry# action accept - cfg>sys>sec>cpm>ip-filter>entry# exit all Create Distributed CPU Protection: - configure system security dist-cpu-protection policy "rate-limit" create - config>sys>security>dist-cpu-protection>policy# static-policer "PIM-RATE" create - config>sys>security>dist-cpu-protection>policy>static# rate kbps 2000 mbs 200 - config>sys>security>dist-cpu-p" create >policy# static-policer "ICMP-RATE - config>sys>security>dist-cpu-protection>policy>static# exit - config>sys>security>dist-cpu-protection>policy# static-policer "ICMP-RATE" create - config>sys>security>dist-cpu-protection>policy>static# rate kbps 2000 mbs 200 - config>sys>security>dist-cpu-protection>policy>static# exit - config>sys>security>dist-cpu-protection>policy# static-policer "ALL-Other-Rate" - config>sys>security>dist-cpu-protection>policy>static# rate kbps 2000 mbs 200 - config>sys>security>dist-cpu-protection>policy>static# exit - config>sys>security>dist-cpu-protection>policy# protocol icmp create - config>sys>security>dist-cpu-protection>policy>protocol# enforcement static "ICMP-RATE" - config>sys>security>dist-cpu-protection>policy>protocol# exit - config>sys>security>dist-cpu-protection>policy# protocol pim create - config>sys>security>dist-cpu-protection>policy>protocol# enforcement static "PIM-RATE" - config>sys>security>dist-cpu-protection>policy>protocol# exit - config>sys>security>dist-cpu-protection>policy# protocol all-unspecified create - config>sys>security>dist-cpu-protection>policy>protocol# enforcement static "ALL-Other-Rate" - config>sys>security>dist-cpu-protection>policy>protocol# exit all Apply Distributed CPU Protection to the interface: - configure router interface "TEST" dist-cpu-protection "rate-limit"