OpenControls Logo

STIG Viewer

STIGViewer Support

The ALG providing user authentication intermediary services must uniquely identify and authenticate nonorganizational users (or processes acting on behalf of nonorganizational users).

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-279166SYME-00-002500SV-279166r1170654_ruleCCI-000804medium
Description
Before continuing, the site must follow the configuration steps for adding Common Access Card (CAC) and LDAPS authentication realms and the SSH Console CAC items under SYME-ND-000190. Lack of authentication enables anyone to gain access to the network or possibly a network element that provides opportunity for intruders to compromise resources within the network infrastructure. By identifying and authenticating nonorganizational users, their access to network resources can be restricted accordingly. Nonorganizational users will be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization when related to the use of anonymous access. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multifactor authentication, some combination thereof. This control applies to application layer gateways that provide content filtering and proxy services on network segments (e.g., DMZ) that allow access by nonorganizational users. This requirement focuses on authentication requests to the proxied application for access to destination resources and policy filtering decisions rather than administrator and management functions. Satisfies: SRG-NET-000169-ALG-000102, SRG-NET-000015-ALG-000016, SRG-NET-000138-ALG-000063, SRG-NET-000138-ALG-000088, SRG-NET-000138-ALG-000089, SRG-NET-000140-ALG-000094, SRG-NET-000147-ALG-000095, SRG-NET-000164-ALG-000100, SRG-NET-000166-ALG-000101, SRG-NET-000018-ALG-000017, SRG-NET-000019-ALG-000018, SRG-NET-000019-ALG-000019, SRG-NET-000400-ALG-000097
STIGDate
Symantec Edge SWG ALG Security Technical Implementation Guide2025-12-16

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-01.2Authenticate, Authorize and Audit (AAA)
1.00
IAC-02Identification & Authentication for Organizational Users
1.00
IAC-03Identification & Authentication for Non-Organizational Users
1.00
IAC-04Identification & Authentication for Devices
1.00
IAC-05Identification & Authentication for Third-Party Technology Assets, Applications and/or Services (TAAS)
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (39) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-7Unsuccessful Logon Attempts
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00

+29 more (top 10 by confidence shown)

CCI1 mapping
CCI-000804
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.AA-01
1.00
PR.AA-03
1.00
PR.AA-05
1.00

Who does this work

7 NICE work roles and 5 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-279166r1170654_chk)

In the Edge SWG Web UI, navigate to the Visual Policy Manager (VPM). If there is not a Web Access Layer, and the authorization has not been configured on this layer for the proxy users based on the CAC/LDAP authentication realm, this is a finding. If there are not specific services restricted to each group, this is a finding. Ensure there is a CPL layer that includes a client certificate requirement rule; otherwise, this is a finding.

Fix Text (F-83619r1170653_fix)

1. In the Edge SWG Web UI, navigate to the VPM. 2. Add a web access layer called "Web Access Layer". 3. Click "Add a rule." 4. Under "Source", left-click and select "Set". 5. Click "Add a new object" and select "Group". 6. Enter the full DN of the LDAP group. For example: CN=broadcom.proxyusers.gsg,OU=BROADCOM,DC=dod,DC=mil 7. Under "Authentication Realm", select the CAC Certificate. 8. Click "Apply" and then click "Set". 9. Click "Service" and then click "Set". 10. Click "Add a new object". 11. Click "Client Protocol", select "HTTP", and then click "Apply and set". 12. Under "Action", left-click and set to "Allow". 13. Under "Track", left-click "Add a new Object". 14. Click "Event Log". 15. Under "Details", add the following text: "$(appliance.name)$(appliance.primary_address)$(c-ip)$(c-port)$(c-uri)$(c-uri-address)$(c-uri-cookie-domain)$(c-uri-extension)$(c-uri-host)$(c-uri-hostname)$(c-uri-path)$(c-ur-pathquery)$(client.address)$(client.certificate.subject)$(client.host)$(client.public_address)$(cs-auth-group)$(cs-categories-policy)$(date)$(user.name)$(user.x509.subject)" 16. Under "Category", select "All". 17. Under "Display options", select "Both". 18. Click "Apply and set". 19. Repeat the above procedure for each service/protocol being proxied with authorization enforcement. For example, ensure HTTPS is selected when doing HTTPS and not HTTP. 20. Click "Apply Policy". 1. Navigate to the top of the VPM and add a new layer. It must be a CPL layer. 2. Include the following in the layer text: <Proxy> url.regex="ssl://" authenticate(no) <Proxy>client.certificate.require(yes) service.name=!(CAC-MC-Notify,HTTPS-Console) authenticate(CAC) authenticate.force(no) authenticate.mode(auto) Note: The CAC-MC-Notify and HTTPS-Console must match a proxy or reverse service in use. The authenticate(CAC) must represent the Certificate Authentication Realm previously configured. 3. Click "Apply Policy".