Bluetooth/Zigbee Security Technical Implementation Guide

Version	Date	Finding Count (4)			Downloads
6	2011-10-07 2013-03-14 2013-03-14 2013-03-14 2013-03-14 2014-03-18 2014-03-18 2014-03-18 2014-03-18 2014-03-18 2014-03-18 2014-03-18 2014-03-18 2014-03-18	CAT I (High): 1	CAT II (Med): 2	CAT III (Low): 1	Excel	JSON	XML

STIG Description
This STIG contains the technical security controls for the operation of Bluetooth/Zigbee devices in the DoD environment.

Classified	Public	Sensitive
I - Mission Critical Classified	I - Mission Critical Public	I - Mission Critical Sensitive	II - Mission Support Classified	II - Mission Support Public	II - Mission Support Sensitive	III - Administrative Classified	III - Administrative Public	III - Administrative Sensitive

Finding ID	Severity	Title	Description
V-4634	High	Bluetooth (and Zigbee) devices must not be used to send, receive, store, or process classified information.	Classified data could be compromised since Bluetooth (and Zigbee) devices do not meet DoD encryption requirements for classified data.
V-18619	Medium	Bluetooth peripherals must conform to the DoD Bluetooth Peripheral Device Security Requirements Specification.	Sensitive unclassified voice and data communications could be intercepted and exposed if required security controls are not used.
V-3499	Medium	If Bluetooth (or Zigbee) devices transmit unclassified DoD data communications, then they must use FIPS 140-2 validated cryptographic modules for data in transit, including digital voice communications.	FIPS validation provides assurance that the cryptographic modules are implemented correctly and resistant to compromise. Failure to use FIPS 140-2 validated cryptographic modules makes it more...
V-30360	Low	The site must have a written policy or training materials stating Bluetooth must be disabled on all applicable devices unless they employ FIPS 140-2 validated cryptographic modules for data-in-transit.	Policy and training provide assurance that security requirements will be implemented in practice. Failure to use FIPS 140-2 validated cryptography makes data more vulnerable to security breaches.