Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

Firewall Security Technical Implementation Guide - Cisco

V8R19 · · · Released 23 Oct 2015 · 73 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

Firewall Security Technical Implementation Guide - Cisco
Digest of Updates vs. V8R16 · 25 Oct 2013 ✎ 54

Comparison against the immediately-prior release (V8R16). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Content changes 54

  • V-14637 Medium check Router advertisements must be suppressed on all external-facing IPv6-enabled interfaces.
  • V-14643 Medium descriptioncheckfix The SA must configure the firewall for the minimum content and protocol inspection requirements.
  • V-14644 Medium check The firewall must reject requests for access or services where the source address received by the firewall specifies a loopback address.
  • V-14646 Low check Alerts must be automatically generated to notify the administrator when log storage reaches seventy-five percent or more of its maximum capacity.
  • V-14647 Low checkfix The network device must dump logs when they reach 75% capacity to a syslog server.
  • V-14648 Medium descriptioncheckfix Critical alerts must be generated and notifications sent to authorized personnel regardless if the person is logged in.
  • V-14649 Medium check The ISSO must ensure the message is displayed at the remote console if an administrator is already logged in, or when an administrator logs in if the alarm message has not been acknowledged.
  • V-14653 Low check The ISSO must ensure the alarm message identifying the potential security violation makes accessible the audit record contents associated with the event(s).
  • V-14655 Low check The ISSO must ensure an alert will remain written on the consoles until acknowledged by an administrator.
  • V-14656 Low check The ISSO must ensure an acknowledgement message identifying a reference to the potential security violation is logged and it contains a notice that it has been acknowledged, the time of the acknowledgement and the user identifier that acknowledged the alarm, at the remote administrator session that received the alarm.
  • V-14667 Low descriptioncheckfix Network devices must be configured with rotating keys used for authenticating IGP peers that have a duration exceeding 180 days.
  • V-14671 Medium fix The network element must authenticate all NTP messages received from NTP servers and peers.
  • V-14693 Medium check The network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave, (FEC0::/10). Note that this consist of all addresses that begin with FEC, FED, FEE and FEF.
  • V-14717 Medium checkfix The network device must not allow SSH Version 1 to be used for administrative access.
  • V-15296 Medium descriptioncheck Interfaces supporting IPv4 in NAT-PT Architecture must not receive IPv6 traffic.
  • V-15432 Medium checkfix Network devices must use two or more authentication servers for the purpose of granting administrative access.
  • V-15434 High descriptioncheck The emergency account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online.
  • V-17754 Medium fix Management traffic is not restricted to only the authorized management packets based on destination and source IP address.
  • V-17822 Medium fix The network elements management interface must be configured with both an ingress and egress ACL.
  • V-17830 Medium fix A firewall located behind the premise router must be configured to block all outbound management traffic.
  • V-18608 Medium descriptioncheckfix IPv6 6-to-4 addresses with a prefix of 2002::/16 must be filtered at the perimeter.
  • V-18815 Medium check IPv6 Jumbo Payload hop by hop header must be blocked.
  • V-23747 Low descriptionfix The network element must use two or more NTP servers to synchronize time.
  • V-25890 Low descriptioncheckfix Network device logs must be timestamped.
  • V-25891 Low descriptioncheck Network device logs must include source IP, destination IP, port, protocol used and action taken.
  • V-3012 High descriptioncheckfix Network devices must be password protected.
  • V-3013 Medium descriptioncheckfix Network devices must display the DoD-approved logon banner warning.
  • V-3014 Medium fix The network element must timeout management connections for administrative access after 10 minutes or less of inactivity.
  • V-3021 Medium fix The network element must only allow SNMP access from addresses belonging to the management network.
  • V-3043 Medium checkfix The network device must use different SNMP community names or groups for various levels of read and write access.
  • V-3054 Medium descriptioncheck The firewall must not utilize any services or capabilities other than firewall software (e.g., DNS servers, e-mail client servers, ftp servers, web servers, etc.), and if these services are part of the standard firewall suite, they will be either uninstalled or disabled.
  • V-3056 High check Group accounts must not be configured for use on the network device.
  • V-3057 Medium description Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.
  • V-3058 Medium check Unauthorized accounts must not be configured for access to the network device.
  • V-3062 High fix The network element must be configured to ensure passwords are not viewable when displaying configuration information.
  • V-3069 Medium check Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.
  • V-3070 Low check Network devices must log all attempts to establish a management connection for administrative access.
  • V-3143 High descriptioncheckfix Network devices must not have any default manufacturer passwords.
  • V-3156 Medium descriptioncheck The device must be configured to protect the network against denial of service attacks such as Ping of Death, TCP SYN floods, etc.
  • V-3160 Medium checkfix Network devices must be running a current and supported operating system with all IAVMs addressed.
  • V-3175 High check The network device must require authentication prior to establishing a management connection for administrative access.
  • V-3176 Medium check The network devices must be configured to alert the administrator of a potential attack or system failure.
  • V-3178 Low descriptioncheckfix Administrator logons, changes to the administrator group, and account lockouts must be logged.
  • V-3196 High checkfix The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.
  • V-3210 High descriptioncheck The network device must not use the default or well-known SNMP community strings public and private.
  • V-3966 Medium descriptioncheckfix In the event the authentication server is down or unavailable, there must only be one local account of last resort created for emergency use.
  • V-3967 Medium descriptioncheck The network devices must time out access to the console port at 10 minutes or less of inactivity.
  • V-3982 Medium descriptioncheck L2TP must not pass into the private network of an enclave.
  • V-4582 High check The network device must require authentication for console access.
  • V-5611 Medium descriptioncheck The network devices must only allow management connections for administrative access from hosts residing in the management network.
  • V-5612 Medium descriptioncheckfix The network devices must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.
  • V-5613 Medium checkfix The network device must be configured for a maximum number of unsuccessful SSH logon attempts set at 3 before resetting the interface.
  • V-5646 Medium descriptioncheck The network device must drop half-open TCP connections through filtering thresholds or timeout periods.
  • V-7011 Low check The auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.
Sort by
a
The network device must log all interface access control lists (ACL) deny statements.
Low - V-3000 - SV-50941r1_rule
RMF Control
Severity
L
CCI
Version
NET1020
Vuln IDs
  • V-3000
Rule IDs
  • SV-50941r1_rule
Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, attempted to be done, and by whom in order to compile an accurate risk assessment. Auditing the actions on network devices provides a means to recreate an attack, or identify a configuration mistake on the device.Information Assurance OfficerECAT-1, ECAT-2, ECSC-1
Checks: C-46492r1_chk

Review the network device interface ACLs to verify all deny statements are logged. interface GigabitEthernet0/0 description To Outside Router nameif outside security-level 0 ip address 173.x.x.x 255.x.x.x ipv6 nd suppress-ra access-group outside_access_in in interface outside ... access-list outside_access_in extended deny ip 172.16.0.0 255.240.0.0 any log access-list outside_access_in extended deny ip 10.0.0.0 255.0.0.0 any log access-list outside_access_in extended deny ip 192.168.0.0 255.255.0.0 any log access-list outside_access_in extended deny ip 127.0.0.0 0.0.0.0 any log ... access-list outside_access_in extended deny ip any any log

Fix: F-3025r4_fix

Configure interface ACLs to log all deny statements.

a
The IAO/NSO will ensure that workstation clients’ real IPv4 addresses are not revealed to the public by implementing NAT on the firewall or the router.
Low - V-3005 - SV-3005r1_rule
RMF Control
Severity
L
CCI
Version
NET0190
Vuln IDs
  • V-3005
Rule IDs
  • SV-3005r1_rule
NAT works well with the implementation of RFC 1918 addressing scheme, it also has the privacy benefit of hiding real internal addresses. An attacker can learn more about a site’s private network once it has discovered the real IP addresses of the hosts within.Information Assurance OfficerEBBD-1, EBBD-2, EBBD-3, ECSC-1
Checks: C-3436r1_chk

Review the firewall or premise router configuration to determine if NAT has been implemented.

Fix: F-3030r1_fix

Implement Network Address Translation (NAT) on the firewall or premise router for NIPRNet Enclaves.

b
The IAO will ensure IPSec VPNs are established as tunnel type VPNs when transporting management traffic across an ip backbone network.
Medium - V-3008 - SV-3008r1_rule
RMF Control
Severity
M
CCI
Version
NET1800
Vuln IDs
  • V-3008
Rule IDs
  • SV-3008r1_rule
Using dedicated paths, the OOBM backbone connects the OOBM gateway routers located at the premise of the managed networks and at the NOC. Dedicated links can be deployed using provisioned circuits (ATM, Frame Relay, SONET, T-carrier, and others or VPN technologies such as subscribing to MPLS Layer 2 and Layer 3 VPN services) or implementing a secured path with gateway-to-gateway IPsec tunnel. The tunnel mode ensures that the management traffic will be logically separated from any other traffic traversing the same path.Information Assurance OfficerEBVC-1, ECSC-1
Checks: C-3837r1_chk

Have the SA display the configuration settings that enable this feature. Review the network topology diagram, and review VPN concentrators. Determine if tunnel mode is being used by reviewing the configuration. Examples: In CISCO Router(config)# crypto ipsec transform-set transform-set-name transform1 Router(cfg-crypto-tran)# mode tunnel OR in Junos edit security ipsec security-association sa-name] mode tunnel

Fix: F-3033r1_fix

Establish the VPN as a tunneled VPN. Terminate the tunneled VPN outside of the firewall. Ensure all host-to-host VPN are established between trusted known hosts.

c
Network devices must be password protected.
High - V-3012 - SV-3012r4_rule
RMF Control
Severity
H
CCI
Version
NET0230
Vuln IDs
  • V-3012
Rule IDs
  • SV-3012r4_rule
Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network device. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network device providing opportunity for intruders to compromise resources within the network infrastructure.Information Assurance OfficerECSC-1, IAIA-1, IAIA-2
Checks: C-3456r6_chk

Review the network devices configuration to determine if administrative access to the device requires some form of authentication--at a minimum a password is required. If passwords aren't used to administrative access to the device, this is a finding.

Fix: F-3037r6_fix

Configure the network devices so it will require a password to gain administrative access to the device.

b
Network devices must display the DoD-approved logon banner warning.
Medium - V-3013 - SV-3013r4_rule
RMF Control
Severity
M
CCI
Version
NET0340
Vuln IDs
  • V-3013
Rule IDs
  • SV-3013r4_rule
All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required logon warning banner prior to logon attempts will limit DoD's ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA's ability to monitor the device's usage is limited unless a proper warning banner is displayed. DoD CIO has issued new, mandatory policy standardizing the wording of "notice and consent" banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, "Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement", dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.Information Assurance OfficerECWM-1
Checks: C-3474r10_chk

Review the device configuration or request that the administrator logon to the device and observe the terminal. Verify either Option A or Option B (for systems with character limitations) of the Standard Mandatory DoD Notice and Consent Banner is displayed at logon. The required banner verbiage follows and must be displayed verbatim: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't." If the device configuration does not have a logon banner as stated above, this is a finding.

