{
"stig": {
"date": "2013-10-08",
"description": "IDS/IPS Security Technical Implementation Guide",
"findings": {
"V-14646": {
"checkid": "C-13714r3_chk",
"checktext": "Review the network device or syslog server to determine whether alerts are configured to automatically generate and notify the administrator when seventy-five percent or more of the storage capacity has been reached with log data.",
"description": "Configuring the network device or syslog server to provide alerts to the administrator in the event of modification or audit log capacity being exceeded ensures administrative staff is aware of critical alerts. Without this type of notification setup, logged audits and events could potentially fill to capacity, causing subsequent records to not be recorded and dropped without any knowledge by the administrative staff. Other unintended consequences of filling the log storage to capacity may include a denial of service of the device itself without proper notification.",
"fixid": "F-14748r3_fix",
"fixtext": "Configure the network device or syslog server to automatically generate and notify the administrator when seventy-five percent or more of the storage capacity has been reached with log data. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-14646",
"ruleID": "SV-15272r2_rule",
"severity": "low",
"title": "Alerts must be automatically generated to notify the administrator when log storage reaches seventy-five percent or more of its maximum capacity.",
"version": "NET0386"
},
"V-14671": {
"checkid": "C-12793r5_chk",
"checktext": "Review the device configuration and verify it is authenticating the NTP messages received from the NTP server or peer. Authentication must be performed using either PKI (supported in NTP v4) or SHA-1 hashing algorithm. If SHA-1 is not supported by both the NTP client and server, then MD5 can be used.",
"description": "Since NTP is used to ensure accurate log file timestamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. \n\nTwo NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka \u201csymmetric mode\u201d). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client\u2019s stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers.\n\nA hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device looses connectivity to it upstream NTP server, it will be able to choose time from one of its peers. \n\nThe NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It\u2019s not used to authenticate NTP clients because NTP servers don\u2019t care about the authenticity of their clients, as they never accept any time from them. \n",
"fixid": "F-14132r1_fix",
"fixtext": "Configure the device to authenticate all received NTP messages using either PKI (supported in NTP v4) or SHA-1 hashing algorithm. If SHA-1 is not supported by this client or the NTP peer or server, then MD5 can be used.",
"iacontrols": [
"ECSC-1"
],
"id": "V-14671",
"ruleID": "SV-15327r2_rule",
"severity": "medium",
"title": "The network element must authenticate all NTP messages received from NTP servers and peers.",
"version": "NET0813"
},
"V-14717": {
"checkid": "C-12924r6_chk",
"checktext": "Review the configuration and verify SSH Version 1 is not being used for administrative access.",
"description": "SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to attacks, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1. ",
"fixid": "F-14184r3_fix",
"fixtext": "Configure the network element to use SSH version 2. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-14717",
"ruleID": "SV-15459r2_rule",
"severity": "medium",
"title": "The network element must not allow SSH Version 1 to be used for administrative access.",
"version": "NET1647"
},
"V-17821": {
"checkid": "C-19238r3_chk",
"checktext": "The managed network element\u2019s OOBM interface must be configured with an IP address from the address space belonging to the OOBM network. After determining which interface is connected to the OOBM access switch, review the managed device configuration and verify the interface has been assigned an address from the local management address block. ",
"description": "The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.",
"fixid": "F-17736r1_fix",
"fixtext": "Configure the managed network element\u2019s OOBM interface with an IP address from the address space belonging to the OOBM network.",
"iacontrols": [
"ECSC-1"
],
"id": "V-17821",
"ruleID": "SV-19075r2_rule",
"severity": "medium",
"title": "The network element\u2019s OOBM interface must be configured with an OOBM network address.",
"version": "NET0991"
},
"V-18484": {
"checkid": "C-21099r2_chk",
"checktext": "Verify the IP address assigned to IDPS consoles and servers are designated for the management network.",
