1. Home
  2. Security Hardening
  3. DISA STIG Cisco ASA FW V1R1
  4. CASA-FW-000150 – The Cisco ASA must be configured to enable threat detection to mitigate risks of denial-of-service (DoS) attacks.
Searching...

CASA-FW-000150 – The Cisco ASA must be configured to enable threat detection to mitigate risks of denial-of-service (DoS) attacks.

Details

A firewall experiencing a DoS attack will not be able to handle production traffic load. The high utilization and CPU caused by a DoS attack will also have an effect on control keep-alives and timers used for neighbor peering, resulting in route flapping and will eventually black-hole production traffic.

The device must be configured to contain and limit a DoS attack’s effect on the device’s resource utilization. The use of redundant components and load balancing are examples of mitigating ‘flood-type’ DoS attacks through increased capacity.

Solution

Configure threat detection as shown in the example below.

ASA(config)# threat-detection basic-threat

Supportive Information

The following resource is also helpful.

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Cisco.

References

Source

Updated on July 16, 2022
Was this article helpful?
Yes No

Related Articles