Fix: F-3038r8_fix

Configure all management interfaces to the network device to display the DoD-mandated warning banner verbiage at logon regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't."

b
The network element must timeout management connections for administrative access after 10 minutes or less of inactivity.
Medium - V-3014 - SV-32758r2_rule
RMF Control
Severity
M
CCI
Version
NET1639
Vuln IDs
  • V-3014
Rule IDs
  • SV-32758r2_rule
Setting the timeout of the session to ten minutes or less increases the level of protection afforded critical network components.Information Assurance OfficerECSC-1
Checks: C-33384r2_chk

Review the management connection for administrative access and verify that the network element is configured to time-out the connection after 10 minutes or less of inactivity as shown in the following example: ssh timeout 10

Fix: F-3039r5_fix

Configure the network devices to ensure the timeout for unattended administrative access connections is no longer than 10 minutes.

a
The network element must have DNS servers defined if it is configured as a client resolver.
Low - V-3020 - SV-41503r1_rule
RMF Control
Severity
L
CCI
Version
NET0820
Vuln IDs
  • V-3020
Rule IDs
  • SV-41503r1_rule
The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a Telnet connection with a destination host and queries a DNS server for the IP address of the destination host name. If the response to this query is the IP address of a host operated by an attacker, the source host will establish a connection with the attackers host, rather than the intended target. The user on the source host might then provide logon, authentication, and other sensitive data.Information Assurance OfficerECSC-1
Checks: C-39985r1_chk

Review the device configuration to ensure that DNS servers have been defined if it has been configured as a client resolver (name lookup). The configuration should look similar to one of the following examples: dns domain-lookup inside dns domain-lookup dmz dns name-server 192.168.1.22 dns name-server 101.14.8.55 Note: DNS lookup on the PIX and ASA is disabled by default.

Fix: F-3045r2_fix

Configure the device to include DNS servers or disable domain lookup.

b
The network element must only allow SNMP access from addresses belonging to the management network.
Medium - V-3021 - SV-41507r1_rule
RMF Control
Severity
M
CCI
Version
NET0890
Vuln IDs
  • V-3021
Rule IDs
  • SV-41507r1_rule
Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.Information Assurance OfficerECSC-1
Checks: C-39986r2_chk

Review device configuration and verify that it is configured to only allow SNMP access from only addresses belonging to the management network. The ASA appliance can send SNMP traps and can be polled via SNMP—it does not allow SNMP write access. The snmp-server host <iface> <IP> [trap|poll] [community <KEY>] command is used to define a host that is allowed to poll the ASA and to receive traps from it. If one of the keywords trap or poll is specified, the host is limited to that function only. Otherwise, it can both receive traps from and poll the ASA device. The following example will send traps from its management interface to the host 10.1.0.100. This is the only host that will be able to poll the ASA appliance. snmp-server community xxxxxxxxxxxx snmp-server host mgmt 10.1.0.100 trap

Fix: F-3046r4_fix

Configure the network devices to only allow SNMP access from only addresses belonging to the management network.

b
The network device must use different SNMP community names or groups for various levels of read and write access.
Medium - V-3043 - SV-3043r4_rule
RMF Control
Severity
M
CCI
Version
NET1675
Vuln IDs
  • V-3043
Rule IDs
  • SV-3043r4_rule
Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking experts. If a hacker gains access to these devices and can easily guess the name, this could result in denial of service, interception of sensitive information, or other destructive actions.Information Assurance OfficerECSC-1
Checks: C-3825r7_chk

Review the SNMP configuration of all managed nodes to ensure different community names (V1/2) or groups/users (V3) are configured for read-only and read-write access. If unique community strings or accounts are not used for SNMP peers, this is a finding.

Fix: F-3068r4_fix

Configure the SNMP community strings on the network device and change them from the default values. SNMP community strings and user passwords must be unique and not match any other network device passwords. Different community strings (V1/2) or groups (V3) must be configured for various levels of read and write access.

b
The firewall must not utilize any services or capabilities other than firewall software (e.g., DNS servers, e-mail client servers, ftp servers, web servers, etc.), and if these services are part of the standard firewall suite, they will be either uninstalled or disabled.
Medium - V-3054 - SV-3054r2_rule
RMF Control
Severity
M
CCI
Version
NET0377
Vuln IDs
  • V-3054
Rule IDs
  • SV-3054r2_rule
The more services that the firewall has enabled increases the risk for an attack since the firewall will listen for these services.Information Assurance OfficerECSC-1
Checks: C-3672r2_chk

Have the FA display the services running on the firewall appliance or underlying OS.CAVEAT: Anti-virus software running on the firewall's OS would be an exception to the above requirement. In fact, it is recommended that anti-virus software be implemented on any non-appliance firewall if supported. However, it is not a finding if anti-virus software has not been implemented. If unnecessary services are found to be running on the firewall, this is a finding.

Fix: F-3079r1_fix

The Firewall Administrator will only utilize services related to the operation of the firewall and even if they are part of the firewall standard suite, they will be uninstalled or disabled.

c
Group accounts must not be configured for use on the network device.
High - V-3056 - SV-3056r7_rule
RMF Control
Severity
H
CCI
Version
NET0460
Vuln IDs
  • V-3056
Rule IDs
  • SV-3056r7_rule
Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network.Information Assurance OfficerIAIA-1, IAIA-2
Checks: C-3503r11_chk

Review the network device configuration and validate there are no group accounts configured for access. If a group account is configured on the device, this is a finding.

Fix: F-3081r9_fix

Configure individual user accounts for each authorized person then remove any group accounts.

b
Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.
Medium - V-3057 - SV-3057r5_rule
RMF Control
Severity
M
CCI
Version
NET0465
Vuln IDs
  • V-3057
Rule IDs
  • SV-3057r5_rule
By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personnel are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.Information Assurance OfficerECSC-1
Checks: C-3504r6_chk

Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the greatest privilege level unless deemed necessary for assigned duties. If it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding.

Fix: F-3082r5_fix

Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.

b
Unauthorized accounts must not be configured for access to the network device.
Medium - V-3058 - SV-3058r5_rule
RMF Control
Severity
M
CCI
Version
NET0470
Vuln IDs
  • V-3058
Rule IDs
  • SV-3058r5_rule
A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service, interception of sensitive information, or other destructive actions could potentially take place if an unauthorized account is configured to access the network device.Information Assurance OfficerECSC-1, IAAC-1
Checks: C-3505r5_chk

Review the organization's responsibilities list and reconcile the list of authorized accounts with those accounts defined for access to the network device. If an unauthorized account is configured for access to the device, this is a finding.

Fix: F-3083r5_fix

Remove any account configured for access to the network device that is not defined in the organization's responsibilities list.

c
The network element must be configured to ensure passwords are not viewable when displaying configuration information.
High - V-3062 - SV-41452r2_rule
RMF Control
Severity
H
CCI
Version
NET0600
Vuln IDs
  • V-3062
Rule IDs
  • SV-41452r2_rule
Many attacks information systems and network elements are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the console or printout of the configuration. Information Assurance OfficerECSC-1
Checks: C-39963r2_chk

The PIX and ASA device will encrypt both user-mode and enable-mode passwords. When displayed the password will be shown encrypted followed by the keyword "encrypted". Hence, this would never be a finding.

Fix: F-3087r7_fix

Configure the network devices to ensure passwords are not viewable when displaying configuration information.

b
Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.
Medium - V-3069 - SV-3069r5_rule
RMF Control
Severity
M
CCI
Version
NET1638
Vuln IDs
  • V-3069
Rule IDs
  • SV-3069r5_rule
Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.Information Assurance OfficerDCNR-1, ECSC-1
Checks: C-3532r8_chk

Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols. -SSHv2 -SCP -HTTPS using TLS If management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.

Fix: F-3094r5_fix

Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.

a
Network devices must log all attempts to establish a management connection for administrative access.
Low - V-3070 - SV-3070r4_rule
RMF Control
Severity
L
CCI
Version
NET1640
Vuln IDs
  • V-3070
Rule IDs
  • SV-3070r4_rule
Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.Information Assurance OfficerECAT-1, ECAT-2
Checks: C-3542r6_chk

Review the configuration to verify all attempts to access the device via management connection are logged. If management connection attempts are not logged, this is a finding.

Fix: F-3095r3_fix

Configure the device to log all access attempts to the device to establish a management connection for administrative access.

b
The network element must have HTTP service for administrative access disabled.
Medium - V-3085 - SV-41470r1_rule
RMF Control
Severity
M
CCI
Version
NET0740
Vuln IDs
  • V-3085
Rule IDs
  • SV-41470r1_rule
The additional services that the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router. Most recent software versions support remote configuration and monitoring using the World Wide Web's HTTP protocol. In general, HTTP access is equivalent to interactive access to the router. The authentication protocol used for HTTP is equivalent to sending a clear-text password across the network, and, unfortunately, there is no effective provision in HTTP for challenge-based or one-time passwords. This makes HTTP a relatively risky choice for use across the public Internet. Any additional services that are enabled increase the risk for an attack since the router will listen for these services.Information Assurance OfficerECSC-1
Checks: C-39969r1_chk

Verify that the command http server enable is not defined in the configuration.

Fix: F-3110r4_fix

Configure the device to disable using HTTP (port 80) for administrative access.

c
Network devices must not have any default manufacturer passwords.
High - V-3143 - SV-3143r4_rule
RMF Control
Severity
H
CCI
Version
NET0240
Vuln IDs
  • V-3143
Rule IDs
  • SV-3143r4_rule
Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not removing them prior to deploying the network devices into production provides an opportunity for a malicious user to gain unauthorized access to the device.Information Assurance OfficerECSC-1
Checks: C-40236r3_chk

Review the network devices configuration to determine if the vendor default password is active. If any vendor default passwords are used on the device, this is a finding.

Fix: F-35391r3_fix

Remove any vendor default passwords from the network devices configuration.

b
The device must be configured to protect the network against denial of service attacks such as Ping of Death, TCP SYN floods, etc.
Medium - V-3156 - SV-3156r2_rule
RMF Control
Severity
M
CCI
Version
NET0375
Vuln IDs
  • V-3156
Rule IDs
  • SV-3156r2_rule
A SYN-flood attack is a denial-of-service attack where the attacker sends a huge amount of please-start-a-connection packets and then nothing else. This causes the device being attacked to be overloaded with the open sessions and eventually crash. A ping sweep (also known as an ICMP sweep) is a basic network scanning technique used to determine which of a range of IP addresses map to live hosts (computers).Information Assurance OfficerEBBD-1, EBBD-2, EBBD-3, ECSC-1
Checks: C-3670r2_chk

Review the device configurations to determine if denial of service attacks guarded against. If the device is not configured to mitigate denial of service attacks, this is a finding.

Fix: F-3181r1_fix

If the firewall support SYN-flood or ping sweep protection then enable these features. If the firewall does not support these features, enable the security features on the router to protect the network from these attacks.

b
Network devices must be running a current and supported operating system with all IAVMs addressed.
Medium - V-3160 - SV-3160r4_rule
RMF Control
Severity
M
CCI
Version
NET0700
Vuln IDs
  • V-3160
Rule IDs
  • SV-3160r4_rule
Network devices not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches, as well as enhancements to IP security. Viruses, denial of service attacks, system weaknesses, back doors and other potentially harmful situations could render a system vulnerable, allowing unauthorized access to DoD assets.Information Assurance OfficerECSC-1
Checks: C-3549r4_chk

Have the administrator display the OS version in operation. The OS must be current with related IAVMs addressed. If the device is using an OS that does not meet all IAVMs or currently not supported by the vendor, this is a finding.

