WMAN Access Point Security Technical Implementation Guide (STIG)

Compare

Select any two versions of this STIG to compare the individual requirements

View

Select any old version/release of this STIG to view the previous requirements

Vuln ID:
V-3012
Rule ID:
SV-3012r4_rule
Group ID:
Network element is not password protected.
Version:
NET0230
CCI:
Severity:
High
Description:
Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network device. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network device providing opportunity for intruders to compromise resources within the network infrastructure.Information Assurance OfficerECSC-1, IAIA-1, IAIA-2
Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network device. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network device providing opportunity for intruders to compromise resources within the network infrastructure.Information Assurance Officer
Check:
Review the network devices configuration to determine if administrative access to the device requires some form of authentication--at a minimum a password is required. If passwords aren't used to administrative access to the device, this is a finding.
Review the network devices configuration to determine if administrative access to the device requires some form of authentication--at a minimum a password is required. If passwords aren't used to administrative access to the device, this is a finding.
Fix:
Configure the network devices so it will require a password to gain administrative access to the device.
Configure the network devices so it will require a password to gain administrative access to the device.
Vuln ID:
V-3013
Rule ID:
SV-3013r4_rule
Group ID:
Login banner is non-existent or not DOD-approved.
Version:
NET0340
CCI:
Severity:
Medium
Description:
All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required logon warning banner prior to logon attempts will limit DoD's ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA's ability to monitor the device's usage is limited unless a proper warning banner is displayed. DoD CIO has issued new, mandatory policy standardizing the wording of "notice and consent" banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, "Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement", dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.Information Assurance OfficerECWM-1
All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required logon warning banner prior to logon attempts will limit DoD's ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA's ability to monitor the device's usage is limited unless a proper warning banner is displayed. DoD CIO has issued new, mandatory policy standardizing the wording of "notice and consent" banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, "Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement", dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.Information Assurance Officer
Check:
Review the device configuration or request that the administrator logon to the device and observe the terminal. Verify either Option A or Option B (for systems with character limitations) of the Standard Mandatory DoD Notice and Consent Banner is displayed at logon. The required banner verbiage follows and must be displayed verbatim: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't." If the device configuration does not have a logon banner as stated above, this is a finding.
Review the device configuration or request that the administrator logon to the device and observe the terminal. Verify either Option A or Option B (for systems with character limitations) of the Standard Mandatory DoD Notice and Consent Banner is displayed at logon. The required banner verbiage follows and must be displayed verbatim: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't." If the device configuration does not have a logon banner as stated above, this is a finding.
Fix:
Configure all management interfaces to the network device to display the DoD-mandated warning banner verbiage at logon regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't."
Configure all management interfaces to the network device to display the DoD-mandated warning banner verbiage at logon regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't."
Vuln ID:
V-3014
Rule ID:
SV-3014r4_rule
Group ID:
Management connection does not timeout.
Version:
NET1639
CCI:
Severity:
Medium
Description:
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled between the managed network device and a PC or terminal server when the later has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network device as well as reduce the risk of a management session from being hijacked. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance OfficerECSC-1
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled between the managed network device and a PC or terminal server when the later has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network device as well as reduce the risk of a management session from being hijacked. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance Officer
Check:
Review the management connection for administrative access and verify the network device is configured to time-out the connection at 10 minutes or less of inactivity. If the device does not terminate inactive management connections at 10 minutes or less, this is a finding.
Review the management connection for administrative access and verify the network device is configured to time-out the connection at 10 minutes or less of inactivity. If the device does not terminate inactive management connections at 10 minutes or less, this is a finding.
Fix:
Configure the network devices to ensure the timeout for unattended administrative access connections is no longer than 10 minutes.
Configure the network devices to ensure the timeout for unattended administrative access connections is no longer than 10 minutes.
Vuln ID:
V-3043
Rule ID:
SV-3043r4_rule
Group ID:
SNMP privileged and non-privileged access.
Version:
NET1675
CCI:
Severity:
Medium
Description:
Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking experts. If a hacker gains access to these devices and can easily guess the name, this could result in denial of service, interception of sensitive information, or other destructive actions.Information Assurance OfficerECSC-1
Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking experts. If a hacker gains access to these devices and can easily guess the name, this could result in denial of service, interception of sensitive information, or other destructive actions.Information Assurance Officer
Check:
Review the SNMP configuration of all managed nodes to ensure different community names (V1/2) or groups/users (V3) are configured for read-only and read-write access. If unique community strings or accounts are not used for SNMP peers, this is a finding.
Review the SNMP configuration of all managed nodes to ensure different community names (V1/2) or groups/users (V3) are configured for read-only and read-write access. If unique community strings or accounts are not used for SNMP peers, this is a finding.
Fix:
Configure the SNMP community strings on the network device and change them from the default values. SNMP community strings and user passwords must be unique and not match any other network device passwords. Different community strings (V1/2) or groups (V3) must be configured for various levels of read and write access.
Configure the SNMP community strings on the network device and change them from the default values. SNMP community strings and user passwords must be unique and not match any other network device passwords. Different community strings (V1/2) or groups (V3) must be configured for various levels of read and write access.
Vuln ID:
V-3056
Rule ID:
SV-3056r7_rule
Group ID:
Group accounts are defined.
Version:
NET0460
CCI:
Severity:
High
Description:
Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network.Information Assurance OfficerIAIA-1, IAIA-2
Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network.Information Assurance Officer
Check:
Review the network device configuration and validate there are no group accounts configured for access. If a group account is configured on the device, this is a finding.
Review the network device configuration and validate there are no group accounts configured for access. If a group account is configured on the device, this is a finding.
Fix:
Configure individual user accounts for each authorized person then remove any group accounts.
Configure individual user accounts for each authorized person then remove any group accounts.
Vuln ID:
V-3057
Rule ID:
SV-3057r5_rule
Group ID:
Accounts assigned least privileges necessary to perform duties.
Version:
NET0465
CCI:
Severity:
Medium
Description:
By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personnel are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.Information Assurance OfficerECSC-1
By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personnel are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.Information Assurance Officer
Check:
Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the greatest privilege level unless deemed necessary for assigned duties. If it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding.
Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the least privilege level unless deemed necessary for assigned duties. If it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding.
Fix:
Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.
Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.
Vuln ID:
V-3058
Rule ID:
SV-3058r5_rule
Group ID:
Unauthorized accounts are configured to access device.
Version:
NET0470
CCI:
Severity:
Medium
Description:
A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service, interception of sensitive information, or other destructive actions could potentially take place if an unauthorized account is configured to access the network device.Information Assurance OfficerECSC-1, IAAC-1
A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service, interception of sensitive information, or other destructive actions could potentially take place if an unauthorized account is configured to access the network device.Information Assurance Officer
Check:
Review the organization's responsibilities list and reconcile the list of authorized accounts with those accounts defined for access to the network device. If an unauthorized account is configured for access to the device, this is a finding.
Review the organization's responsibilities list and reconcile the list of authorized accounts with those accounts defined for access to the network device. If an unauthorized account is configured for access to the device, this is a finding.
Fix:
Remove any account configured for access to the network device that is not defined in the organization's responsibilities list.
Remove any account configured for access to the network device that is not defined in the organization's responsibilities list.
Vuln ID:
V-3069
Rule ID:
SV-3069r5_rule
Group ID:
Management connections must be secured by FIPS 140-2.
