The Enterprise Voice, Video, and Messaging Endpoint must be configured to prevent the configuration or display of configuration settings without the use of a PIN or password.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259941	SRG-NET-000015-VVEP-00101	SV-259941r948792_rule		Medium

Description
Many Enterprise Voice, Video, and Messaging Endpoints can set or display configuration settings in the instrument itself. This presents a risk if a user obtains information such as the IP addresses and URLs of system components. This obtained information could be used to facilitate an attack on the system. Therefore, these devices should be considered a target to be defended against such individuals that would collect voice network information for illicit purposes. To mitigate information gathering by the adversaries, measures must be taken to protect this information.

Description

Many Enterprise Voice, Video, and Messaging Endpoints can set or display configuration settings in the instrument itself. This presents a risk if a user obtains information such as the IP addresses and URLs of system components. This obtained information could be used to facilitate an attack on the system. Therefore, these devices should be considered a target to be defended against such individuals that would collect voice network information for illicit purposes. To mitigate information gathering by the adversaries, measures must be taken to protect this information.

STIG	Date
Enterprise Voice, Video, and Messaging Endpoint Security Requirements Guide	2024-03-06

Details

Check Text ( C-63672r948790_chk )
Verify the Enterprise Voice, Video, and Messaging Endpoint is configured to prevent the configuration or display of configuration settings without the use of a PIN or password. If the Enterprise Voice, Video, and Messaging Endpoint does not prevent the configuration or display of configuration settings without the use of a PIN or password, this is a finding.

Fix Text (F-63579r948791_fix)
Configure the Enterprise Voice, Video, and Messaging Endpoint to prevent the configuration or display of configuration settings without the use of a PIN or password.