Fix: F-3185r4_fix

Update operating system to a supported version that addresses all related IAVMs.

c
The network device must require authentication prior to establishing a management connection for administrative access.
High - V-3175 - SV-3175r5_rule
RMF Control
Severity
H
CCI
Version
NET1636
Vuln IDs
  • V-3175
Rule IDs
  • SV-3175r5_rule
Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance OfficerECSC-1
Checks: C-3516r9_chk

Review the network device configuration to verify all management connections for administrative access require authentication. If authentication isn't configured for management access, this is a finding.

Fix: F-3200r3_fix

Configure authentication for all management connections.

b
The network devices must be configured to alert the administrator of a potential attack or system failure.
Medium - V-3176 - SV-3176r2_rule
RMF Control
Severity
M
CCI
Version
NET0390
Vuln IDs
  • V-3176
Rule IDs
  • SV-3176r2_rule
The IDS or firewall is the first device that is under the sites control that has the possibility to alarm the local staff of an ongoing attack. An alert from either of these devices can be the first indication of an attack or system failure.Information Assurance OfficerECAT-2, ECSC-1
Checks: C-3680r3_chk

The SA shall define clipping levels / thresholds as a baseline to display alert messages on specific attacks identifying the potential security violation or attack. Review the IDS or firewall configuration to determine what alerts have been defined and how the notifications are performed. If the device is not configured to alert the administrator of potential failures, this is a finding.

Fix: F-3201r2_fix

Configure the IDS or firewall to alarm the SA of potential attacks or system failure.

a
Administrator logons, changes to the administrator group, and account lockouts must be logged.
Low - V-3178 - SV-3178r2_rule
RMF Control
Severity
L
CCI
Version
NET1300
Vuln IDs
  • V-3178
Rule IDs
  • SV-3178r2_rule
The network device and the associated logging functions allows for forensic investigations if properly configured and protected. The administrators account is the most sought after account so extra protection must be taken to protect this account and log its activity.Information Assurance OfficerECAR-1, ECAR-2, ECAR-3, ECSC-1
Checks: C-12954r5_chk

Review the device configuration to determine if all administrative actions are being logged. If administrative actions are not being logged, this is a finding.

Fix: F-14198r2_fix

Configure the network device to log all administrative actions performed on the device.

c
The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.
High - V-3196 - SV-3196r4_rule
RMF Control
Severity
H
CCI
Version
NET1660
Vuln IDs
  • V-3196
Rule IDs
  • SV-3196r4_rule
SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network.Information Assurance OfficerECSC-1
Checks: C-3820r6_chk

Review the device configuration to verify it is configured to use SNMPv3 with both SHA authentication and privacy using AES encryption. Downgrades: If the site is using Version 1 or Version 2 with all of the appropriate patches and has developed a migration plan to implement the Version 3 Security Model, this finding can be downgraded to a Category II. If the targeted asset is running SNMPv3 and does not support SHA or AES, but the device is configured to use MD5 authentication and DES or 3DES encryption, then the finding can be downgraded to a Category III. If the site is using Version 1 or Version 2 and has installed all of the appropriate patches or upgrades to mitigate any known security vulnerabilities, this finding can be downgraded to a Category II. In addition, if the device does not support SNMPv3, this finding can be downgraded to a Category III provided all of the appropriate patches to mitigate any known security vulnerabilities have been applied and has developed a migration plan that includes the device upgrade to support Version 3 and the implementation of the Version 3 Security Model. If the device is configured to use to anything other than SNMPv3 with at least SHA-1 and AES, this is a finding. Downgrades can be determined based on the criteria above.

Fix: F-3221r5_fix

If SNMP is enabled, configure the network device to use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography (i.e., SHA authentication and AES encryption).

c
The network device must not use the default or well-known SNMP community strings public and private.
High - V-3210 - SV-3210r4_rule
RMF Control
Severity
H
CCI
Version
NET1665
Vuln IDs
  • V-3210
Rule IDs
  • SV-3210r4_rule
Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device using the read community string "public". In addition, an attacker can change a system configuration using the write community string "private".Information Assurance OfficerECSC-1, IAIA-1, IAIA-2
Checks: C-3822r7_chk

Review the network devices configuration and verify if either of the SNMP community strings "public" or "private" is being used. If default or well-known community strings are used for SNMP, this is a finding.

Fix: F-3235r4_fix

Configure unique SNMP community strings replacing the default community strings.

b
In the event the authentication server is down or unavailable, there must only be one local account of last resort created for emergency use.
Medium - V-3966 - SV-15469r5_rule
RMF Control
Severity
M
CCI
Version
NET0440
Vuln IDs
  • V-3966
Rule IDs
  • SV-15469r5_rule
Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between the device and the authentication server is not operable. The console or account of last resort logon credentials must be stored in a sealed envelope and kept in a safe.ECSC-1
Checks: C-12935r6_chk

Review the network device configuration to determine if an authentication server is defined for gaining administrative access. If so, there must be only one account of last resort configured locally for an emergency. Verify the username and password for the account of last resort is contained within a sealed envelope kept in a safe. If an authentication server is used and more than one local account exists, this is a finding.

Fix: F-3899r7_fix

Configure the device to only allow one local account of last resort for emergency access and store the credentials in a secure manner.

b
The network devices must time out access to the console port at 10 minutes or less of inactivity.
Medium - V-3967 - SV-3967r4_rule
RMF Control
Severity
M
CCI
Version
NET1624
Vuln IDs
  • V-3967
Rule IDs
  • SV-3967r4_rule
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network device. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance OfficerECSC-1
Checks: C-3511r5_chk

Review the configuration and verify a session using the console port will time out after 10 minutes or less of inactivity. If console access is not configured to timeout at 10 minutes or less, this is a finding.

Fix: F-3900r4_fix

Configure the timeout for idle console connection to 10 minutes or less.

b
The network device must only allow SNMP read-only access.
Medium - V-3969 - SV-41513r2_rule
RMF Control
Severity
M
CCI
Version
NET0894
Vuln IDs
  • V-3969
Rule IDs
  • SV-41513r2_rule
Enabling write access to the router via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.Information Assurance OfficerECSC-1
Checks: C-39993r4_chk

The ASA appliance can send SNMP traps and can be polled via SNMP. However, it does not allow SNMP write access. This requirement will not be a finding.

Fix: F-40479r2_fix

The ASA appliance can send SNMP traps and can be polled via SNMP. However, it does not allow SNMP write access. This requirement will not be a finding.

b
L2TP must not pass into the private network of an enclave.
Medium - V-3982 - SV-3982r3_rule
RMF Control
Severity
M
CCI
Version
NET-TUNL-013
Vuln IDs
  • V-3982
Rule IDs
  • SV-3982r3_rule
Unlike GRE (a simple encapsulating header) L2TP is a full-fledged communications protocol with control channel, data channels, and a robust command structure. In addition to PPP, other link layer types (called pseudowires) can be and are defined for delivery in L2TP by separate RFC documents. Further complexity is created by the capability to define vender-specific parameters beyond those defined in the L2TP specifications. The endpoint devices of an L2TP connection can be an L2TP Access Concentrator (LAC) in which case it inputs/outputs the layer 2 protocol to/from the L2TP tunnel. Otherwise it is an L2TP Network Server (LNS), in which case it inputs/outputs the layer 3 (IP) protocol to/from the L2TP tunnel. The specifications describe three reference models: LAC-LNS, LAC-LAC, and LNS-LNS, the first of which is the most common case. The LAC-LNS model allows a remote access user to reach his home network or ISP from a remote location. The remote access user either dials (or otherwise connects via layer 2) to a LAC device which tunnels his connection home to an awaiting LNS. The LAC could also be located on the remote user's laptop which connects to an LNS at home using some generic internet connection. The other reference models may be used for more obscure scenarios. Although the L2TP protocol does not contain encryption capability, it can be operated over IPSEC which would provide authentication and confidentiality. A remote user in the LAC-LNS model would most likely obtain a dynamically assigned IP address from the home network to ultimately use through the tunnel back to the home network. Secondly, the outer IP source address used to send the L2TP tunnel packet to the home network is likely to be unknown or highly variable. Thirdly, since the LNS provides the remote user with a dynamic IP address to use, the firewall at the home network would have to be dynamically updated to accept this address in conjunction with the outer tunnel address. Finally, there is also the issue of authentication of the remote user prior to divulging an acceptable IP address. As a result of all of these complications, the strict filtering rules applied to the IP-in-IP and GRE tunneling cases will likely not be possible in the L2TP scenario. In addition to the difficulty of enforcing addresses and endpoints (as explained above), the L2TP protocol itself is a security concern if allowed through a security boundary. In particular: 1) L2TP potentially allows link layer protocols to be delivered from afar. These protocols were intended for link-local scope only, are less defended, and not as well-known 2) The L2TP tunnels can carry IP packets that are very difficult to see and filter because of the additional layer 2 overhead 3) L2TP is highly complex and variable (vender-specific variability) and therefore would be a viable target that is difficult to defend. It is better left outside of the main firewall where less damage occurs if the L2TP-processing node is compromised. 4) Filtering cannot be used to detect and prevent other unintended layer 2 protocols from being tunneled. The strength of the application layer code would have to be relied on to achieve this task. 5) Regardless of whether the L2TP is handled inside or outside of the main network, a secondary layer of IP filtering is required, therefore bringing it inside doesn't save resources. Therefore, it is not recommended to allow unencrypted L2TP packets across the security boundary into the network's protected areas. Reference the Backbone Transport STIG for additional L2TP guidance and use.Information Assurance OfficerECSC-1
Checks: C-3800r5_chk

Review the network topology diagram, and review VPN concentrators. Verify that L2TP is not permitted into the enclave's private network. L2TP uses TCP and UDP ports 1701. See the PPS Vulnerability Assessment for additional protocol guidance and reference the Backbone Transport STIG for exceptions. If L2TP is not filtered outbound, this is a finding.

Fix: F-3915r3_fix

Terminate L2TP tunnels at the enclave perimeter, either in the DMZ or a service network for filtering and content inspection before passing traffic to the enclave's private network.

c
The network device must require authentication for console access.
High - V-4582 - SV-4582r5_rule
RMF Control
Severity
H
CCI
Version
NET1623
Vuln IDs
  • V-4582
Rule IDs
  • SV-4582r5_rule
Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance OfficerIAIA-1, IAIA-2
Checks: C-3510r6_chk

Review the network device's configuration and verify authentication is required for console access. If authentication is not configured for console access, this is a finding.

Fix: F-4515r4_fix

Configure authentication for console access on the network device.

b
The FA will ensure that if the firewall product operates on an OS platform, the host must be STIG compliant prior to the installation of the firewall product.
Medium - V-4619 - SV-4619r1_rule
RMF Control
Severity
M
CCI
Version
NET0379
Vuln IDs
  • V-4619
Rule IDs
  • SV-4619r1_rule
If the host that a firewall engine is operating on is not secured, the firewall itself is exposed to greater risk.Information Assurance OfficerDCCS-1, DCCS-2, ECSC-1
Checks: C-3674r1_chk

Review documentation that the OS was STIG compliant prior to firewall installation and that the appropriate patches have been applied that address all IAVAs.