Version:
NET1638
CCI:
Severity:
Medium
Description:
Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.Information Assurance OfficerDCNR-1, ECSC-1
Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.Information Assurance Officer
Check:
Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols. -SSHv2 -SCP -HTTPS using TLS If management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.
Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols. -SSHv2 -SCP -HTTPS using TLS If management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.
Fix:
Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.
Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.
Vuln ID:
V-3070
Rule ID:
SV-3070r4_rule
Group ID:
Management connections must be logged.
Version:
NET1640
CCI:
Severity:
Low
Description:
Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.Information Assurance OfficerECAT-1, ECAT-2
Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.Information Assurance Officer
Check:
Review the configuration to verify all attempts to access the device via management connection are logged. If management connection attempts are not logged, this is a finding.
Review the configuration to verify all attempts to access the device via management connection are logged. If management connection attempts are not logged, this is a finding.
Fix:
Configure the device to log all access attempts to the device to establish a management connection for administrative access.
Configure the device to log all access attempts to the device to establish a management connection for administrative access.
Vuln ID:
V-3143
Rule ID:
SV-3143r4_rule
Group ID:
Devices exist with standard default passwords.
Version:
NET0240
CCI:
Severity:
High
Description:
Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not removing them prior to deploying the network devices into production provides an opportunity for a malicious user to gain unauthorized access to the device.Information Assurance OfficerECSC-1
Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not removing them prior to deploying the network devices into production provides an opportunity for a malicious user to gain unauthorized access to the device.Information Assurance Officer
Check:
Review the network devices configuration to determine if the vendor default password is active. If any vendor default passwords are used on the device, this is a finding.
Review the network devices configuration to determine if the vendor default password is active. If any vendor default passwords are used on the device, this is a finding.
Fix:
Remove any vendor default passwords from the network devices configuration.
Remove any vendor default passwords from the network devices configuration.
Vuln ID:
V-3160
Rule ID:
SV-3160r4_rule
Group ID:
Operating system is not at a current release level.
Version:
NET0700
CCI:
Severity:
Medium
Description:
Network devices not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches, as well as enhancements to IP security. Viruses, denial of service attacks, system weaknesses, back doors and other potentially harmful situations could render a system vulnerable, allowing unauthorized access to DoD assets.Information Assurance OfficerECSC-1
Network devices not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches, as well as enhancements to IP security. Viruses, denial of service attacks, system weaknesses, back doors and other potentially harmful situations could render a system vulnerable, allowing unauthorized access to DoD assets.Information Assurance Officer
Check:
Have the administrator display the OS version in operation. The OS must be current with related IAVMs addressed. If the device is using an OS that does not meet all IAVMs or currently not supported by the vendor, this is a finding.
Have the administrator display the OS version in operation. The OS must be current with related IAVMs addressed. If the device is using an OS that does not meet all IAVMs or currently not supported by the vendor, this is a finding.
Fix:
Update operating system to a supported version that addresses all related IAVMs.
Update operating system to a supported version that addresses all related IAVMs.
Vuln ID:
V-3175
Rule ID:
SV-3175r5_rule
Group ID:
Management connections must require passwords.
Version:
NET1636
CCI:
Severity:
High
Description:
Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance OfficerECSC-1
Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance Officer
Check:
Review the network device configuration to verify all management connections for administrative access require authentication. If authentication isn't configured for management access, this is a finding.
Review the network device configuration to verify all management connections for administrative access require authentication. If authentication isn't configured for management access, this is a finding.
Fix:
Configure authentication for all management connections.
Configure authentication for all management connections.
Vuln ID:
V-3196
Rule ID:
SV-3196r4_rule
Group ID:
An insecure version of SNMP is being used.
Version:
NET1660
CCI:
Severity:
High
Description:
SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network.Information Assurance OfficerECSC-1
SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network.Information Assurance Officer
Check:
Review the device configuration to verify it is configured to use SNMPv3 with both SHA authentication and privacy using AES encryption. Downgrades: If the site is using Version 1 or Version 2 with all of the appropriate patches and has developed a migration plan to implement the Version 3 Security Model, this finding can be downgraded to a Category II. If the targeted asset is running SNMPv3 and does not support SHA or AES, but the device is configured to use MD5 authentication and DES or 3DES encryption, then the finding can be downgraded to a Category III. If the site is using Version 1 or Version 2 and has installed all of the appropriate patches or upgrades to mitigate any known security vulnerabilities, this finding can be downgraded to a Category II. In addition, if the device does not support SNMPv3, this finding can be downgraded to a Category III provided all of the appropriate patches to mitigate any known security vulnerabilities have been applied and has developed a migration plan that includes the device upgrade to support Version 3 and the implementation of the Version 3 Security Model. If the device is configured to use to anything other than SNMPv3 with at least SHA-1 and AES, this is a finding. Downgrades can be determined based on the criteria above.
Review the device configuration to verify it is configured to use SNMPv3 with both SHA authentication and privacy using AES encryption. Downgrades: If the site is using Version 1 or Version 2 with all of the appropriate patches and has developed a migration plan to implement the Version 3 Security Model, this finding can be downgraded to a Category II. If the targeted asset is running SNMPv3 and does not support SHA or AES, but the device is configured to use MD5 authentication and DES or 3DES encryption, then the finding can be downgraded to a Category III. If the site is using Version 1 or Version 2 and has installed all of the appropriate patches or upgrades to mitigate any known security vulnerabilities, this finding can be downgraded to a Category II. In addition, if the device does not support SNMPv3, this finding can be downgraded to a Category III provided all of the appropriate patches to mitigate any known security vulnerabilities have been applied and has developed a migration plan that includes the device upgrade to support Version 3 and the implementation of the Version 3 Security Model. If the device is configured to use to anything other than SNMPv3 with at least SHA-1 and AES, this is a finding. Downgrades can be determined based on the criteria above.
Fix:
If SNMP is enabled, configure the network device to use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography (i.e., SHA authentication and AES encryption).
If SNMP is enabled, configure the network device to use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography (i.e., SHA authentication and AES encryption).
Vuln ID:
V-3210
Rule ID:
SV-3210r4_rule
Group ID:
Using default SNMP community names.
Version:
NET1665
CCI:
Severity:
High
Description:
Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device using the read community string "public". In addition, an attacker can change a system configuration using the write community string "private".Information Assurance OfficerECSC-1, IAIA-1, IAIA-2
Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device using the read community string "public". In addition, an attacker can change a system configuration using the write community string "private".Information Assurance Officer
Check:
Review the network devices configuration and verify if either of the SNMP community strings "public" or "private" is being used. If default or well-known community strings are used for SNMP, this is a finding.
Review the network devices configuration and verify if either of the SNMP community strings "public" or "private" is being used. If default or well-known community strings are used for SNMP, this is a finding.
Fix:
Configure unique SNMP community strings replacing the default community strings.
Configure unique SNMP community strings replacing the default community strings.
Vuln ID:
V-3966
Rule ID:
SV-3966r5_rule
Group ID:
More than one local account is defined.
Version:
NET0440
CCI:
Severity:
Medium
Description:
Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between the device and the authentication server is not operable. The console or account of last resort logon credentials must be stored in a sealed envelope and kept in a safe.ECSC-1
Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between the device and the authentication server is not operable. The console or local account of last resort logon credentials must be stored in a sealed envelope and kept in a safe.