"description": "Sensors and agents monitor and analyze activity. The term sensor is typically used for IDPSs that monitor networks, including network-based, wireless, and network behavior analysis technologies. The term agent is typically used for host-based IDPS technologies. \n\nA management server is a centralized device that receives information from the sensors or agents and manages them. Some management servers perform analysis on the event information that the sensors or agents provide and can identify events that the individual sensors or agents cannot. Matching event information from multiple sensors or agents, such as finding events triggered by the same IP address, is known as correlation. Management servers are available as both appliance and software-only products. Some small IDPS deployments do not use any management servers, but most IDPS deployments do. In larger IDPS deployments, there are often multiple management servers, and in some cases there are two tiers of management servers.\n",
"fixid": "F-19076r2_fix",
"fixtext": "Configure all IDPS consoles and servers with IP addresses designated for the management network.",
"iacontrols": [
"EBBD-1"
],
"id": "V-18484",
"ruleID": "SV-20019r2_rule",
"severity": "medium",
"title": "IDPS consoles, management and database servers must reside on the management network.",
"version": "NET-IDPS-002"
},
"V-18489": {
"checkid": "C-21120r1_chk",
"checktext": "Review the configuration and ensure the interfaces with data flow do not have an IP address.",
"description": "Administrators should ensure that for both passive and inline sensors, IP addresses are not\nassigned to the network interfaces used to monitor network traffic. Only networks interfaces used for IDPS management should have an IP address assigned. Operating a sensor without IP addresses assigned to its monitoring interfaces is known as operating in stealth mode. Stealth mode improves the security of the IDPS sensors because it prevents other hosts from initiating connections to them. This conceals the sensors from attackers and thus limits their exposure to attacks. If monitoring is being performed using a switch SPAN port, it is recommended that the IDPS is configured in Stealth Mode; the NIC connected to the SPAN port would not have any network protocol stacks bound to it. A second NIC would then be connected to an OOB network. Stealth mode will reduce the risk of the IDPS itself being attacked.",
"fixid": "F-19081r1_fix",
"fixtext": "Remove the IP addresses from all interfaces monitoring data flow.",
"iacontrols": [
"DCCS-1"
],
"id": "V-18489",
"ruleID": "SV-20024r1_rule",
"severity": "medium",
"title": "The Network IDPS administrator will ensure all Network IDPS systems are installed and operational in stealth mode \u2014no ip address on interface with data flow.",
"version": "NET-IDPS-001"
},
"V-18501": {
"checkid": "C-21186r1_chk",
"checktext": "Check the thresholds to ensure a message is sent when data overflow has occurred.",
"description": "Scaling IDPS sensors to avoid missed packets as a result of CPU and memory thresholds when link mbps is greater than what the engine can inspect should be an initial consideration prior to deployment. The IDPS administrator will have the sensor send notifications to the syslog server or central controller when thresholds limits do occur.\n\nAs mentioned in the guidance for Server Farms, VACLs can also be a useful tool to help scale the traffic a sensor receives. The VACL capture feature allows you to mirror traffic to ports configured to forward captured traffic. By defining the interested traffic, for instance web traffic, a copy of the http traffic only could be forwarded to the sensing interface avoiding data overflow. Additional design options such as Remote Switch Port Analyzer (RSPAN) are available and should be considered by the network engineer.\n",
"fixid": "F-19092r1_fix",
"fixtext": "Configure the device to send messages to indicate data overflow is occurring.",
"iacontrols": [
"ECTP-1"
],
"id": "V-18501",
"ruleID": "SV-20036r1_rule",
"severity": "medium",
"title": "The IAO/NSO will ensure notifications are sent to the syslog server or central controller when threshold limits exceed the sensor\u2019s capacity.",
"version": "NET-IDPS-004"
},
"V-18502": {
"checkid": "C-21189r1_chk",
"checktext": "Review the Whitelists and Blacklists used by the IDPS and interview the SA to determine when the last update occurred. These lists are updated frequently by the vendor.",
"description": "A blacklist is a list of discrete entities, such as hosts, TCP or UDP port numbers, ICMP types and codes, applications, usernames, URLs, filenames, or file extensions, that have been previously determined to be associated with malicious activity. Blacklists, also known as hot lists, are typically used to allow IDPSs to recognize and block activity that is highly likely to be malicious, and may also be used to assign a higher priority to alerts that match entries on the blacklists. Some IDPSs generate dynamic blacklists that are used to temporarily block recently detected threats (e.g., activity from an attacker\u2019s IP address). A whitelist is a list of discrete entities that are known to be benign. Whitelists are typically used on a granular basis, such as protocol-by-protocol, to reduce or ignore false positives involving known benign activity from trusted hosts. Whitelists and blacklists are most commonly used in signature-based detection and stateful protocol analysis.",
"fixid": "F-19093r1_fix",
"fixtext": "Create a periodic update schedule to review the Whitelists and Blacklist.",
"iacontrols": [
"DCSW-1"
],
"id": "V-18502",
"ruleID": "SV-20037r1_rule",