Fix: F-4552r1_fix

The firewall administrator will install all patches that address IAVA.

b
The network devices must only allow management connections for administrative access from hosts residing in the management network.
Medium - V-5611 - SV-5611r4_rule
RMF Control
Severity
M
CCI
Version
NET1637
Vuln IDs
  • V-5611
Rule IDs
  • SV-5611r4_rule
Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.Information Assurance OfficerECSC-1
Checks: C-3527r6_chk

Review the configuration and verify management access to the device is allowed only from hosts within the management network. If management access can be gained from outside of the authorized management network, this is a finding.

Fix: F-5522r4_fix

Configure an ACL or filter to restrict management access to the device from only the management network.

b
The network devices must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.
Medium - V-5612 - SV-5612r3_rule
RMF Control
Severity
M
CCI
Version
NET1645
Vuln IDs
  • V-5612
Rule IDs
  • SV-5612r3_rule
An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for the malicious user attempting to make a connection to the network device.Information Assurance OfficerECSC-1
Checks: C-3534r6_chk

Review the configuration and verify the timeout is set for 60 seconds or less. The SSH service terminates the connection if protocol negotiation (that includes user authentication) is not complete within this timeout period. If the device is not configured to drop broken SSH sessions after 60 seconds, this is a finding.

Fix: F-5523r5_fix

Configure the network devices so it will require a secure shell timeout of 60 seconds or less.

b
The network device must be configured for a maximum number of unsuccessful SSH logon attempts set at 3 before resetting the interface.
Medium - V-5613 - SV-5613r4_rule
RMF Control
Severity
M
CCI
Version
NET1646
Vuln IDs
  • V-5613
Rule IDs
  • SV-5613r4_rule
An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.Information Assurance OfficerECSC-1
Checks: C-3538r8_chk

Review the configuration and verify the number of unsuccessful SSH logon attempts is set at 3. If the device is not configured to reset unsuccessful SSH logon attempts at 3, this is a finding.

Fix: F-5524r9_fix

Configure the network device to require a maximum number of unsuccessful SSH logon attempts at 3.

b
The network device must drop half-open TCP connections through filtering thresholds or timeout periods.
Medium - V-5646 - SV-5646r5_rule
RMF Control
Severity
M
CCI
Version
NET0965
Vuln IDs
  • V-5646
Rule IDs
  • SV-5646r5_rule
A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance of that acknowledgement is sent by the originator. An attacker's goal in this scenario is to cause a denial of service to the network or device by initiating a high volume of TCP packets, then never sending an acknowledgement, leaving connections in a half-opened state. Without the device having a connection or time threshold for these half-opened sessions, the device risks being a victim of a denial of service attack. Setting a TCP timeout threshold will instruct the device to shut down any incomplete connections. Services such as SSH, BGP, SNMP, LDP, etc. are some services that may be prone to these types of denial of service attacks. If the router does not have any BGP connections with BGP neighbors across WAN links, values could be set to even tighter constraints.Information Assurance OfficerECSC-1
Checks: C-3604r11_chk

Review the device configuration to determine if threshold filters or timeout periods are set for dropping excessive half-open TCP connections. For timeout periods, the time should be set to 10 seconds or less. If the device cannot be configured for 10 seconds or less, it should be set to the least amount of time allowable in the configuration. Threshold filters will need to be determined by the organization for optimal filtering. If the device is not configured in a way to drop half-open TCP connections using filtering or timeout periods, this is a finding.

Fix: F-5557r6_fix

Configure the device to drop half-open TCP connections through threshold filtering or timeout periods.

b
The SA will utilize ingress and egress ACLs to restrict traffic destined to the enclave perimeter in accordance with the guidelines contained in DoD Instruction 8551.1 for all ports and protocols required for operational commitments.
Medium - V-5731 - SV-5731r1_rule
RMF Control
Severity
M
CCI
Version
NET0910
Vuln IDs
  • V-5731
Rule IDs
  • SV-5731r1_rule
Vulnerability assessments must be reviewed by the SA and protocols must be approved by the IA staff before entering the enclave. Access Control Lists (ACLs) are the first line of defense in a layered security approach. They permit authorized packets and deny unauthorized packets based on port or service type. They enhance the posture of the network by not allowing packets to even reach a potential target within the security domain. The list provided are highly susceptible ports and services that should be blocked or limited as much as possible without adversely affecting customer requirements. Auditing packets attempting to penetrate the network but are stopped by an ACL will allow network administrators to broaden their protective ring and more tightly define the scope of operation. If the perimeter is in a Deny-by-Default posture and what is allowed through the filter is IAW DoD Instruction 8551.1, and if the permit rule is explicitly defined with explicit ports and protocols allowed, then all requirements related to PPS being blocked would be satisfied. Information Assurance OfficerECSC-1
Checks: C-3595r1_chk

Identify the device or devices that make up the perimeter defense. Review the configuration of the premise routers and firewalls and verify that the filters are IAW DoD 8551. SA will review PPS Vulnerability Assessment of every port allowed into the enclave and apply all appropriate mitigations defined in the VA report. All ports and protocols allowed into the enclave must be registered in the PPSM database. Note: It is the responsibility of the enclave owner to have the applications the enclave uses registered in the PPSM database.

Fix: F-5666r1_fix

The SA will utilize ingress and egress ACLs to restrict traffic in accordance with the guidelines contained in DOD Instruction 8551.1 for all services and protocols required for operational commitments.

a
The auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.
Low - V-7011 - SV-7365r4_rule
RMF Control
Severity
L
CCI
Version
NET1629
Vuln IDs
  • V-7011
Rule IDs
  • SV-7365r4_rule
The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network. Secured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.Information Assurance OfficerECSC-1
Checks: C-3513r5_chk

Review the configuration and verify the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected. If the auxiliary port is enabled without the use of a secured modem, this is a finding.

Fix: F-6614r3_fix

Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.

b
Router advertisements must be suppressed on all external-facing IPv6-enabled interfaces.
Medium - V-14637 - SV-38206r2_rule
RMF Control
Severity
M
CCI
Version
NET-IPV6-004
Vuln IDs
  • V-14637
Rule IDs
  • SV-38206r2_rule
Many of the known attacks in stateless autoconfiguration are defined in RFC 3756 were present in IPv4 ARP attacks. IPSec AH was originally suggested as mitigation for the link local attacks, but has since been found to have bootstrapping problems and to be very administrative intensive. Due to first requiring an IP address in order to set up the IPSec security association creates the chicken-before-the-egg dilemma. There are solutions being developed (Secure Neighbor Discovery and Cryptographic Generated Addressing) to secure these threats but are not currently available at the time of this writing. To mitigate these vulnerabilities, links that have no hosts connected such as the interface connecting to external gateways will be configured to suppress router advertisements. Disable (or do not configure) all IPv6 Neighbor Discovery functions across tunnels including the Neighbor Unreachability Detection (NUD) function. Note: this is applicable only when the inner IP layer is IPv6 since IPv4 does not have the Neighbor Discovery functionality. Information Assurance OfficerDCBP-1, ECSC-1
Checks: C-12653r5_chk

Inspect the device configuration to validate IPv6 router advertisement suppression is enabled on all external-facing interfaces. This is applicable to all IPv6-enabled interfaces connected to an IP backbone (i.e. NIPRNet, SIPRNet, etc.), backdoor link, or an alternate gateway (AG). If router advertisements are not suppressed on external facing IPv6 interfaces, this is a finding.

Fix: F-14099r2_fix

Configure the network device to enable route advertisement suppression on all external facing have IPv6 enabled on the interface.

b
The SA must configure the firewall for the minimum content and protocol inspection requirements.
Medium - V-14643 - SV-15269r2_rule
RMF Control
Severity
M
CCI
Version
NET0366
Vuln IDs
  • V-14643
Rule IDs
  • SV-15269r2_rule
Creating a filter to allow a port or service through the firewall without content or protocol inspection creates a direct connection between the host in the private network and a host on the outside; thereby, bypassing additional security measures that could be provided. This places the internal host at a greater risk of exploitation that could make the entire network vulnerable to an attack.DCCS-2, ECSC-1
Checks: C-12659r2_chk

Review the firewall configuration and verify both ingress and egress traffic is being inspected. If any traffic is able to leave or enter the enclave without being inspected by the firewall, then this is a finding.

Fix: F-14103r2_fix

Ensure the firewall has content and protocol inspection implemented for all ingress and egress traffic.

b
The firewall must reject requests for access or services where the source address received by the firewall specifies a loopback address.
Medium - V-14644 - SV-15270r2_rule
RMF Control
Severity
M
CCI
Version
NET0380
Vuln IDs
  • V-14644
Rule IDs
  • SV-15270r2_rule
The loopback address is used by an Inter-Processor Control (IPC) mechanism that enables the client and server portion of an application running on the same machine to communicate, and so it is trusted. It should never be used as the source IP address of an inbound or outbound transmission.Information Assurance OfficerECSC-1
Checks: C-12660r2_chk

Review the device configuration to determine if filters are in place to block loopback addresses. If loopback addresses are not being filtered by the firewall, this is a finding.

Fix: F-14104r2_fix

Establish filters to block any attempt from the firewall or any network to pass any packets claiming to be from a loopback address.

a
Alerts must be automatically generated to notify the administrator when log storage reaches seventy-five percent or more of its maximum capacity.
Low - V-14646 - SV-15272r3_rule
RMF Control
Severity
L
CCI
Version
NET0386
Vuln IDs
  • V-14646
Rule IDs
  • SV-15272r3_rule
Configuring the network device or syslog server to provide alerts to the administrator in the event of modification or audit log capacity being exceeded ensures administrative staff is aware of critical alerts. Without this type of notification setup, logged audits and events could potentially fill to capacity, causing subsequent records to not be recorded and dropped without any knowledge by the administrative staff. Other unintended consequences of filling the log storage to capacity may include a denial of service of the device itself without proper notification.Information Assurance OfficerECSC-1
Checks: C-13714r5_chk

Review the network device or syslog server to determine whether alerts are configured to automatically generate and notify the administrator when seventy-five percent or more of the storage capacity has been reached with log data. If alerts are not configured for notification when exceeding storage capacity, this is a finding.

Fix: F-14748r4_fix

Configure the network device or syslog server to automatically generate and notify the administrator when seventy-five percent or more of the storage capacity has been reached with log data.

a
The network device must dump logs when they reach 75% capacity to a syslog server.
Low - V-14647 - SV-15273r2_rule
RMF Control
Severity
L
CCI
Version
NET0388
Vuln IDs
  • V-14647
Rule IDs
  • SV-15273r2_rule
Having a procedure tested and verified will prevent the logs from filling when they reach 75% capacity.ECSC-1
Checks: C-13715r2_chk

Review the device configuration to determine if logs are being dumped to a syslog when meeting the 75% storage capacity. If logs aren't being dumped at 75% capacity, this is a finding.