Check:
Review the network device configuration to determine if an authentication server is defined for gaining administrative access. If so, there must be only one account of last resort configured locally for an emergency. Verify the username and password for the account of last resort is contained within a sealed envelope kept in a safe. If an authentication server is used and more than one local account exists, this is a finding.
Review the network device configuration to determine if an authentication server is defined for gaining administrative access. If so, there must be only one account of last resort configured locally for an emergency. Verify the username and password for the local account of last resort is contained within a sealed envelope kept in a safe. If an authentication server is used and more than one local account exists, this is a finding.
Fix:
Configure the device to only allow one local account of last resort for emergency access and store the credentials in a secure manner.
Configure the device to only allow one local account of last resort for emergency access and store the credentials in a secure manner.
Vuln ID:
V-3967
Rule ID:
SV-3967r4_rule
Group ID:
The console port does not timeout after 10 minutes.
Version:
NET1624
CCI:
Severity:
Medium
Description:
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network device. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance OfficerECSC-1
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network device. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance Officer
Check:
Review the configuration and verify a session using the console port will time out after 10 minutes or less of inactivity. If console access is not configured to timeout at 10 minutes or less, this is a finding.
Review the configuration and verify a session using the console port will time out after 10 minutes or less of inactivity. If console access is not configured to timeout at 10 minutes or less, this is a finding.
Fix:
Configure the timeout for idle console connection to 10 minutes or less.
Configure the timeout for idle console connection to 10 minutes or less.
Vuln ID:
V-3969
Rule ID:
SV-3969r5_rule
Group ID:
Network element must only allow SNMP read access.
Version:
NET0894
CCI:
Severity:
Medium
Description:
Enabling write access to the device via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.Information Assurance OfficerECSC-1
Enabling write access to the device via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.Information Assurance Officer
Check:
Review the network device configuration and verify SNMP community strings are read-only when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3. If write-access is used for SNMP versions 1, 2c, or 3-noAuthNoPriv mode and there is no documented approval by the ISSO, this is a finding.
Review the network device configuration and verify SNMP community strings are read-only when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3. If write-access is used for SNMP versions 1, 2c, or 3-noAuthNoPriv mode and there is no documented approval by the ISSO, this is a finding.
Fix:
Configure the network device to allow for read-only SNMP access when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3.
Configure the network device to allow for read-only SNMP access when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3.
Vuln ID:
V-4582
Rule ID:
SV-4582r5_rule
Group ID:
Authentication required for console access.
Version:
NET1623
CCI:
Severity:
High
Description:
Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance OfficerIAIA-1, IAIA-2
Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance Officer
Check:
Review the network device's configuration and verify authentication is required for console access. If authentication is not configured for console access, this is a finding.
Review the network device's configuration and verify authentication is required for console access. If authentication is not configured for console access, this is a finding.
Fix:
Configure authentication for console access on the network device.
Configure authentication for console access on the network device.
Vuln ID:
V-5611
Rule ID:
SV-5611r4_rule
Group ID:
Management connections are not restricted.
Version:
NET1637
CCI:
Severity:
Medium
Description:
Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.Information Assurance OfficerECSC-1
Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.
Check:
Review the configuration and verify management access to the device is allowed only from hosts within the management network. If management access can be gained from outside of the authorized management network, this is a finding.
Review the configuration and verify management access to the device is allowed only from hosts within the management network. If management access can be gained from outside of the authorized management network, this is a finding.
Fix:
Configure an ACL or filter to restrict management access to the device from only the management network.
Configure an ACL or filter to restrict management access to the device from only the management network.
Vuln ID:
V-5613
Rule ID:
SV-5613r4_rule
Group ID:
SSH login attempts value is greater than 3.
Version:
NET1646
CCI:
Severity:
Medium
Description:
An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.Information Assurance OfficerECSC-1
An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.Information Assurance Officer
Check:
Review the configuration and verify the number of unsuccessful SSH logon attempts is set at 3. If the device is not configured to reset unsuccessful SSH logon attempts at 3, this is a finding.
Review the configuration and verify the number of unsuccessful SSH logon attempts is set at 3. If the device is not configured to reset unsuccessful SSH logon attempts at 3, this is a finding.
Fix:
Configure the network device to require a maximum number of unsuccessful SSH logon attempts at 3.
Configure the network device to require a maximum number of unsuccessful SSH logon attempts at 3.
Vuln ID:
V-7011
Rule ID:
SV-7365r4_rule
Group ID:
The auxiliary port is not disabled.
Version:
NET1629
CCI:
Severity:
Low
Description:
The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network. Secured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.Information Assurance OfficerECSC-1
The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network. Secured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.Information Assurance Officer
Check:
Review the configuration and verify the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected. If the auxiliary port is enabled without the use of a secured modem, this is a finding.
Review the configuration and verify the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected. If the auxiliary port is enabled without the use of a secured modem, this is a finding.
Fix:
Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.
Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.
Vuln ID:
V-14207
Rule ID:
SV-14818r1_rule
Group ID:
WMAN authentication - Subscriber to Network
Version:
WIR0315-01
CCI:
Severity:
Medium
Description:
Broadband systems not compliant with authentication requirements could allow a hacker to gain access to the DoD network.Information Assurance OfficerECSC-1, ECWN-1
Broadband systems not compliant with authentication requirements could allow a hacker to gain access to the DoD network.Information Assurance Officer
Check:
Detailed Policy Requirements: The site WMAN systems will implement strong authentication from the User or WMAN subscriber device to WMAN network. For tactical WMAN systems or commercial WMAN systems operated in a tactical environment, two factor authentication is required, at a minimum. Note: Examples of two-factor authentication are password with biometrics or CAC with PIN. In cases where there are no available WMAN technology solutions that meets this requirement, the local DAA may grant an exception to this requirement until such time as a WMAN product is available that meets this requirement. The exception must be documented during the system DIACAP and in the site SSAA/SSP. At a minimum, the system must meet the authentication requirements of non-tactical WMAN systems. -For tactical or commercial WMAN systems operated in a non-tactical environment, this check does not apply: Checks WIR0315-02 and WIR0315-02 apply. Check Procedures: - Determine if the WMAN system is used in a tactical or non-tactical environment. - Review the WMAN system product documentation (specification sheet, network administration manual, installation manual, etc.) to determine what authentication mechanism is supported between the user/subscriber device and WMAN network. - Review the authentication configuration configured on the WMAN access point. (Have the system administrator and user show you the setting.) - Verify “User or WMAN subscriber device to WMAN network” authentication meets requirements. --For WMAN systems operated in a tactical environment, two factor authentication is required, at a minimum, unless the DAA has approved an exception based on the unavailability of a WMAN product that meets this requirement. Determine if two factor authentication is used (e.g. CAC) or if the DAA has granted an exception. If the DAA has granted an exception, verify the exception has been noted in the site’s SSAA/SSP and that the system meets the requirements for non-tactical authentication. -Mark as a finding if the authentication requirements are not met.
