The system must not have a public Instant Messaging (IM) client installed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-12024	GEN006000	SV-35205r1_rule	ECIM-1	Medium

Description
Public IM systems are not approved for use and may result in the unauthorized distribution of information. IM clients provide a way for a user to send a message to one or more other users in real time. Additional capabilities may include file transfer and support for distributed game playing. Communication between clients and associated directory services are managed through messaging servers. Commercial IM clients include AOL Instant Messenger (AIM), MSN Messenger, and Yahoo! Messenger. IM clients present a security issue when the clients route messages through public servers. The obvious implication is potentially sensitive information could be intercepted or altered in the course of transmission. This same issue is associated with the use of public e-mail servers. In order to reduce the potential for disclosure of sensitive government information and to ensure the validity of official government information, IM clients connecting to public IM services will not be installed. Clients using access to internal or DoD-controlled IM services are permitted.

Description

Public IM systems are not approved for use and may result in the unauthorized distribution of information. IM clients provide a way for a user to send a message to one or more other users in real time. Additional capabilities may include file transfer and support for distributed game playing. Communication between clients and associated directory services are managed through messaging servers. Commercial IM clients include AOL Instant Messenger (AIM), MSN Messenger, and Yahoo! Messenger. IM clients present a security issue when the clients route messages through public servers. The obvious implication is potentially sensitive information could be intercepted or altered in the course of transmission. This same issue is associated with the use of public e-mail servers. In order to reduce the potential for disclosure of sensitive government information and to ensure the validity of official government information, IM clients connecting to public IM services will not be installed. Clients using access to internal or DoD-controlled IM services are permitted.

STIG	Date
HP-UX 11.31 Security Technical Implementation Guide	2017-05-19

Details

Check Text ( C-36690r1_chk )
NOTE: This will virtually always require a manual review. If an IM client is installed, ask the SA if it has access to any public domain IM servers. If it does have access to public servers, this is a finding.

Fix Text (F-32064r1_fix)
Uninstall the IM client from the system, or configure the client to only connect to DoD-approved IM services.