Fix: F-14749r2_fix

Configure the device to dump logs to a syslog server when reaching a storage capacity of 75%.

b
Critical alerts must be generated and notifications sent to authorized personnel regardless if the person is logged in.
Medium - V-14648 - SV-15274r2_rule
RMF Control
Severity
M
CCI
Version
NET0391
Vuln IDs
  • V-14648
Rule IDs
  • SV-15274r2_rule
By immediately displaying an alarm message, identifying the potential security violation and making it accessible with the audit record contents associated with the event(s) that generated the alarm provides the administration staff prompt alert messages, regardless if the person is logged into the system.Information Assurance OfficerECAR-1, ECAR-2, ECAR-3, ECSC-1
Checks: C-12664r2_chk

Review the firewall configuration to determine what alerts have been defined and how the notifications are performed. If the firewall doesn't have the proper alerts defined, this is a finding.

Fix: F-14108r2_fix

Configure the firewall to immediately notify authorized personnel of critical alerts.

b
The ISSO must ensure the message is displayed at the remote console if an administrator is already logged in, or when an administrator logs in if the alarm message has not been acknowledged.
Medium - V-14649 - SV-15275r2_rule
RMF Control
Severity
M
CCI
Version
NET0392
Vuln IDs
  • V-14649
Rule IDs
  • SV-15275r2_rule
By immediately displaying an alarm message, identifying the potential security violation and making it accessible with the audit record contents associated with the auditable event(s) that generated the alarm provides the administration staff prompt alert messages at their work areas.Information Assurance OfficerECAR-1, ECAR-2, ECAR-3, ECSC-1
Checks: C-12665r2_chk

Review the firewall configuration to determine what alerts have been defined and how the notifications are performed. The message must be displayed at the remote console if an administrator is already logged in, or when an administrator logs in if the alarm message has not been acknowledged. The firewall shall immediately display an alarm message, identifying the potential security violation and make accessible the audit record contents associated with the auditable event(s) that generated the alarm. This can also be accomplished by sending email alerts using an Exchange receipt. If alerts are not configured for notification to remote consoles, this is a finding.

Fix: F-14109r1_fix

Configure the firewall to immediately write an alarm message to the remote consoles.

a
The ISSO must ensure the alarm message identifying the potential security violation makes accessible the audit record contents associated with the event(s).
Low - V-14653 - SV-15279r2_rule
RMF Control
Severity
L
CCI
Version
NET0395
Vuln IDs
  • V-14653
Rule IDs
  • SV-15279r2_rule
The relevant audit information must be available to administrators. The firewall shall immediately display an alarm message, identifying the potential security violation and make accessible the audit record contents associated with the event(s) that generated the alarm.Information Assurance OfficerECAR-1, ECAR-2, ECAR-3, ECSC-1
Checks: C-12667r2_chk

Review the firewall configuration to determine what alerts have been defined and how the notifications are performed. The relevant audit information must be available to administrators. The message will not be scrolled off the screen due to other activities taking place (e.g., the Audit Administrator is running an audit report). If the device does not write violations to the console and make accessible the audit record contents, this is a finding.

Fix: F-14111r1_fix

Configure the firewall to write violations to the console and make accessible the audit record contents.

a
The ISSO must ensure an alert will remain written on the consoles until acknowledged by an administrator.
Low - V-14655 - SV-15281r2_rule
RMF Control
Severity
L
CCI
Version
NET0396
Vuln IDs
  • V-14655
Rule IDs
  • SV-15281r2_rule
Critical alerts require immediate response. Critical alerts must not roll off the screens. The requirements are necessary to ensure an administrator will be aware of the alerts or alarm. The intent is to ensure that if an administrator is physically at the remote workstation the message will remain displayed until they have acknowledged it.Information Assurance OfficerECAR-1, ECAR-2, ECAR-3, ECSC-1
Checks: C-12670r2_chk

Review the firewall configuration to determine what alerts have been defined and how the notifications are performed. Verify alerts generated will remain until acknowledged. If the device is not configured to send or retain notifications until acknowledgement, this is a finding.

Fix: F-14114r1_fix

Configure the firewall to send an alarm or retain an alert message until acknowledged.

a
The ISSO must ensure an acknowledgement message identifying a reference to the potential security violation is logged and it contains a notice that it has been acknowledged, the time of the acknowledgement and the user identifier that acknowledged the alarm, at the remote administrator session that received the alarm.
Low - V-14656 - SV-15282r2_rule
RMF Control
Severity
L
CCI
Version
NET0398
Vuln IDs
  • V-14656
Rule IDs
  • SV-15282r2_rule
Acknowledging the alert could be a single event, or different events. In addition, assurance is required that each administrator that received the alarm message also receives the acknowledgement message, which includes some form of reference to the alarm message, who acknowledged the message and when.Information Assurance OfficerECAR-1, ECAR-2, ECAR-3, ECSC-1
Checks: C-12671r2_chk

The firewall shall display an acknowledgement message identifying a reference to the potential security violation, a notice that it has been acknowledged, the time of the acknowledgement and the user identifier that acknowledged the alarm at the remote administrator sessions that received the alarm. Have the administrator verify these capabilities. If the notifications do not include the proper references, this is a finding.

Fix: F-14115r1_fix

Configure the firewall to send acknowledge messages to administrators, referencing the alarm, who acknowledged the alarm, and timestamps.

a
Network devices must be configured with rotating keys used for authenticating IGP peers that have a duration exceeding 180 days.
Low - V-14667 - SV-15301r3_rule
RMF Control
Severity
L
CCI
Version
NET0422
Vuln IDs
  • V-14667
Rule IDs
  • SV-15301r3_rule
If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Changing the keys frequently reduces the risk of them eventually being guessed. When configuring authentication for routing protocols that provide key chains, configure two rotating keys with overlapping expiration dates, both with 180-day expirations.Information Assurance OfficerIAKM-1, IAKM-2, IAKM-3
Checks: C-12696r5_chk

Review device configuration for key expirations of 180 days or less. If rotating keys are not configured to expire at 180 days or less, this is a finding.

Fix: F-14125r4_fix

Configure the device so rotating keys expire at 180 days or less.

b
The network element must authenticate all NTP messages received from NTP servers and peers.
Medium - V-14671 - SV-41500r1_rule
RMF Control
Severity
M
CCI
Version
NET0813
Vuln IDs
  • V-14671
Rule IDs
  • SV-41500r1_rule
Since NTP is used to ensure accurate log file timestamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. Two NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka “symmetric mode”). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client’s stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers. A hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device looses connectivity to it upstream NTP server, it will be able to choose time from one of its peers. The NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It’s not used to authenticate NTP clients because NTP servers don’t care about the authenticity of their clients, as they never accept any time from them. Information Assurance OfficerECSC-1
Checks: C-39979r1_chk

Review the device configuration and verify that it is authenticating the NTP messages received from the NTP server or peer. Authentication must be performed using either PKI (supported in NTP v4) or SHA-1 hashing algorithm. If SHA-1 is not supported by both the NTP client and server, then MD5 can be used. You should find a configuration similar to the example below: ntp server 10.1.0.5 key 1 source mgmt ntp server 10.1.0.8 key 1 source mgmt ntp authenticate ntp authentication-key 1 md5 ******** ntp trusted-key 1

Fix: F-14132r2_fix

Configure the device to authenticate all received NTP messages using either PKI (supported in NTP v4) or SHA-1 hashing algorithm.

b
The network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave, (FEC0::/10). Note that this consist of all addresses that begin with FEC, FED, FEE and FEF.
Medium - V-14693 - SV-15397r2_rule
RMF Control
Severity
M
CCI
Version
NET-IPV6-025
Vuln IDs
  • V-14693
Rule IDs
  • SV-15397r2_rule
As currently defined, site local addresses are ambiguous and can be present in multiple sites. The address itself does not contain any indication of the site to which it belongs. The use of site-local addresses has the potential to adversely affect network security through leaks, ambiguity and potential misrouting, as documented in section 2 of RFC3879. RFC3879 formally deprecates the IPv6 site-local unicast prefix defined in RFC3513, i.e., 1111111011 binary or FEC0::/10.Information Assurance OfficerECSC-1
Checks: C-12864r2_chk

Review the device configuration to ensure FEC0::/10 IP addresses are not defined. If FEC0::/10 IP addresses are defined, this is a finding.

Fix: F-14158r1_fix

Configure the device using authorized IP addresses.

b
The network device must not allow SSH Version 1 to be used for administrative access.
Medium - V-14717 - SV-15459r4_rule
RMF Control
Severity
M
CCI
Version
NET1647
Vuln IDs
  • V-14717
Rule IDs
  • SV-15459r4_rule
SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to attacks, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1.Information Assurance OfficerECSC-1
Checks: C-12924r8_chk

Review the configuration and verify SSH Version 1 is not being used for administrative access. If the device is using an SSHv1 session, this is a finding.

Fix: F-14184r5_fix

Configure the network device to use SSH version 2.

c
Teredo packets must be blocked inbound to the enclave and outbound from the enclave.
High - V-15294 - SV-16075r5_rule
RMF Control
Severity
H
CCI
Version
NET-TUNL-020
Vuln IDs
  • V-15294
Rule IDs
  • SV-16075r5_rule
Teredo (RFC 4380) is a tunneling mechanism that allows computers to encapsulate IPv6 packets inside IPv4 to traverse IPv4-only networks. It relies on UDP to allow the tunnel to traverse NAT devices. Teredo uses UDP port 3544 to communicate with Teredo relays which access the packet, decapsulated the packet, and route it to the appropriate IPv6 network. While Teredo was proposed by Microsoft, Linux versions do exist. By allowing Teredo tunneling mechanism to be uncontrolled, it can pass malicious IPv6 packets over IPv4 without further inspection of the packet by router and firewall ACLs.Information Assurance OfficerECSC-1
Checks: C-13694r7_chk

Inspect the network device configuration to validate Teredo packets, UDP port 3544 is blocked both inbound to the enclave and outbound from the enclave. This requirement must be administered on either the perimeter router or firewall. If Teredo is not blocked one of these devices, this is a finding.

Fix: F-14736r5_fix

Configure either the perimeter router or firewall to block UDP port 3544 traffic inbound and outbound.

b
Interfaces supporting IPv4 in NAT-PT Architecture must not receive IPv6 traffic.
Medium - V-15296 - SV-16078r2_rule
RMF Control
Severity
M
CCI
Version
NET-IPV6-047
Vuln IDs
  • V-15296
Rule IDs
  • SV-16078r2_rule
Network Address Translation with Protocol Translation (NAT-PT), defined in [RFC2766], is a service that can be used to translate data sent between IP-heterogeneous nodes. NAT-PT translates IPv4 datagrams into a semantically equivalent IPv6 datagram or vice versa. For this service to work it has to be located in the connection point between the IPv4 network and the IPv6 network. The PT-part of the NAT-PT handles the interpretation and translation of the semantically equivalent IP header, either from IPv4 to IPv6 or from IPv6 to IPv4. Like NAT, NATPT also uses a pool of addresses which it dynamically assigns to the translated datagrams. The NAT-PT architecture is not one of the preferred DoD IPv6 transition paradigms due to the deprecation of NAT-PT within the DoD community. However, as described in the "DoD IPv6 Guidance for Information Assurance (IA) Milestone Objective 3 (MO3) Requirements, some services/agencies may choose to implement this transition mechanism within an enclave. The following sub-sections provide guidelines for the use of NAT-PT within a controlled enclave. In addition to the single point of failure, the reduced performance of an application level gateway, coupled with limitations on the kinds of applications that work, decreases the overall value and utility of the network. NAT-PT also inhibits the ability to deploy security at the IP layer.Information Assurance OfficerECSC-1
Checks: C-13697r3_chk

Review network diagram in the STIG and ensure the architecture is designed correctly. The interface facing the IPv4 LAN network must not receive IPv6 traffic. This can be accomplished by not having IPv6 on the interface supporting the IPv4 network. In addition a filter can be added to deny IPv6 at this interface. If interfaces supporting IPv4 in NAT-PT receive IPv6 traffic, this is a finding.