Detailed Policy Requirements: The site WMAN systems will implement strong authentication from the User or WMAN subscriber device to WMAN network. For tactical WMAN systems or commercial WMAN systems operated in a tactical environment, two factor authentication is required, at a minimum. Note: Examples of two-factor authentication are password with biometrics or CAC with PIN. In cases where there are no available WMAN technology solutions that meets this requirement, the local DAA may grant an exception to this requirement until such time as a WMAN product is available that meets this requirement. The exception must be documented during the system DIACAP and in the site SSAA/SSP. At a minimum, the system must meet the authentication requirements of non-tactical WMAN systems. -For tactical or commercial WMAN systems operated in a non-tactical environment, this check does not apply: Checks WIR0315-02 and WIR0315-02 apply. Check Procedures: - Determine if the WMAN system is used in a tactical or non-tactical environment. - Review the WMAN system product documentation (specification sheet, network administration manual, installation manual, etc.) to determine what authentication mechanism is supported between the user/subscriber device and WMAN network. - Review the authentication configuration configured on the WMAN access point. (Have the system administrator and user show you the setting.) - Verify “User or WMAN subscriber device to WMAN network” authentication meets requirements. --For WMAN systems operated in a tactical environment, two factor authentication is required, at a minimum, unless the DAA has approved an exception based on the unavailability of a WMAN product that meets this requirement. Determine if two factor authentication is used (e.g. CAC) or if the DAA has granted an exception. If the DAA has granted an exception, verify the exception has been noted in the site’s SSAA/SSP and that the system meets the requirements for non-tactical authentication. -Mark as a finding if the authentication requirements are not met.
Fix:
Implement strong authentication for the user or device to the WMAN network.
Implement strong authentication for the user or device to the WMAN network.
Vuln ID:
V-14671
Rule ID:
SV-15327r4_rule
Group ID:
NTP messages are not authenticated.
Version:
NET0813
CCI:
Severity:
Medium
Description:
Since NTP is used to ensure accurate log file timestamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. Two NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka "symmetric mode"). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client's stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers. A hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device loses connectivity to it upstream NTP server, it will be able to choose time from one of its peers. The NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It's not used to authenticate NTP clients because NTP servers don't care about the authenticity of their clients, as they never accept any time from them.Information Assurance OfficerECSC-1
Since NTP is used to ensure accurate log file time stamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. Two NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka "symmetric mode"). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client's stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers. A hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device loses connectivity to its upstream NTP server, it will be able to choose time from one of its peers. The NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It is not used to authenticate NTP clients because NTP servers do not care about the authenticity of their clients, as they never accept any time from them.
Check:
Review the device configuration and verify it is authenticating the NTP messages received from the NTP server or peer. Authentication must be performed using either PKI (supported in NTP v4) or SHA-1 hashing algorithm. If NTP messages are not authenticated using PKI or SHA-1 hashing, this is a finding.
Review the network element configuration and verify that it is authenticating NTP messages received from the NTP server or peer using a FIPS-approved message authentication code algorithm. FIPS-approved algorithms for authentication are the cipher-based message authentication code (CMAC) and the keyed-hash message authentication code (HMAC). AES and 3DES are NIST-approved CMAC algorithms. The following are NIST-approved HMAC algorithms: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. Downgrade: If the network device is not capable of authenticating the NTP server or peer using a FIPS-approved message authentication code algorithm, then MD5 can be utilized for NTP message authentication and the finding can be downgraded to a CAT III. If the network element is not configured to authenticate received NTP messages using a FIPS-approved message authentication code algorithm, this is a finding. A downgrade can be determined based on the criteria above.
Fix:
Configure the device to authenticate all received NTP messages using either PKI (supported in NTP v4) or SHA-1 hashing algorithm.
Configure the device to authenticate all received NTP messages using a FIPS-approved message authentication code algorithm.
Vuln ID:
V-14717
Rule ID:
SV-15459r4_rule
Group ID:
The network element must not allow SSH Version 1.
Version:
NET1647
CCI:
Severity:
Medium
Description:
SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to attacks, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1.Information Assurance OfficerECSC-1
SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to attacks, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1.Information Assurance Officer
Check:
Review the configuration and verify SSH Version 1 is not being used for administrative access. If the device is using an SSHv1 session, this is a finding.
Review the configuration and verify SSH Version 1 is not being used for administrative access. If the device is using an SSHv1 session, this is a finding.
Fix:
Configure the network device to use SSH version 2.
Configure the network device to use SSH version 2.
Vuln ID:
V-14886
Rule ID:
SV-15654r2_rule
Group ID:
WLAN infrastructure network placement
Version:
WIR0135
CCI:
Severity:
Medium
Description:
If an adversary is able to compromise an access point or controller that is directly connected to an enclave network, then the adversary can easily surveil and attack other devices from that beachhead. A defense-in-depth approach requires an additional layer of protection exist between the WLAN and the enclave network. This is particularly important for wireless networks, which may be vulnerable to attack from outside physical perimeter of the facility or base given the inherent nature of radio communications to penetrate walls, fences, and other physical boundaries.System AdministratorECSC-1, ECTM-2, ECWN-1
If an adversary is able to compromise an access point or controller that is directly connected to an enclave network, then the adversary can easily surveil and attack other devices from that beachhead. A defense-in-depth approach requires an additional layer of protection exist between the WLAN and the enclave network. This is particularly important for wireless networks, which may be vulnerable to attack from outside physical perimeter of the facility or base given the inherent nature of radio communications to penetrate walls, fences, and other physical boundaries.System Administrator
Check:
Detailed policy requirements: Wireless access points and bridges must not be directly connected to the enclave network. A network device must separate wireless access from other elements of the enclave network. Sites must also comply with the Network Infrastructure STIG configuration requirements for DMZ, VLAN, and VPN configurations, as applicable. Examples of acceptable architectures include placing access points or controllers in a screened subnet (e.g. DMZ separating intranet and wireless network) or dedicated virtual LAN (VLAN) with ACLs. Check Procedures: Review network architecture with the network administrator. 1. Verify compliance by inspecting the site network topology diagrams. 2. Since many network diagrams are not kept up-to-date, walk through the connections with the network administrator using network management tools or diagnostic commands to verify the diagrams are current. If the site’s wireless infrastructure, such as access points and bridges, is not isolated from the enclave network, this is a finding.
Detailed policy requirements: Wireless access points and bridges must not be directly connected to the enclave network. A network device must separate wireless access from other elements of the enclave network. Sites must also comply with the Network Infrastructure STIG configuration requirements for DMZ, VLAN, and VPN configurations, as applicable. Examples of acceptable architectures include placing access points or controllers in a screened subnet (e.g. DMZ separating intranet and wireless network) or dedicated virtual LAN (VLAN) with ACLs. Check Procedures: Review network architecture with the network administrator. 1. Verify compliance by inspecting the site network topology diagrams. 2. Since many network diagrams are not kept up-to-date, walk through the connections with the network administrator using network management tools or diagnostic commands to verify the diagrams are current. If the site’s wireless infrastructure, such as access points and bridges, is not isolated from the enclave network, this is a finding.
Fix:
Remove wireless network devices with direct connections to an enclave network. If feasible, reconfigure network connections to isolate the WLAN infrastructure from the enclave network, separating them with a firewall or equivalent protection.
Remove wireless network devices with direct connections to an enclave network. If feasible, reconfigure network connections to isolate the WLAN infrastructure from the enclave network, separating them with a firewall or equivalent protection.
Vuln ID:
V-15432
Rule ID:
SV-16259r4_rule
Group ID:
The device is not authenticated using a AAA server.
