Ensure ‘Host Name’ is set
Details Changes the device default hostname Rationale: The device hostname plays an important role in asset inventory and identification as...
- Home
- Security Hardening
- Tenable Cisco Firepower Threat Defense Best Practices
Tenable Cisco Firepower Threat Defense Best Practices
Ensure ‘HTTP session timeout’ is set to organzational policy
Details Sets the timeout for an HTTP session before the security appliance terminates it. Rationale: Limiting session timeout prevents unauthorized...Ensure ‘HTTP source restriction’ is set to an authorized IP address
Details Determines the client IP addresses that are allowed to connect to the security appliance through HTTP Rationale: One key...Ensure ICMP is restricted for untrusted interfaces
Details Allows ICMP traffic for specific hosts or subnets and denies ICMP traffic for all other sources Rationale: ICMP is...Ensure ‘Image Integrity’ is correct
Details Verifies integrity of an uploaded software before upgrading the system Rationale: Sometimes, manipulating software from downloading them from the...Ensure ‘Image Authenticity’ is correct
Details Verifies for digitally signed images that the running image is from a trusted source Rationale: The software image being...Ensure ‘ip verify’ is set to ‘reverse-path’ for untrusted interfaces
Details Enables the unicast Reverse-Path Forwarding (uRPF) on untrusted interfaces. Rationale: The unicast Reverse-Path Forwarding(uRPF) enabled on an interface ensures...Ensure ‘logging buffered severity ‘ is greater than or equal to ‘3’
Details Determines which syslog messages should be temporary stored in the local buffer so they can be checked by the...Ensure ‘logging buffer size’ is greater than or equal to ‘524288’ bytes (512kb)
Details Determines the size of the local buffer in which the logs are stored so that they can be checked...Ensure ‘logging’ is enabled
Details Enables logging Rationale: Logging is fundamental for audit requirements and incident management and should be enabled on any business...