Fix: F-14738r2_fix

This can be accomplished by not having IPv6 enabled on the interface supporting the IPv4 network. In addition a filter can be added to deny IPv6 at the interface.

b
Network devices must use two or more authentication servers for the purpose of granting administrative access.
Medium - V-15432 - SV-16259r4_rule
RMF Control
Severity
M
CCI
Version
NET0433
Vuln IDs
  • V-15432
Rule IDs
  • SV-16259r4_rule
The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ or RADIUS, the administrators can easily add or remove user accounts, add or remove command authorizations, and maintain a log of user activity. The use of an authentication server provides the capability to assign router administrators to tiered groups that contain their privilege level that is used for authorization of specific commands. For example, user mode would be authorized for all authenticated administrators while configuration or edit mode should only be granted to those administrators that are permitted to implement router configuration changes.Information Assurance OfficerIAIA-1
Checks: C-14439r6_chk

Verify an authentication server is required to access the device and that there are two or more authentication servers defined. If the device is not configured for two separate authentication servers, this is a finding.

Fix: F-15096r3_fix

Configure the device to use two separate authentication servers.

c
The emergency account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online.
High - V-15434 - SV-16261r4_rule
RMF Control
Severity
H
CCI
Version
NET0441
Vuln IDs
  • V-15434
Rule IDs
  • SV-16261r4_rule
The emergency account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate authorization level to perform necessary administrative functions during this time.Information Assurance OfficerECSC-1
Checks: C-14441r5_chk

Review the emergency account configured on the network devices and verify that it has been assigned to a privilege level that will enable the administrator to perform necessary administrative functions when the authentication server is not online. If the emergency account is configured for more access than needed to troubleshoot issues, this is a finding.

Fix: F-15098r6_fix

Assign a privilege level to the emergency account to allow the administrator to perform necessary administrative functions when the authentication server is not online.

b
Management traffic is not restricted to only the authorized management packets based on destination and source IP address.
Medium - V-17754 - SV-19320r1_rule
RMF Control
Severity
M
CCI
Version
NET1807
Vuln IDs
  • V-17754
Rule IDs
  • SV-19320r1_rule
The Out-of-Band Management (OOBM) network is an IP network used exclusively for the transport of OAM&P data from the network being managed to the OSS components located at the NOC. Its design provides connectivity to each managed network element enabling network management traffic to flow between the managed NEs and the NOC. This allows the use of paths separate from those used by the network being managed. Traffic from the managed network to the management network and vice-versa must be secured via IPSec encapsulation. Information Assurance OfficerECNK-1
Checks: C-20269r1_chk

Where IPSec technology is deployed to connect the OOBM gateway routers or firewall, the traffic entering the tunnels must be restricted to only the authorized management packets based on destination and source IP address from the address block used for the management network. Verify that all traffic from the managed network to the management network and vice-versa is secured via IPSec encapsulation. In the configuration examples, 10.2.2.0/24 is the management network at the NOC and 10.1.1.0/24 is the management address block used at the network being managed (i.e., the enclave). When the AS PIC receives traffic on the inside interface associated with a service set, the AS PIC applies the configured Layer 3 services and then forwards the packet back to the router through the outside interface. Likewise, when the AS PIC receives traffic on the outside interface associated with a service set, it forwards the packet back to the router through the inside interface after applying the configured Layer 3 services. hostname VPN-Gateway1 ! interface Ethernet0/0 nameif Outside security-level 0 ip address 19.16.1.254 255.255.255.252 ! interface Ethernet0/1 nameif Inside security-level 100 ip address 10.1.1.1 255.255.255.0 ! isakmp policy 10 authentication pre-share isakmp policy 10 encryption 3des isakmp policy 10 hash sha isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto map Outside_map ipsec-isakmp crypto map Outside_map 20 match address 101 crypto map Outside_map 20 set peer 19.16.2.254 crypto map Outside_map 20 set transform-set ESP-3DES-SHA crypto map Outside_map interface Outside ! isakmp key ***** 19.16.2.254 netmask 255.255.255.255 isakmp enable Outside ! access-list 101 permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0 sysopt connection permit-ipsec Note: Access lists can be defined for PIX/ASA using the familiar IOS software ACL format. However, one important difference exists between the PIX/ASA and IOS ACL formats: PIXs use real subnet masks (a 1 bit matches, and a 0 bit ignores), whereas IOS platforms use a wildcard mask (a 0 bit matches, and a 1 bit ignores).

Fix: F-17652r2_fix

Configure filters based on source and destination IP address to restrict only authorized management traffic into IPSec tunnels used for transiting management data.

b
Gateway configuration at the remote VPN end-point is a not a mirror of the local gateway
Medium - V-17814 - SV-19063r1_rule
RMF Control
Severity
M
CCI
Version
NET1808
Vuln IDs
  • V-17814
Rule IDs
  • SV-19063r1_rule
The IPSec tunnel end points may be configured on the OOBM gateway routers connecting the managed network and the NOC. They may also be configured on a firewall or VPN concentrator located behind the gateway router. In either case, the crypto access-list used to identify the traffic to be protected must be a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-19020r1_chk

Verify the configuration at the remote VPN end-point is a mirror configuration as that reviewed for the local end-point.

Fix: F-17724r1_fix

Configure he crypto access-list used to identify the traffic to be protected so that it is a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.

b
The network element’s OOBM interface must be configured with an OOBM network address.
Medium - V-17821 - SV-20207r2_rule
RMF Control
Severity
M
CCI
Version
NET0991
Vuln IDs
  • V-17821
Rule IDs
  • SV-20207r2_rule
The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-20307r2_chk

The managed network element’s OOBM interface must be configured with an IP address from the address space belonging to the OOBM network. After determining which interface is connected to the OOBM access switch, review the managed device configuration and verify that the interface has been assigned an address from the local management address block. In this example, that is 10.1.1.0/24. interface Ethernet0/2 nameif Management security-level 90 ip address 10.1.1.23 255.255.255.0 management-only The 5510 and higher ASA appliance includes a dedicated management interface called Management 0/0, which is meant to support traffic to the security appliance. The management interface is a Fast Ethernet interface and is specified as management0/0. However, you can configure any interface to be a management-only interface using the management-only command. Furthermore, you can disable management-only mode for the Management 0/0 interface so that traffic can pass through just like any other interface. Regardless, of which interface is being used as the management interface, verify that the management-only command is specified.

Fix: F-19267r1_fix

Configure the managed network element’s OOBM interface with an IP address from the address space belonging to the OOBM network.

b
The network elements management interface must be configured with both an ingress and egress ACL.
Medium - V-17822 - SV-19333r2_rule
RMF Control
Severity
M
CCI
Version
NET0992
Vuln IDs
  • V-17822
Rule IDs
  • SV-19333r2_rule
The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so management traffic does not leak into the managed network and production traffic does not leak into the management network. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-20312r2_chk

Determine which interface is used as the management interface and verify that it has a higher security level than the external or DMZ interface. interface Ethernet0/2 nameif Management security-level 90 ip address 10.1.1.23 255.255.255.0 management-only interface GigabitEthernet0 nameif outside security-level 0 ip address 172.20.2.1 255.255.255.0 interface GigabitEthernet1 nameif inside security-level 100 ip address 192.168.1.0 255.255.255.0 By default, traffic from an interface with a lower security level can’t egress an interface with a higher security level. Traffic is allowed to flow from a higher-security interface to a lower-security interface. Hence, if the interface to the managed network is at a higher security level, traffic originated from this network could leak into the management network. Verify that there is an ACL bound to the management network interface to ensure traffic from a higher security level interface such as the private network (i.e. 192.168.1.0/24) is blocked. access-group TO_MGMTNET in interface Management access-list TO_MGMTNET deny ip 192.168.1.0 255.255.255.0 any Note: Access lists can be defined for PIX/ASA using the familiar IOS software ACL format. However, one important difference exists between the PIX/ASA and IOS ACL formats: PIXs use real subnet masks (a 1 bit matches, and a 0 bit ignores), whereas IOS platforms use a wildcard mask (a 0 bit matches, and a 1 bit ignores).

Fix: F-17737r2_fix

If the management interface is a routed interface, it must be configured with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.

a
The network element’s management interface is not configured as passive for the IGP instance deployed in the managed network.
Low - V-17823 - SV-19336r2_rule
RMF Control
Severity
L
CCI
Version
NET0993
Vuln IDs
  • V-17823
Rule IDs
  • SV-19336r2_rule
The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so management traffic, both data plane and control plane, does not leak into the managed network and production traffic does not leak into the management network. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-20315r3_chk

If the managed network element is a Cisco PIX or ASA firewall with an IGP enabled, review the configuration to verify the management interface is configured as passive for the IGP instance for the managed network. In the example below, OSPF is only enabled on the interface connecting to the internal network. interface Ethernet0/2 nameif Management security-level 90 ip address 10.1.1.23 255.255.255.0 management-only interface GigabitEthernet0 nameif outside security-level 0 ip address 172.20.2.1 255.255.255.0 interface GigabitEthernet1 nameif inside security-level 100 ip address 192.168.1.0 255.255.255.0 ! router ospf 1 network 192.168.1.0 255.255.255.0 area 1

Fix: F-17738r2_fix

Configure the management interface as passive for the IGP instance configured for the managed network. Depending on the platform and routing protocol, this may simply require that the interface or its IP address is not included in the IGP configuration.

b
A firewall located behind the premise router must be configured to block all outbound management traffic.
Medium - V-17830 - SV-19319r1_rule
RMF Control
Severity
M
CCI
Version
NET1001
Vuln IDs
  • V-17830
Rule IDs
  • SV-19319r1_rule
The management network must still have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the managed network’s premise equipment. It there is a firewall located behind the premise router, then all management traffic should be blocked at that point—with the exception of management traffic destined to premise equipment.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-20268r1_chk