Version:
NET0433
CCI:
Severity:
Medium
Description:
The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ or RADIUS, the administrators can easily add or remove user accounts, add or remove command authorizations, and maintain a log of user activity. The use of an authentication server provides the capability to assign router administrators to tiered groups that contain their privilege level that is used for authorization of specific commands. For example, user mode would be authorized for all authenticated administrators while configuration or edit mode should only be granted to those administrators that are permitted to implement router configuration changes.Information Assurance OfficerIAIA-1
The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ or RADIUS, the administrators can easily add or remove user accounts, add or remove command authorizations, and maintain a log of user activity. The use of an authentication server provides the capability to assign router administrators to tiered groups that contain their privilege level that is used for authorization of specific commands. For example, user mode would be authorized for all authenticated administrators while configuration or edit mode should only be granted to those administrators that are permitted to implement router configuration changes.Information Assurance Officer
Check:
Verify an authentication server is required to access the device and that there are two or more authentication servers defined. If the device is not configured for two separate authentication servers, this is a finding.
Verify an authentication server is required to access the device and that there are two or more authentication servers defined. If the device is not configured for two separate authentication servers, this is a finding.
Fix:
Configure the device to use two separate authentication servers.
Configure the device to use two separate authentication servers.
Vuln ID:
V-15434
Rule ID:
SV-16261r4_rule
Group ID:
Emergency account privilege level is not set.
Version:
NET0441
CCI:
Severity:
High
Description:
The emergency account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate authorization level to perform necessary administrative functions during this time.Information Assurance OfficerECSC-1
The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate authorization level to perform necessary administrative functions during this time.Information Assurance Officer
Check:
Review the emergency account configured on the network devices and verify that it has been assigned to a privilege level that will enable the administrator to perform necessary administrative functions when the authentication server is not online. If the emergency account is configured for more access than needed to troubleshoot issues, this is a finding.
Review the emergency administration account configured on the network devices and verify that it has been assigned to a privilege level that will enable the administrator to perform necessary administrative functions when the authentication server is not online. If the emergency administration account is configured for more access than needed to troubleshoot issues, this is a finding.
Fix:
Assign a privilege level to the emergency account to allow the administrator to perform necessary administrative functions when the authentication server is not online.
Assign a privilege level to the emergency administration account to allow the administrator to perform necessary administrative functions when the authentication server is not online.
Vuln ID:
V-17821
Rule ID:
SV-19075r4_rule
Group ID:
The OOBM interface not configured correctly.
Version:
NET0991
CCI:
Severity:
Medium
Description:
The OOBM access switch will connect to the management interface of the managed network device. The management interface of the managed network device will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.System AdministratorInformation Assurance OfficerECSC-1
The OOBM access switch will connect to the management interface of the managed network device. The management interface of the managed network device will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.System AdministratorInformation Assurance Officer
Check:
Review the device configuration to determine if the OOB management interface is assigned an appropriate IP address from the authorized OOB management network. If an IP address assigned to the interface is not from an authorized OOB management network, this is a finding.
Review the device configuration to determine if the OOB management interface is assigned an appropriate IP address from the authorized OOB management network. If an IP address assigned to the interface is not from an authorized OOB management network, this is a finding.
Fix:
Configure the OOB management interface with an IP address from the address space belonging to the OOBM network.
Configure the OOB management interface with an IP address from the address space belonging to the OOBM network.
Vuln ID:
V-17822
Rule ID:
SV-19076r4_rule
Group ID:
The management interface does not have an ACL.
Version:
NET0992
CCI:
Severity:
Medium
Description:
The OOBM access switch will connect to the management interface of the managed network device. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network device will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network.System AdministratorInformation Assurance OfficerECSC-1
The OOBM access switch will connect to the management interface of the managed network device. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network device will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network.System AdministratorInformation Assurance Officer
Check:
Step 1: Verify the managed interface has an inbound and outbound ACL or filter. Step 2: Verify the ingress ACL blocks all transit traffic--that is, any traffic not destined to the router itself. In addition, traffic accessing the managed elements should be originated at the NOC. Step 3: Verify the egress ACL blocks any traffic not originated by the managed element. If management interface does not have an ingress and egress filter configured and applied, this is a finding.
Step 1: Verify the managed interface has an inbound and outbound ACL or filter. Step 2: Verify the ingress ACL blocks all transit traffic--that is, any traffic not destined to the router itself. In addition, traffic accessing the managed elements should be originated at the NOC. Step 3: Verify the egress ACL blocks any traffic not originated by the managed element. If management interface does not have an ingress and egress filter configured and applied, this is a finding.
Fix:
If the management interface is a routed interface, it must be configured with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.
If the management interface is a routed interface, it must be configured with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.
Vuln ID:
V-18598
Rule ID:
SV-20147r1_rule
Group ID:
WMAN RADAR interference
Version:
WIR0300
CCI:
Severity:
Low
Description:
DoD RADAR systems operate in the 3.30-3.65 GHz frequency band. If the WMAN system operates in the same band, it could potentially interfere with RADAR operations and undermine the mission the RADAR supports. System AdministratorInformation Assurance OfficerDesignated Approving AuthorityECWN-1
DoD RADAR systems operate in the 3.30-3.65 GHz frequency band. If the WMAN system operates in the same band, it could potentially interfere with RADAR operations and undermine the mission the RADAR supports. System AdministratorInformation Assurance OfficerDesignated Approving Authority
Check:
Review the WMAN system data specification sheet (for both the AP or bridge). Verify the WMAN system does not operate in the 3.30 – 3.65 GHz frequency band. Mark as a finding if the WMAN system does not meet the requirement.
Review the WMAN system data specification sheet (for both the AP or bridge). Verify the WMAN system does not operate in the 3.30 – 3.65 GHz frequency band. Mark as a finding if the WMAN system does not meet the requirement.
Fix:
Reconfigure the WMAN system so that it does not operate in the 3.30 – 3.65 GHz frequency band.
Reconfigure the WMAN system so that it does not operate in the 3.30 – 3.65 GHz frequency band.
Vuln ID:
V-18600
Rule ID:
SV-20149r1_rule
Group ID:
WMAN TRANSEC analysis
Version:
WIR0305
CCI:
Severity:
Low
Description:
If the TRANSEC analysis has not been completed, the system may not be designed or configured correctly to mitigate exposure of DoD data or may be vulnerable to a wireless attack.Designated Approving AuthorityECWN-1
If the TRANSEC analysis has not been completed, the system may not be designed or configured correctly to mitigate exposure of DoD data or may be vulnerable to a wireless attack.Designated Approving Authority
Check:
Detailed Policy Requirements: If the WMAN system is a tactical system or a commercial system operated in a tactical environment, then the site WMAN system DIACAP must include a Transmission Security (TRANSEC) vulnerability analysis, which includes a determination on whether the system has a low probability of explotation (LPE) for the WMAN signal in space and lists recommended risk mitigation actions. NOTE: The purpose of the TRANSEC vulnerability analysis is to determine the jamming and exploitation risk of a WMAN system based on the design of the system. The TRANSEC analysis should include the following components: - Verify radio communications are encrypted including the management, control, and data frames. - Determine denial of service risks to the network. - Check with NSA to determine if additional mitigation actions are available. NOTE: This check should only be reviewed during the initial system Certification and Accreditation (C&A). Check Procedures: Review the SSAA/SSP and other DIACAP documentation. If the WMAN system is a tactical system or a commercial system used in a tactical environment, verify a TRANSEC vulnerability analysis was performed on the WMAN system during the system DIACAP and includes the required components. Mark as a finding if documentation is missing the required analysis and components.
