The F5 BIG-IP appliance providing content filtering must automatically update malicious code protection mechanisms.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-266159	SRG-NET-000251-ALG-000131	F5BI-AP-300065	SV-266159r1024388_rule	2024-09-20	1

Description
The malicious software detection functionality on network elements needs to be constantly updated to identify new threats as they are discovered. All malicious software detection functions must come with an update mechanism that automatically updates the application and any associated signature definitions. The organization (including any contractor to the organization) is required to promptly install security-relevant malicious code protection updates. Examples of relevant updates include antivirus signatures, detection heuristic rule sets, and/or file reputation data employed to identify and/or block malicious software from executing. Malicious code includes viruses, worms, Trojan horses, and spyware. This requirement is limited to ALGs, web content filters, and packet inspection firewalls that perform malicious code detection as part of their functionality.

Description

The malicious software detection functionality on network elements needs to be constantly updated to identify new threats as they are discovered. All malicious software detection functions must come with an update mechanism that automatically updates the application and any associated signature definitions. The organization (including any contractor to the organization) is required to promptly install security-relevant malicious code protection updates. Examples of relevant updates include antivirus signatures, detection heuristic rule sets, and/or file reputation data employed to identify and/or block malicious software from executing. Malicious code includes viruses, worms, Trojan horses, and spyware. This requirement is limited to ALGs, web content filters, and packet inspection firewalls that perform malicious code detection as part of their functionality.

ℹ️ Check
If the BIG-IP does not perform content filtering as part of its traffic management functionality, this is not applicable. Note: Automatic signature updates can be configured, but depending on site connectivity this may not be possible. In this case manual upload of updates is possible. The below covers automatic update configuration. Automatic Update Check: From the BIG-IP GUI: 1. System. 2. Software Management. 3. Update Check. 4. Verify that "Automatic Update Check" is set to "Enabled". Real-Time Installation of Updates: 1. System. 2. Software Management. 3. Live Update. 4. Under "Updates Configuration" click on each item and check that "Real-Time" is selected for the setting "Installation of Automatically Downloaded Updates". If the BIG-IP appliance is not configured to automatically update malicious code protection mechanisms, this is a finding.

ℹ️ Check

If the BIG-IP does not perform content filtering as part of its traffic management functionality, this is not applicable. Note: Automatic signature updates can be configured, but depending on site connectivity this may not be possible. In this case manual upload of updates is possible. The below covers automatic update configuration. Automatic Update Check: From the BIG-IP GUI: 1. System. 2. Software Management. 3. Update Check. 4. Verify that "Automatic Update Check" is set to "Enabled". Real-Time Installation of Updates: 1. System. 2. Software Management. 3. Live Update. 4. Under "Updates Configuration" click on each item and check that "Real-Time" is selected for the setting "Installation of Automatically Downloaded Updates". If the BIG-IP appliance is not configured to automatically update malicious code protection mechanisms, this is a finding.

✔️ Fix
Note: Automatic signature updates can be configured, but depending on site connectivity this may not be possible. In this case, manual upload of updates is possible. The below covers automatic update configuration. Automatic Update Check: From the BIG-IP GUI: 1. System. 2. Software Management. 3. Update Check. 4. Set "Automatic Update Check" to "Enabled". 5. Click "Apply Settings". Real-Time Installation of Updates: 1. System. 2. Software Management. 3. Live Update. 4. Under "Updates Configuration" click on each item and click "Real-Time" for the setting "Installation of Automatically Downloaded Updates". 5. Click "Save" for each item.

✔️ Fix

Note: Automatic signature updates can be configured, but depending on site connectivity this may not be possible. In this case, manual upload of updates is possible. The below covers automatic update configuration. Automatic Update Check: From the BIG-IP GUI: 1. System. 2. Software Management. 3. Update Check. 4. Set "Automatic Update Check" to "Enabled". 5. Click "Apply Settings". Real-Time Installation of Updates: 1. System. 2. Software Management. 3. Live Update. 4. Under "Updates Configuration" click on each item and click "Real-Time" for the setting "Installation of Automatically Downloaded Updates". 5. Click "Save" for each item.