With the exception of management traffic destined to premise equipment, a firewall located behind the premise router must be configured to block all outbound management traffic. Step 1: Review the firewall configuration to verify that it is blocking all outbound management traffic as shown in the example configuration below: Cisco PIX interface GigabitEthernet0 nameif outside security-level 0 ip address 172.20.3.2 255.255.255.240 interface GigabitEthernet1 nameif inside security-level 100 ip address 192.168.1.2 255.255.255.0 interface Ethernet0/2 nameif DMZ security-level 50 ip address 172.20.2.1 255.255.255.0 By default, traffic from an interface with a lower security level can’t egress an interface with a higher security level. However, traffic is allowed to flow from a higher-security interface to a lower-security interface. Hence, if the interface to the managed network is at a higher security level than the interface connecting the WAN backbone (i.e. NIPRNet) or the Internet, management traffic originated from this network could leak out. Verify that there is an egress ACL bound to the outside interface to ensure management traffic from the private network or DMZ is blocked. access-group outside_out interface outside access-list outside_out deny ip any 10.0.0.0 255.255.255.0 log access-list outside_out permit ip any any Note: Access lists can be defined for PIX/ASA using the familiar IOS software ACL format. However, one important difference exists between the PIX/ASA and IOS ACL formats: PIXs use real subnet masks (a 1 bit matches, and a 0 bit ignores), whereas IOS platforms use a wildcard mask (a 0 bit matches, and a 1 bit ignores). Step 2: Verify that routing has been configured to ensure all traffic destined to the management network is forwarded to the next hop router connected to its inside interface. route outside 0.0.0.0 0.0.0.0 172.20.3.1 1 route inside 10.0.0.0 255.0.0.0 192.168.1.1 1 route inside 192.168.2.0 255.255.255.0 192.168.1.1 1

Fix: F-17747r2_fix

With the exception of management traffic destined to perimeter equipment, a firewall located behind the premise router must be configured to block all outbound management traffic.

b
Traffic entering the tunnels is not restricted to only the authorized management packets based on destination address.
Medium - V-17835 - SV-19312r1_rule
RMF Control
Severity
M
CCI
Version
NET1006
Vuln IDs
  • V-17835
Rule IDs
  • SV-19312r1_rule
Similar to the OOBM model, when the production network is managed in-band, the management network could also be housed at a NOC that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity as well as connectivity between the NOC and the managed networks’ premise routers would be enabled using either provisioned circuits or VPN technologies such as IPSec tunnels or MPLS VPN services. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-20261r1_chk

Verify that all traffic from the managed network to the management network and vice-versa is secured via IPSec encapsulation. In the configuration examples, 10.2.2.0/24 is the management network at the NOC and 192.168.1.0/24 is address space used at the network being managed (i.e., the enclave). When the AS PIC receives traffic on the inside interface associated with a service set, the AS PIC applies the configured Layer 3 services and then forwards the packet back to the router through the outside interface. Likewise, when the AS PIC receives traffic on the outside interface associated with a service set, it forwards the packet back to the router through the inside interface after applying the configured Layer 3 services. hostname VPN-Gateway1 ! interface Ethernet0/0 nameif Outside security-level 0 ip address 19.16.1.254 255.255.255.252 ! interface Ethernet0/1 nameif Inside security-level 100 ip address 192.168.1.15 255.255.255.0 ! isakmp policy 10 authentication pre-share isakmp policy 10 encryption 3des isakmp policy 10 hash sha isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto map Outside_map ipsec-isakmp crypto map Outside_map 20 match address 101 crypto map Outside_map 20 set peer 19.16.2.254 crypto map Outside_map 20 set transform-set ESP-3DES-SHA crypto map Outside_map interface Outside ! isakmp key ***** 19.16.2.254 netmask 255.255.255.255 isakmp enable Outside ! access-list 101 permit ip any 10.2.2.0 255.255.255.0 sysopt connection permit-ipsec Note: Access lists can be defined for PIX/ASA using the familiar IOS software ACL format. However, one important difference exists between the PIX/ASA and IOS ACL formats: PIXs use real subnet masks (a 1 bit matches, and a 0 bit ignores), whereas IOS platforms use a wildcard mask (a 0 bit matches, and a 1 bit ignores).

Fix: F-17752r1_fix

Where IPSec technology is deployed to connect the managed network to the NOC, it is imperative that the traffic entering the tunnels is restricted to only the authorized management packets based on destination address.

b
Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.
Medium - V-18522 - SV-20061r2_rule
RMF Control
Severity
M
CCI
Version
NET-SRVFRM-003
Vuln IDs
  • V-18522
Rule IDs
  • SV-20061r2_rule
Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs provisioned for servers. Without proper access control of traffic entering or leaving the server VLAN, potential threats such as a denial of service, data corruption, or theft could occur, resulting in the inability to complete mission requirements by authorized users.Information Assurance OfficerECND-1, ECSC-1
Checks: C-21297r5_chk

Review the device configuration to validate an ACL with a deny-by-default security posture has been implemented on the server VLAN interface.

Fix: F-19125r4_fix

Configure an ACL to protect the server VLAN interface. The ACL must be in a deny-by-default security posture.

b
The IAO will ensure the Server Farm infrastructure is secured by ACLs on VLAN interfaces that restrict data originating from one server farm segment destined to another server farm segment.
Medium - V-18523 - SV-20062r1_rule
RMF Control
Severity
M
CCI
Version
NET-SRVFRM-004
Vuln IDs
  • V-18523
Rule IDs
  • SV-20062r1_rule
ACLs on VLAN interfaces do not protect against compromised servers. The Server farm vlans need to protect the servers located on one subnet from servers located on another subnet. Protecting a client’s data from other clients is necessary and can be accomplished using VLAN provisioning, layer 3 filtering and content filtering at the Server Farm entry point. Restricting protocol, source and destination traffic via filters is an option; however additional security practices such as content filtering are required. The Server farm private vlans need to protect the servers located on one subnet from servers located on another subnet.Information Assurance OfficerECND-1
Checks: C-21298r1_chk

Review the firewall protecting the server farm. Vlan configurations should have a filter that secures the servers located on the vlan segment. Identify the source ip addresses that have access to the servers and verify the privilege intended with the SA. The filter should be in a deny by default posture. If the filter is not defined on the firewall and the architecture contains a layer 3 switch between the firewall and the server, than review the VLAN definition on the L3 switch.

Fix: F-19126r1_fix

Review the filter and ensure access from other server segments is denied unless necessary for application operation. The intent of the policy should be to protect servers from a server that has been compromised by an intruder.

b
The IAO will ensure the Server Farm VLANs are protected by severely restricting the actions the hosts can perform on the servers by firewall content filtering.
Medium - V-18525 - SV-20064r1_rule
RMF Control
Severity
M
CCI
Version
NET-SRVFRM-005
Vuln IDs
  • V-18525
Rule IDs
  • SV-20064r1_rule
Most current applications are deployed as a multi-tier architecture. The multi-tier model uses separate server machines to provide the different functions of presentation, business logic, and database. Multi-tier server farms provide added security because a compromised web server does not provide direct access to the application itself or to the database. The multi-tier separation is accomplished in several architectures, by a layer 2 switch, by a layer3 switch/router or by a firewall located at the server farm. Using the firewall implementation is the most secure method and is the only approved DoD architecture. Firewalls get packets from VLAN-supporting switches complete with 802.1Q tags in their headers. What the VLAN-aware firewall can do is extract the tags and use the information within the tags to make policy-based security decisions. Information Assurance OfficerEBBD-1
Checks: C-21300r1_chk

Identify the VLAN IP subnet and determine if the subnet passes content inspect by a firewall capable on content inspection.

Fix: F-19128r1_fix

Configure the firewall to inspect traffic content to and from the server farm.

b
IPv6 6-to-4 addresses with a prefix of 2002::/16 must be filtered at the perimeter.
Medium - V-18608 - SV-20160r2_rule
RMF Control
Severity
M
CCI
Version
NET-IPV6-024
Vuln IDs
  • V-18608
Rule IDs
  • SV-20160r2_rule
"6-to-4" is a tunneling IPv6 transition mechanism [RFC 3056]. The guidance is the default case, which assumes that 6-to-4 is not being used as an IPv6 transition mechanism. If 6-to-4 is implemented, reference addition 6-to-4 guidance defined in the STIG. Drop all inbound IPv6 packets containing a source address of type 2002::/16. This assumes the 6-to-4 transition mechanism is not being used. Drop all inbound IPv6 packets containing a destination address of type 2002::/16. This assumes the 6-to-4 transition mechanism is not being used.Information Assurance OfficerECSC-1
Checks: C-22275r2_chk

Review the device configuration to ensure filters are in place to restrict the IP addresses explicitly or implicitly. Verify that ingress and egress ACLs for IPv6 have been defined to deny 6-to-4 tunnel addresses and log all violations. source type: 2002::/16 If filters are not in place to deny 6-to-4 tunnel addresses, this is a finding.

Fix: F-19237r2_fix

Configure the device using filters to restrict IP addresses that contain any 6-to-4 addresses.

b
IPv6 Jumbo Payload hop by hop header must be blocked.
Medium - V-18815 - SV-20551r2_rule
RMF Control
Severity
M
CCI
Version
NET-IPV6-035
Vuln IDs
  • V-18815
Rule IDs
  • SV-20551r2_rule
The IPv6 Jumbo Payload allows IP packets to be larger than 65,535 bytes. This feature is only useful on very specialized high performance systems (e.g. super computers). Common place link layer technologies do not support these payload sizes and special link layer designs would be necessary. This header should be dropped unless the system is specifically designed to use very large payloads, since it only serves as an opportunity to break implementations.Information Assurance OfficerECSC-1
Checks: C-22525r4_chk

Review the device configuration to determine filters drop all inbound and/or outbound IPv6 packets containing a hop-by-hop option of option type 0xC2. If IPv6 Jumbo Payloads are not dropped, this is a finding. Alternatively, if the system is specifically designed to use very large payloads and its use is documented in architecture design documents, than this is not a finding.

Fix: F-19475r1_fix

Configure the firewall to drop all inbound and/or outbound IPv6 packets containing a hop-by-hop option of option type 0xC2.

a
The network element must use two or more NTP servers to synchronize time.
Low - V-23747 - SV-41499r1_rule
RMF Control
Severity
L
CCI
Version
NET0812
Vuln IDs
  • V-23747
Rule IDs
  • SV-41499r1_rule
Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If you cannot successfully compare logs between each of your routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.Information Assurance OfficerSystem AdministratorECSC-1
Checks: C-39978r1_chk

Review the firewall configurations and verify that two or more NTP servers have been defined similar to the following example: ntp server 10.1.0.5 key 1 source mgmt ntp server 10.1.0.8 key 1 source mgmt ntp authenticate ntp authentication-key 1 md5 ******** ntp trusted-key 1

Fix: F-3044r2_fix

Configure the device to use two separate NTP servers.