Detailed Policy Requirements: If the WMAN system is a tactical system or a commercial system operated in a tactical environment, then the site WMAN system DIACAP must include a Transmission Security (TRANSEC) vulnerability analysis, which includes a determination on whether the system has a low probability of explotation (LPE) for the WMAN signal in space and lists recommended risk mitigation actions. NOTE: The purpose of the TRANSEC vulnerability analysis is to determine the jamming and exploitation risk of a WMAN system based on the design of the system. The TRANSEC analysis should include the following components: - Verify radio communications are encrypted including the management, control, and data frames. - Determine denial of service risks to the network. - Check with NSA to determine if additional mitigation actions are available. NOTE: This check should only be reviewed during the initial system Certification and Accreditation (C&A). Check Procedures: Review the SSAA/SSP and other DIACAP documentation. If the WMAN system is a tactical system or a commercial system used in a tactical environment, verify a TRANSEC vulnerability analysis was performed on the WMAN system during the system DIACAP and includes the required components. Mark as a finding if documentation is missing the required analysis and components.
Fix:
Commission a TRANSEC analysis for the WMAN system..
Commission a TRANSEC analysis for the WMAN system..
Vuln ID:
V-18601
Rule ID:
SV-20152r1_rule
Group ID:
WMAN coverage area
Version:
WIR0310
CCI:
Severity:
Low
Description:
Wireless signals could be intercepted more easily by an adversary if the coverage area is not appropriately sized. If an adversary is able to intercept wireless signals, it is possible to obtain information about the location and intensity of DoD operations. If DoD data is not encrypted in transit, then the adversary will be able to capture it.Information Assurance OfficerDesignated Approving AuthorityECWN-1
Wireless signals could be intercepted more easily by an adversary if the coverage area is not appropriately sized. If an adversary is able to intercept wireless signals, it is possible to obtain information about the location and intensity of DoD operations. If DoD data is not encrypted in transit, then the adversary will be able to capture it.Information Assurance OfficerDesignated Approving Authority
Check:
NOTE: This check should only be reviewed during the initial system Certification and Accreditation (C&A). Review the site SSP/SSAA and other DIACAP documentation. Verify an appropriate WMAN coverage area was determined during system design or the DIACAP. Compare the actual radio coverage of WMAN system with the intended coverage area map. Mark as a finding if the actual usable radio coverage in any direction is 10% greater (or more) than shown on the intended coverage area map.
NOTE: This check should only be reviewed during the initial system Certification and Accreditation (C&A). Review the site SSP/SSAA and other DIACAP documentation. Verify an appropriate WMAN coverage area was determined during system design or the DIACAP. Compare the actual radio coverage of WMAN system with the intended coverage area map. Mark as a finding if the actual usable radio coverage in any direction is 10% greater (or more) than shown on the intended coverage area map.
Fix:
Implement a solution to constrain signals to areas in which they are intended to be received. Potential technical actions include using directional antennas or changing radio transmission power. If the coverage map does not reflect the operational requirement, it may be updated so that the current system is in compliance.
Implement a solution to constrain signals to areas in which they are intended to be received. Potential technical actions include using directional antennas or changing radio transmission power. If the coverage map does not reflect the operational requirement, it may be updated so that the current system is in compliance.
Vuln ID:
V-18602
Rule ID:
SV-20153r1_rule
Group ID:
WMAN authentication - User to Enclave
Version:
WIR0320
CCI:
Severity:
Medium
Description:
Without strong user authentication to the network a hacker may be able to gain access.ECWN-1
Without strong user authentication to the network a hacker may be able to gain access.
Check:
Interview the IAO and network system administrator to determine if the site’s network is configured to require CAC authentication before a WMAN user is connected to the network. If possible, have a user set up a WMAN connection and verify the user is required to CAC authenticate before they gain access to the local network. Mark as a finding if a WMAN user is not required to CAC authenticate to the network prior to gaining network access.
Interview the IAO and network system administrator to determine if the site’s network is configured to require CAC authentication before a WMAN user is connected to the network. If possible, have a user set up a WMAN connection and verify the user is required to CAC authenticate before they gain access to the local network. Mark as a finding if a WMAN user is not required to CAC authenticate to the network prior to gaining network access.
Fix:
Comply with policy.
Comply with policy.
Vuln ID:
V-18603
Rule ID:
SV-20154r1_rule
Group ID:
Encryption for unclass WMAN is compliant
Version:
WIR0325
CCI:
Severity:
Medium
Description:
Sensitive DoD data could be exposed to a hacker.Information Assurance OfficerECWN-1
Sensitive DoD data could be exposed to a hacker.Information Assurance Officer
Check:
Detailed policy requirements: Site WMAN systems that transmit unclassified data must implement the following data encryption controls: - For tactical WMAN systems or commercial WMAN systems operated in a tactical environment: --The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 2 radio data frames. The WMAN system must be configured for AES-CCM encryption, if supported by the WMAN system. --The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 3 data being transmitted. - For tactical WMAN systems or commercial WMAN systems operated in a non-tactical environment and for WMAN bridges: --The WMAN system must implement FIPS 140-2 validated encryption at ISO OSI Layer 2 or 3. Check Procedures: Verify with the IAO that site WMAN systems transmitting unclassified data implement the following data encryption controls: For tactical WMAN systems or commercial WMAN systems operated in a tactical environment: - The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 2 radio data frames. The WMAN system will be configured for AES-CCM encryption, if supported by the WMAN system. - The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 3 data being transmitted. For tactical WMAN systems or commercial WMAN systems operated in a non-tactical environment: - The WMAN system must implement FIPS 140-2 validated encryption at ISO OSI Layer 2 or 3. Mark as a finding if these requirements are not met.
Detailed policy requirements: Site WMAN systems that transmit unclassified data must implement the following data encryption controls: - For tactical WMAN systems or commercial WMAN systems operated in a tactical environment: --The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 2 radio data frames. The WMAN system must be configured for AES-CCM encryption, if supported by the WMAN system. --The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 3 data being transmitted. - For tactical WMAN systems or commercial WMAN systems operated in a non-tactical environment and for WMAN bridges: --The WMAN system must implement FIPS 140-2 validated encryption at ISO OSI Layer 2 or 3. Check Procedures: Verify with the IAO that site WMAN systems transmitting unclassified data implement the following data encryption controls: For tactical WMAN systems or commercial WMAN systems operated in a tactical environment: - The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 2 radio data frames. The WMAN system will be configured for AES-CCM encryption, if supported by the WMAN system. - The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 3 data being transmitted. For tactical WMAN systems or commercial WMAN systems operated in a non-tactical environment: - The WMAN system must implement FIPS 140-2 validated encryption at ISO OSI Layer 2 or 3. Mark as a finding if these requirements are not met.
Fix:
Comply with policy.
Comply with policy.