"severity": "medium",
"title": "The Network IDPS administrator will review whitelists and blacklists regularly and validate all entries to ensure that they are still accurate and necessary.",
"version": "NET-IDPS-005"
},
"V-18508": {
"checkid": "C-21209r1_chk",
"checktext": "Have the IDPS SA display the configuration settings. Verify all http ports are defined and have the SA identify the signatures that will review applications using port redirection. \n\nReview and tune as necessary the signatures that are specific to vulnerabilities in Web servers. ",
"description": "In the Regional Enterprise Enclave different sets of sensors will see different traffic as a result of their location within the regional enclave. By establishing separate signature profiles for each set of sensors, each profile can then be tuned to generate alarms based on the traffic types seen, the attack signatures, and the specific traffic (string signatures) that is relevant to that particular set of sensors. If more than one set of sensors will see the same traffic types, then the same signature profile may be used for both sets. Alerting on specific connection signatures, general attack signatures, and specific string signatures provides focused segment analysis at Layers 4 through 7.\n\nThe IDPS system administrator will ensure the sensor monitoring the web servers is configured for application inspection and control of all web ports e.g. 80, 3128, 8000, 8010, 8080, 8888, 24326, etc. The sensor monitoring the web servers should be capable of inspecting web traffic that is not received on web ports; known as port redirection. In many implementations this is a separate signature that needs to be enabled.\n",
"fixid": "F-19099r1_fix",
"fixtext": "Configure the IDPS to protect the Web components.",
"iacontrols": null,
"id": "V-18508",
"ruleID": "SV-20043r1_rule",
"severity": "medium",
"title": "The Network administrator will implement signatures that detect specific attacks and protocols that should not be seen on the segments containing web servers.",
"version": "NET-IDPS-006"
},
"V-18509": {
"checkid": "C-21245r1_chk",
"checktext": "Signatures are usually defined for each FTP command. Verify all FTP commands are being monitored by the IDPS.",
"description": "In the Regional Enterprise Enclave different sets of sensors will see different traffic as a result of their location within the regional enclave. By establishing separate signature profiles for each set of sensors, each profile can then be tuned to generate alarms based on the traffic types seen, the attack signatures, and the specific traffic (string signatures) that is relevant to that particular set of sensors. If more than one set of sensors will see the same traffic types, then the same signature profile may be used for both sets. Alerting on specific connection signatures, general attack signatures, and specific string signatures provides focused segment analysis at Layers 4 through 7.\n\nNetwork segments containing FTP servers should have sensors installed that monitor, inspect and log all recognized ftp commands, as well as unrecognized ftp commands.",
"fixid": "F-19100r1_fix",
"fixtext": "Add all signatures for FTP commands to the IDPS that monitors file servers.",
"iacontrols": [
"ECSC-1"
],
"id": "V-18509",
"ruleID": "SV-20044r1_rule",
"severity": "medium",
"title": "The Network administrator will implement signatures that detect both specific attacks on public service servers and traffic types (protocols) that should not be seen on the segments containing ftp servers.",
"version": "NET-IDPS-007"
},
"V-18512": {
"checkid": "C-21280r1_chk",
"checktext": "Review the IDPS configuration and ensure the device is protecting the Network Management subnet. Protocols going to the Management network should be known by the SA. Alarms should be generated for unexpected traffic types.",
"description": "The management network must detect all attacks on the management hosts. The management network has a various range of traffic that is permitted. Some of the following traffic is allowed on the\nManagement Hosts Segment: Trivial File Transfer Protocol (TFTP [UDP 69])\u2014For network device configuration files from devices on the Managed Devices Segment; FTP-Data (TCP 20)\u2014For file transfers to network devices on the Managed Devices Segment and for Internet downloads; FTP-Control (TCP 21)\u2014For file transfers to network devices on the Managed Devices Segment and for Internet downloads; Syslog (UDP 514)\u2014From network devices on the Managed Devices Segment; Telnet (TCP 23)\u2014To network devices on the Managed Devices Segment; SSH (TCP 22)\u2014To network devices on the Managed Devices Segment; Network Time Protocol (NTP [UDP 123])\u2014To synchronize the clocks of all network devices on the Managed Devices Segment; HTTP (TCP 80)\u2014To the Internet and from hosts on other segments to download the host-based IPS agent software; HTTPS (TCP 443)\u2014To network devices on the Managed Devices Segment and the Internet as well as between the host-based IPS Console and its agents; TACACS+ (TCP 49)\u2014For administrator authentication to devices on the Managed Devices Segment; RADIUS (UDP 1812/1813 authentication/accounting)\u2014For authentication of administrator remote-access VPN connections coming from the Remote Administration Segment; ICMP (IP Protocol 1)\u2014Echo request and response to reach network devices on the Managed Devices Segment and the Internet; DNS (UDP 53)\u2014For name translation services for management hosts as they access services on the Internet; Simple Network Management Protocol (SNMP [UDP 161])\u2014To query information from network devices on the\nManaged Devices Segment; SNMP-Trap (UDP 162)\u2014To receive trap information from network devices on the Managed Devices Segment.\n",