c
The IAO will ensure that the router or firewall software has been upgraded to mitigate the risk of DNS cache poisoning attack caused by a flawed PAT implementation using a predictable source port allocation method for DNS query traffic.
High - V-25037 - SV-30841r1_rule
RMF Control
Severity
H
CCI
Version
NET1970
Vuln IDs
  • V-25037
Rule IDs
  • SV-30841r1_rule
DNS cache poisoning is an attack technique that allows an attacker to introduce forged DNS information into the cache of a caching name server. There are inherent deficiencies in the DNS protocol and defects in implementations that facilitate DNS cache poisoning. Name servers vulnerable to cache poisoning attacks are due to their use of insufficiently randomized transaction IDs and UDP source ports in the DNS queries that they produce, which may allow an attacker to more easily forge DNS answers that can poison DNS caches. To exploit these vulnerabilities an attacker must be able to cause a vulnerable DNS server to perform recursive DNS queries. Therefore, DNS servers that are only authoritative, or servers where recursion is not allowed, are not affected. The DNS protocol specification includes a transaction ID field of 16 bits. If the specification is correctly implemented and the transaction ID is randomly selected with a strong random number generator, an attacker will require, on average, 32,768 attempts to successfully predict the ID. Some flawed implementations may use a smaller number of bits for this transaction ID, meaning that fewer attempts will be needed. Furthermore, there are known errors with the randomness of transaction IDs that are generated by a number of implementations. Some current implementations allocate an arbitrary source port at startup (and sometimes selected at random) and reuse this source port for all outgoing queries. With other implementations, the source port for outgoing queries is fixed at the traditional assigned DNS server UDP port number 53. Because attacks against these vulnerabilities all rely on an attacker's ability to predict, the implementation of per-query source port randomization in the server presents a practical mitigation against these attacks within the boundaries of the current protocol specification. Randomized source ports can be used to gain approximately 16 additional bits of randomness in the data that an attacker must guess. Randomizing the ports adds a significant amount of attack resiliency. Routers, firewalls, proxies, and other gateway devices that perform NAT—more specifically Port Address Translation (PAT)—often rewrite source ports in order to track connection state. A flawed implementation of a PAT device using a predictiable source port allocation method can reduce any effectiveness of source port randomization implemented by name servers and stub resolvers. Henceforth, it is imperative that the router or firewall software has been upgraded or patched to reduce an attacker’s opportunity for launching a DNS cache poisoning attack. Note: Regular NAT (allocating one public IP address for each private IP address) is not affected by this problem because it only rewrites layer 3 information and does not modify layer 4 header information of packets traversing the NAT device. Information Assurance OfficerVIVM-1
Checks: C-31263r1_chk

Verify that the software implemented on the router or firewall has been updated to a release that mitigates the risk of a DNS cache poisoning attack. A number of vendors have released patches to implement source port randomization. This change significantly reduces the practicality of cache poisoning attacks. See the Systems Affected section at http://www.kb.cert.org/vuls/id/800113 for additional details for specific products not listed below. The following BlueCoat products are vulnerable: Proxy SG: Fixed in 4.2.8.6 or 5.2.4.3 and later. Director: Fixed in: 4.2.2.4 or 5.2.2.5 and later. Proxy RA: Fixed in 2.3.2.1 and later. The following Secure Computing products are vulnerable: Sidewinder G2 6.1 .0.01 Sidewinder G2 6.1 .0.02 Sidewinder 5.0 Sidewinder 5.0 .0.01 Sidewinder 5.0 .0.02 Sidewinder 5.0 .0.03 Sidewinder 5.0 .0.04 Sidewinder 5.1 Sidewinder 5.1 .0.01 Sidewinder 5.1 .0.02 Sidewinder 5.1 .1 Sidewinder 5.1 .1.01 Sidewinder 5.2 Sidewinder 5.2 .0.01 Sidewinder 5.2 .0.02 Sidewinder 5.2 .0.03 Sidewinder 5.2 .0.04 Sidewinder 5.2 .1 Sidewinder 5.2 .1.02 Sidewinder 5.2.1 .10 Sidewinder Software 5.0 Sidewinder Software 5.0 .0.01 Sidewinder Software 5.0 .0.02 Sidewinder Software 5.0 .0.03 Sidewinder Software 5.0 .0.04 Sidewinder Software 5.1 Sidewinder Software 5.1 .0.01 Sidewinder Software 5.1 .0.02 Sidewinder Software 5.1 .1 Sidewinder Software 5.1 .1.01 Sidewinder Software 5.2 Sidewinder Software 5.2 .0.01 Sidewinder Software 5.2 .0.02 Sidewinder Software 5.2 .0.03 Sidewinder Software 5.2 .0.04 Sidewinder Software 5.2 .1 Sidewinder Software 5.2 .1.02 CyberGuard Classic CyberGuard TSP See Secure Computing Knowledgebase article 11446 for the resolution to updates to these vulnerable products. The following Juniper Networks ScreenOS firewall versions are vulnerable. ScreenOS 5.1 ScreenOS 5.2 The following Cisco PIX/ASA releases are vulnerable: 6.3(5) and earlier. Fixed with 6.3(5.144) and later 7.0 Fixed with 7.0(8.1) 7.1 Fixed with 7.1(2.74) 7.2 Fixed with 7.2(4.9) 8.0 Fixed with 8.0(3.32) 8.1 Fixed with 8.1(1.8) , 8.1(1.100), and 8.1(101.4) 8.2 Fixed with 8.2(0.140)

Fix: F-27729r1_fix

Update the OS to the release that mitigates the risk of a DNS cache poisoning attack

a
Network device logs must be timestamped.
Low - V-25890 - SV-32503r2_rule
RMF Control
Severity
L
CCI
Version
NET1288
Vuln IDs
  • V-25890
Rule IDs
  • SV-32503r2_rule
Device logs can be used for forensic analysis in support of incident as well as to aid with normal traffic analysis. It can take numerous days to recover from a firewall outage when a proper backup scheme is not used.Information Assurance OfficerECSC-1, ECTB-1
Checks: C-32808r4_chk

Review the device configuration to validate timestamps are configured for logging. If timestamps are not configured for logging purposes, this is a finding.

Fix: F-28925r3_fix

Configure the network device to include timestamps on all device logs.

a
Network device logs must include source IP, destination IP, port, protocol used and action taken.
Low - V-25891 - SV-32504r2_rule
RMF Control
Severity
L
CCI
Version
NET1289
Vuln IDs
  • V-25891
Rule IDs
  • SV-32504r2_rule
The network device logs can be used for forensic analysis in support of incident as well as to aid with normal traffic analysis.Information Assurance OfficerECSC-1, ECTB-1
Checks: C-32809r3_chk

Review the active logs and verify the source IP, destination IP, port, protocol used and action taken are recorded fields in the event record. If logs do not include the source IP, destination IP, port, or protocol, this is a finding.

Fix: F-28929r1_fix

Ensure the firewall logs are receiving source IP, destination IP, port, protocol used and action taken.

b
A service or feature that calls home to the vendor must be disabled.
Medium - V-28784 - SV-38003r2_rule
RMF Control
Severity
M
CCI
Version
NET0405
Vuln IDs
  • V-28784
Rule IDs
  • SV-38003r2_rule
Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.Information Assurance OfficerNetwork Security OfficerECSC-1
Checks: C-37332r1_chk

Verify the call home service or feature is disabled on the device. On a Cisco product, you will not see the call-home service in the running config unless it's enabled.

Fix: F-32568r1_fix

Configure the network device to disable the call home service or feature. The command below will disable the call-home service on a Cisco device. Example: hostname(config)# no service call-home

b
The IAO must ensure firewalls deployed in an IPv6 enclave meet the requirements defined by DITO and NSA milestone objective 3 guidance.
Medium - V-30638 - SV-40424r2_rule
RMF Control
Severity
M
CCI
Version
NET-IPV6-005
Vuln IDs
  • V-30638
Rule IDs
  • SV-40424r2_rule
1) Drop IPv6 Undetectable protocol/port (May be an intrinsic FW feature.) - IPv6 allows an unlimited number of extension headers to be applied to a packet. A FW may not be able to locate the layer 4 protocol and port values if too many extension headers exhaust its resources. As a minimum, a FW must be able to drop any packet for which it cannot identify the layer 4 protocol and ports (if applicable). The security policy would be subverted if these packets were allowed to pass through a FW. If the FW cannot traverse through extension headers at all, it must drop packets using any extension header. This measure will disable a large amount of IPv6’s functionality and should only be used if the Primary guidance cannot be implemented. 2) Drop IPv6 Type 0 Routing Header - The IPv6 Type 0 Routing Header (extension header) is functionally equivalent to the IPv4 loose source routing header option, which is typically blocked for security reasons. The Type 0 Routing Header is dangerous because it allows attackers to spoof source addresses and get traffic in response (rather than to the real owner of the address). Secondly, a packet with an allowed destination address could be sent through a FW only to bounce to a different (disallowed) node once inside using the Routing Header functionality. If the Type 0 Routing Header must be used, it must be used in conjunction with either the IPSec AH or the IPSec Encapsulation Security Payload (ESP) headers. If the FW cannot distinguish the type field of a routing header, it should be configured to drop all routing headers. Note that Mobile IP is disabled without the Type 2 Routing Header. Although deprecated by a recent RFC, there may be existing implementations that still recognize this header. 3) Drop Undefined IPv6 Header Extensions/Protocol Values (May be an intrinsic FW feature.) - Undefined IPv6 header extensions means that the Next Header type is not registered with Internet Assigned Numbers Authority (IANA). The header extension is the same as the protocol value, and should be dropped. Drop all undefined extension headers/protocol values. 4) Drop at least one fragment of any inbound fragmented packet for which the complete data set for filtering to include protocol/port values cannot be determined.(May be an intrinsic FW feature) - A FW must be able to properly enforce its filtering policy upon fragmented packets. This requires that the FW be able to find the complete set of header data including extension headers and the upper layer protocol/port values. It also requires that the packet not be susceptible to fragment overlap attacks. Fragment overlaps are a more serious problem in IPv6 than in IPv4 because the presence of extension headers can push the upper layer protocol/port information outward (toward packet boundaries) making it much harder to protect. How a FW achieves these requirements is not important as long as both aspects are met. The wording “drop at least one fragment” used in the actions below is a statement of the bare minimum action to secure a packet, and is chosen to allow FW venders flexibility in achieving it. Refer to Firewall Design Considerations for IPv6 section 3.6 for extensive detail on this topic. https://www.us.army.mil/suite/doc/10209656 5) Drop all inbound IPv6 packets containing more than one Fragmentation Header within an IP header chain. (May be an intrinsic FW feature) - Nested fragmentation is an unnecessary and unwanted IPv6 condition that is not forbidden by the specifications. It occurs when an IP header chain contains more than one Fragmentation Header implying that a fragment has been fragmented. In the specification, the phrase “IP header chain” rather than “packet” is used, because a tunneled packet has more than one IP header chain and each chain can have a Fragment Header (this case is not nested fragmentation). Nested fragmentation is a new phenomenon with IPv6. It is not possible in IPv4, because the fragmentation fields are part of the main header and are modified in the event of a secondary fragmentation event. Nested fragmentation in IPv6 should be dropped by FWs since internal nodes that process the fragmentation may or may not be equipped to handle this unexpected case. These nodes may crash or behave in some unpredictable manner.Information Assurance OfficerDCDS-1, EBBD-1
Checks: C-39273r2_chk

Drop all inbound IPv6 packets for which the layer 4 protocol and ports (if applicable) cannot be located. Drop all inbound IPv6 packets with a Type 0 Routing Header unless those packets also contain an IPSec AH or IPSec ESP header. Drop all inbound IPv6 packets containing undefined header extensions/protocol values. Drop at least one fragment of any inbound fragmented packet for which the complete data set for filtering to include protocol/port values cannot be determined. Drop all inbound IPv6 packets containing more than one Fragmentation Header within an IP header chain.

Fix: F-34380r1_fix

Identify the firewall capabilities to ensure they support the DITO requirements prior to procurement. Review current alternatives defined in the MO3 guidance for mitigation.