Vuln ID:
V-18604
Rule ID:
SV-20156r1_rule
Group ID:
Classified WMAN encryption compliant
Version:
WIR0330
CCI:
Severity:
High
Description:
If not compliant, classified data could be compromised.Information Assurance OfficerECWN-1
If not compliant, classified data could be compromised.Information Assurance Officer
Check:
Detailed Policy Requirements: Site WMAN systems that transmit classified data must implement the following data encryption controls: - The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 2 radio data frames. The WMAN system will be configured for AES-CCM encryption, if supported by the WMAN system. (Not required for classified WMAN bridges.) - The WMAN system must implement NSA Type 1 certified High Assurance Internet Protocol Encryptor (HAIPE) encryption, other NSA Type 1 certified encryption, or NSA approved Suite B overlay encryption at ISO OSI Layer 3 to protect data being transmitted. Check Procedures: Review the WMAN product specification sheets. - Verify FIPS 140-2 validated encryption is being used at OSI Layer 2 to protect the radio data frames. - Determine if the system supports AES-CCM encryption. If yes, verify the system has been configured for AES-CCM encryption. - Verify NSA Type 1 certified High Assurance Internet Protocol Encryptor (HAIPE) encryption, other NSA Type 1 certified encryption, or NSA approved Suite B overlay encryption is being used at OSI Layer 3 to protect data being transmitted. Mark as a finding if any of these requirements have not been met.
Detailed Policy Requirements: Site WMAN systems that transmit classified data must implement the following data encryption controls: - The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 2 radio data frames. The WMAN system will be configured for AES-CCM encryption, if supported by the WMAN system. (Not required for classified WMAN bridges.) - The WMAN system must implement NSA Type 1 certified High Assurance Internet Protocol Encryptor (HAIPE) encryption, other NSA Type 1 certified encryption, or NSA approved Suite B overlay encryption at ISO OSI Layer 3 to protect data being transmitted. Check Procedures: Review the WMAN product specification sheets. - Verify FIPS 140-2 validated encryption is being used at OSI Layer 2 to protect the radio data frames. - Determine if the system supports AES-CCM encryption. If yes, verify the system has been configured for AES-CCM encryption. - Verify NSA Type 1 certified High Assurance Internet Protocol Encryptor (HAIPE) encryption, other NSA Type 1 certified encryption, or NSA approved Suite B overlay encryption is being used at OSI Layer 3 to protect data being transmitted. Mark as a finding if any of these requirements have not been met.
Fix:
Comply with policy.
Comply with policy.
Vuln ID:
V-18605
Rule ID:
SV-20157r1_rule
Group ID:
WMAN IDS screening compliant
Version:
WIR0335
CCI:
Severity:
Medium
Description:
WMAN systems could be at risk of wireless hacker attack if periodic wireless IDS screening is not performed.Information Assurance OfficerECWN-1
WMAN systems could be at risk of wireless hacker attack if periodic wireless IDS screening is not performed.Information Assurance Officer
Check:
Detailed Policy Requirements: Site performs periodic wireless IDS screening in all areas where WMAN coverage exists to prevent unauthorized access, jamming, or electromagnetic interference. Requirements are as follows: - Screening will be performed periodically, at least every 30 days is recommended and at least every 90 days is required. - Screening will be completed within the WMAN bands. (The most common WMAN bands are 2.5 GHz, 3.5 GHz, and 5.8 GHz for fixed WMAN and 2-6 GHz for mobile WMAN.) Note: 5.8 GHz is an unlicensed band. For this band, screening can be done to prevent unauthorized access. But since it is an unlicensed band, the WMAN may experience interference. Therefore, screening for interference in the 5.8 GHz band is not required. - Screening will verify the WMAN radio coverage area limitations that were defined during system design and initial setup have been maintained. NOTE: Reference A1.a in the Wireless STIG states “DoD Components shall actively screen for wireless devices. Active electromagnetic sensing at the DoD or contractor premises to detect/prevent unauthorized access of DoD ISs shall be periodically performed by the cognizant DAA or Defense Security Service office to ensure compliance with the DoD Information Technology Security Certification and Accreditation Process (DITSCAP) ongoing accreditation agreement.” Reference A1.d requires WMAN scanning to ensure that Components develop a capability to determine if unauthorized use of the WMAN system is taking place. This is to ensure that the Component is aware of attempted or on-going attacks. -Scanning logs will be maintained by the site for a period of at least one year. Check Procedures: Interview the IAO and review logs of previous site WMAN wireless IDS screening. - Verify WMAN wireless IDS screening sessions are being performed periodically, as required. - Verify previous site WMAN wireless IDS screening sessions are verifing WMAN radio beam coverage area limitations that were defined during system design and initial setup have been maintained. Mark as a finding if any of these requirements are not met.
Detailed Policy Requirements: Site performs periodic wireless IDS screening in all areas where WMAN coverage exists to prevent unauthorized access, jamming, or electromagnetic interference. Requirements are as follows: - Screening will be performed periodically, at least every 30 days is recommended and at least every 90 days is required. - Screening will be completed within the WMAN bands. (The most common WMAN bands are 2.5 GHz, 3.5 GHz, and 5.8 GHz for fixed WMAN and 2-6 GHz for mobile WMAN.) Note: 5.8 GHz is an unlicensed band. For this band, screening can be done to prevent unauthorized access. But since it is an unlicensed band, the WMAN may experience interference. Therefore, screening for interference in the 5.8 GHz band is not required. - Screening will verify the WMAN radio coverage area limitations that were defined during system design and initial setup have been maintained. NOTE: Reference A1.a in the Wireless STIG states “DoD Components shall actively screen for wireless devices. Active electromagnetic sensing at the DoD or contractor premises to detect/prevent unauthorized access of DoD ISs shall be periodically performed by the cognizant DAA or Defense Security Service office to ensure compliance with the DoD Information Technology Security Certification and Accreditation Process (DITSCAP) ongoing accreditation agreement.” Reference A1.d requires WMAN scanning to ensure that Components develop a capability to determine if unauthorized use of the WMAN system is taking place. This is to ensure that the Component is aware of attempted or on-going attacks. -Scanning logs will be maintained by the site for a period of at least one year. Check Procedures: Interview the IAO and review logs of previous site WMAN wireless IDS screening. - Verify WMAN wireless IDS screening sessions are being performed periodically, as required. - Verify previous site WMAN wireless IDS screening sessions are verifing WMAN radio beam coverage area limitations that were defined during system design and initial setup have been maintained. Mark as a finding if any of these requirements are not met.
Fix:
Comply with policy.
Comply with policy.
Vuln ID:
V-18606
Rule ID:
SV-20158r1_rule
Group ID:
WMAN IDS reporting
Version:
WIR0340
CCI:
Severity:
Low
Description:
If scan results are not properly reported and acted on, then the site could be vulnerable to wireless attack.Information Assurance OfficerECWN-1
If scan results are not properly reported and acted on, then the site could be vulnerable to wireless attack.Information Assurance Officer
Check:
Detailed Policy Requirements: Site implements the following procedures for reporting the results of WMAN intrusion scans: The site will implement a wireless incident process and plan, as part of the site’s Incident Response Plan, for reporting unauthorized access, jamming, or electromagnetic interference identified during active electromagnetic scanning. The site will establish a Standard Operating Procedure (SOP) to address intrusion, jamming, or electromagnetic interference. Check Procedures: Review the site Incident Response Plan and determine if it includes procedures for reporting unauthorized access, jamming, or electromagnetic interference identified during active electromagnetic scanning. - Determine if the site has an SOP that addresses intrusion, jamming, or electromagnetic interference. Mark as a finding if either of these requirements are not met.