"fixid": "F-19106r1_fix",
"fixtext": "Implement or modify the sensor to protect the Management Network. Expected traffic to this network should be known by the SA.",
"iacontrols": [
"ECSC-1"
],
"id": "V-18512",
"ruleID": "SV-20047r1_rule",
"severity": "medium",
"title": "The Network IDPS administrator will tune the sensor to alarm if unexpected protocols for network management enter the subnet.",
"version": "NET-IDPS-009"
},
"V-18513": {
"checkid": "C-21281r1_chk",
"checktext": "Ask the SA to identify the signature that protects against IP hijacking of TCP sessions. Ensure the signature is current.",
"description": "There are a number of publicly available tools that exist to facilitate the hijacking of TCP sessions. An attacker using such tools can determine the TCP sequence and acknowledgement numbers that two hosts are using in a communication session. This information could enable the attacker to take over the legitimate network connection of an authorized user and inject commands into the session. This is particularly serious because most forms of one-time passwords do not prevent this access.",
"fixid": "F-19107r1_fix",
"fixtext": "Implement the latest signature from vendor that protects against IP hijacking of TCP sessions.",
"iacontrols": [
"ECSC-1"
],
"id": "V-18513",
"ruleID": "SV-20048r1_rule",
"severity": "medium",
"title": "The Network IDPS administrator will ensure IP hijacking signatures have been implemented with the common default signatures.",
"version": "NET-IDPS-008"
},
"V-18632": {
"checkid": "C-22325r1_chk",
"checktext": "If DHCP is not being used in the network, drop inbound and outbound TCP and UDP packets with the following port numbers: 67, 68, 546, 547, 647, 847, and 2490 on the IDPS.\n",
"description": "Currently, many vendors are not prepared for DHCPv6 stateful autoconfiguration, thus there are very few implementations of it. DHCPv6 is a completely separate protocol than DHCPv4. In IPV6 DHCPDISCOVER use of the unspecified address 0.0.0.0 with a broadcast address. These messages are sent with a FF02::1:2 (RFC3315) via IPv6 support of link-local autoconfiguration. There is also DHCPv6-Prefix Delegation that allows nodes to request not just an address, but also the entire prefix. DHCPv6-PD is primarily used by routers. Stateful autoconfiguration offers the best auditing capabilities due to the logs being centralized at the DHCP server and may become the preferred implementation as the protocol matures.\n\nWhen DHCP is not being used in an IPv6 network, DHCP packets should be filtered at security boundaries and internally at router interfaces where possible. The internal filtering will not completely prevent use since any on-link attacks never pass through a router, hence the IDS recommendations follow.\n\nCreate an IDS check to detect any inconsistencies in the advertised \u201cM or O bit values\u201d of router advertisements on a link.\n\nIf DHCP is not being used in the network, create an IDS check to detect traffic on the commonly used DHCP ports. The following port numbers for both TCP and UDP are associated with DHCP: 67, 68, 546, 547, 647, 847, and 2490. \n",
"fixid": "F-19258r1_fix",
"fixtext": "Apply inspection on IDPS.",
"iacontrols": [
"ECSC-1"
],
"id": "V-18632",
"ruleID": "SV-20192r1_rule",
"severity": "medium",
"title": "The IAO/NSO will ensure if DHCPV6 is not being used in the enclave it will be disabled.",
"version": "NET-IPV6-039"
},
"V-19233": {
"checkid": "C-23256r1_chk",
"checktext": "Review the IDPS configuration and verify the signatures are defined to protect against TCP SYN Flood attacks. If the server farm is being monitored by an IDS as opposed to an IPS that can block traffic inline, the following alternatives can be implemented:\n\nUpon detection of a SYN flood attack, the IDS can dynamically push (or remotely configure) an ACL unto the upstream router or multi-layer switch that can serve as the blocking device for the TCP SYN flood attack.\n\nConfigure TCP Intercept on the server farm's first hop router, MLS, or firewall that is controlling access to the server farm sub-net (VLAN).\n",
"description": "SYN flood sends a flood of TCP/SYN packets, often with a forged sender address. Each of these packets is handled like a connection request, causing the server to spawn a half-open connection, by sending back a TCP/SYN-ACK packet, and waiting for a packet in response from the sender address. However, because the sender address is forged, the response never comes. These half-open connections saturate the number of available connections the server is able to make, keeping it from responding to legitimate requests until after the attack ends.",