Detailed Policy Requirements: Site implements the following procedures for reporting the results of WMAN intrusion scans: The site will implement a wireless incident process and plan, as part of the site’s Incident Response Plan, for reporting unauthorized access, jamming, or electromagnetic interference identified during active electromagnetic scanning. The site will establish a Standard Operating Procedure (SOP) to address intrusion, jamming, or electromagnetic interference. Check Procedures: Review the site Incident Response Plan and determine if it includes procedures for reporting unauthorized access, jamming, or electromagnetic interference identified during active electromagnetic scanning. - Determine if the site has an SOP that addresses intrusion, jamming, or electromagnetic interference. Mark as a finding if either of these requirements are not met.
Fix:
Comply with policy.
Comply with policy.
Vuln ID:
V-18617
Rule ID:
SV-20174r1_rule
Group ID:
WMAN TEMPEST compliance
Version:
WIR0345
CCI:
Severity:
Low
Description:
Sensitive or classified information could be compromised via a TEMPEST vulnerability.Information Assurance OfficerDesignated Approving AuthorityECWN-1
Sensitive or classified information could be compromised via a TEMPEST vulnerability.Information Assurance OfficerDesignated Approving Authority
Check:
NOTE: This check should only be reviewed during the initial system Certification and Accreditation (C&A). Interview the IAO and review the site SSAA/SSP or DIACAP documentation to verify the Department or Agency CTTA has completed the required evaluation. Mark as a finding if the required evaluation has not been completed.
NOTE: This check should only be reviewed during the initial system Certification and Accreditation (C&A). Interview the IAO and review the site SSAA/SSP or DIACAP documentation to verify the Department or Agency CTTA has completed the required evaluation. Mark as a finding if the required evaluation has not been completed.
Fix:
Comply with policy.
Comply with policy.
Vuln ID:
V-19903
Rule ID:
SV-22073r1_rule
Group ID:
WMAN authentication - Subscriber to Network
Version:
WIR0315-02
CCI:
Severity:
Medium
Description:
Broadband systems not compliant with authentication requirements could allow a hacker to gain access to the DoD network.System AdministratorInformation Assurance OfficerECSC-1, ECWN-1
Broadband systems not compliant with authentication requirements could allow a hacker to gain access to the DoD network.System AdministratorInformation Assurance Officer
Check:
Detailed Policy Requirements: The site WMAN systems must implement strong authentication from the User or WMAN subscriber device to WMAN network. -For tactical or commercial WMAN systems operated in a non-tactical environment: User ID and password or shared secret authentication shall be implemented between the user or WMAN subscriber device to the WMAN network. When user ID/Password are used, the length requirements of the password must be compliant with JTF-GNO CTO 07-15Rev1: o 15 character password length (or the maximum length supported by the system if a 15 character password is not supported). Check Procedures: For non-tactical WMAN systems, verify the system uses either User ID and password or shared secret authentication between the User or WMAN subscriber device (respectively) to the WMAN network. If User ID and password is used, verify the password meets the length requirements of CTO 07-15Rev1. Mark as a finding if the password length requirements are not met.
Detailed Policy Requirements: The site WMAN systems must implement strong authentication from the User or WMAN subscriber device to WMAN network. -For tactical or commercial WMAN systems operated in a non-tactical environment: User ID and password or shared secret authentication shall be implemented between the user or WMAN subscriber device to the WMAN network. When user ID/Password are used, the length requirements of the password must be compliant with JTF-GNO CTO 07-15Rev1: o 15 character password length (or the maximum length supported by the system if a 15 character password is not supported). Check Procedures: For non-tactical WMAN systems, verify the system uses either User ID and password or shared secret authentication between the User or WMAN subscriber device (respectively) to the WMAN network. If User ID and password is used, verify the password meets the length requirements of CTO 07-15Rev1. Mark as a finding if the password length requirements are not met.
Fix:
Comply with requirement.
Comply with requirement.
Vuln ID:
V-19904
Rule ID:
SV-22074r1_rule
Group ID:
WMAN authentication - Subscriber to Network
Version:
WIR0315-03
CCI:
Severity:
Medium
Description:
Broadband systems not compliant with authentication requirements could allow a hacker to gain access to the DoD network.System AdministratorInformation Assurance OfficerECSC-1, ECWN-1
Broadband systems not compliant with authentication requirements could allow a hacker to gain access to the DoD network.System AdministratorInformation Assurance Officer
Check:
Detailed Policy Requirements: The IAO has not ensured that site WMAN systems implement strong authentication from the User or WMAN subscriber device to WMAN network. -For tactical or commercial WMAN systems operated in a non-tactical environment: User ID and password or shared secret authentication shall be implemented between the User or WMAN subscriber device to the WMAN network. When user ID and password are used, the complexity requirements of the password must be compliant with JTF-GNO CTO 07-15Rev1: --Password complexity is a case sensitive mixture of upper case letters, lower case letters, special characters, and numbers, including at least one of each. Check Procedures: - For non-tactical WMAN systems, verify the system uses either User ID and password or shared secret authentication between the User or WMAN subscriber device (respectively) to the WMAN network. If User ID and password is used, verify the password meets the complexity requirements of CTO 07-15Rev1. Have the system administrator show the password complexity settings in the management console of the WMAN access point. Mark as a finding if the requirements are not met.
Detailed Policy Requirements: The IAO has not ensured that site WMAN systems implement strong authentication from the User or WMAN subscriber device to WMAN network. -For tactical or commercial WMAN systems operated in a non-tactical environment: User ID and password or shared secret authentication shall be implemented between the User or WMAN subscriber device to the WMAN network. When user ID and password are used, the complexity requirements of the password must be compliant with JTF-GNO CTO 07-15Rev1: --Password complexity is a case sensitive mixture of upper case letters, lower case letters, special characters, and numbers, including at least one of each. Check Procedures: - For non-tactical WMAN systems, verify the system uses either User ID and password or shared secret authentication between the User or WMAN subscriber device (respectively) to the WMAN network. If User ID and password is used, verify the password meets the complexity requirements of CTO 07-15Rev1. Have the system administrator show the password complexity settings in the management console of the WMAN access point. Mark as a finding if the requirements are not met.
Fix:
Comply with requirement.
Comply with requirement.
Vuln ID:
V-23747
Rule ID:
SV-28651r4_rule
Group ID:
Two NTP servers are not used to synchronize time.
Version:
NET0812
CCI:
Severity:
Low
Description:
Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If logs cannot be successfully compared between each of the routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network devices to synchronize to an accurate time source.System AdministratorInformation Assurance OfficerECSC-1
Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If logs cannot be successfully compared between each of the routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network devices to synchronize to an accurate time source.System AdministratorInformation Assurance Officer
Check:
Review the configuration and verify two NTP servers have been defined. If the device is not configured to use two separate NTP servers, this is a finding.
Review the configuration and verify two NTP servers have been defined. If the device is not configured to use two separate NTP servers, this is a finding.
Fix:
Configure the device to use two separate NTP servers.
Configure the device to use two separate NTP servers.
Vuln ID:
V-28784
Rule ID:
SV-36774r4_rule
Group ID:
Call home service is disabled.
Version:
NET0405
CCI:
Severity:
Medium
Description:
Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.Information Assurance OfficerNetwork Security OfficerECSC-1
Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.Information Assurance OfficerNetwork Security Officer
Check:
Review the device configuration to determine if the call home service or feature is disabled on the device. If the call home service is enabled on the device, this is a finding.
Review the device configuration to determine if the call home service or feature is disabled on the device. If the call home service is enabled on the device, this is a finding. Note: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.
Fix:
Configure the network device to disable the call home service or feature.
Configure the network device to disable the call home service or feature. Note: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.