"fixid": "F-19906r1_fix",
"fixtext": "Apply current signatures to protect against SYN Flood attacks. If the server farm is being monitored by an IDS as opposed to an IPS that can block traffic inline, the following alternatives can be implemented:\n\nUpon detection of a SYN flood attack, the IDS can dynamically push (or remotely configure) an ACL unto the upstream router or multi-layer switch that can serve as the blocking device for the TCP SYN flood attack.\n\nConfigure TCP Intercept on the server farm's first hop router, MLS, or firewall that is controlling access to the server farm sub-net (VLAN).\n",
"iacontrols": [
"EBBD-1"
],
"id": "V-19233",
"ruleID": "SV-21142r1_rule",
"severity": "medium",
"title": "The IDPS device positioned to protect servers in the server farm or DMZs must provide protection from DoS SYN Flood attacks by dropping half open TCP sessions.",
"version": "NET-IDPS-010"
},
"V-19246": {
"checkid": "C-23276r1_chk",
"checktext": "Have the SA identify the signature and policy established that forges TCP Resets at the perimeter and in front of DMZ server segments when malware and unexpected traffic is identified in the network. \n\nIf an IPS is not in place to provide this safeguard, verify there is a firewall at the described locations providing the safeguard.",
"description": "By listening to the conversation flow of inbound and outbound internet traffic for malware and malware references, the IDPS can prevent unwanted programs entering into the enclave. When it detects unmanaged instant messaging and peer-to-peer protocols or malware coming over IM , the IDPS can prevent the unwanted computer programs from entering the network by spoofing the source and destination machine addresses to send each session partner a TCP Reset packet. The TCP Reset instructs both sender and receiver to cease the current transfer of data.",
"fixid": "F-19908r1_fix",
"fixtext": "Implement TCP Reset protections to protect the enclave from malware and other unexpected network traffic.",
"iacontrols": [
"EBBD-1"
],
"id": "V-19246",
"ruleID": "SV-21157r1_rule",
"severity": "medium",
"title": "The Network IDPS administrator will ensure the IDPS is protecting the enclave from malware and unexpected traffic by using TCP Reset signatures. ",
"version": "NET-IDPS-011"
},
"V-19250": {
"checkid": "C-23279r1_chk",
"checktext": "Verify the IDPS protects against DoS LAND attacks. An effective implementation is the use of an Atomic attack signature that looks at a single packet, because State information ( tracking established connections) is not necessary in identifying this attack.",
"description": "The LAND attack is a denial-of-service (DoS) attack in which an attacker sends a TCP packet (with the SYN bit set) to a system in which the source and destination IP address (along with the source and destination port) are the same. When it was first discovered, many IP stacks crashed the system when they received a LAND attack.",
"fixid": "F-19909r1_fix",
"fixtext": "Implement IDPS signatures that protect against LAND attacks.",
"iacontrols": [
"EBBD-1"
],
"id": "V-19250",
"ruleID": "SV-21161r1_rule",
"severity": "medium",
"title": "The IDPS administrator will ensure LAND DoS signature has been implemented to protect the enclave. ",
"version": "NET-IDPS-012"
},
"V-19256": {
"checkid": "C-23289r1_chk",
"checktext": "Identify the IDPS product and discuss the atomic signature installation with the SA. As defined above, regardless of the product type there are signatures that require state and those that do not. Ensure the atomic signatures are applied to all IDPS within the enclave. As a result of no statefulness, the implementation of atomic signatures do not degrade product performance significantly. Validate the signatures are current.",
"description": "Without an industry agreed-upon set of definitions for IDPS controls, the use of the term signature will apply to all IDPS technologies. Signatures are defined as identifying something, defining it and then stop it from occurring.\n\nSignatures fall into one of the following two basic categories depending on their functionality:\n- Atomic\n- Stateful\n\nAtomic signatures trigger on a single event, they do not require your intrusion system to maintain state. The entire inspection can be accomplished in an atomic operation that does not require any knowledge of past or future activities. these signatures consume minimal resources (such as memory) on the IPS/IDS device. These signatures are easy to understand because they search only for a specific event. \n\n",
"fixid": "F-19911r1_fix",
"fixtext": "Apply Atomic Signatures to all IDPS components in the enclave. Create a Change management process to receive Atomic signatures daily from the vendor if available, else as frequently as available by vendor.",
"iacontrols": [
"EBBD-1"
],
"id": "V-19256",
"ruleID": "SV-21171r1_rule",
"severity": "medium",
"title": "The IDPS Administrator will ensure Atomic Signatures are implemented to protect the enclave.",
"version": "NET-IDPS-013"
},
"V-23747": {
"checkid": "C-3581r3_chk",
"checktext": "Review the configuration and verify two NTP servers have been defined.",
"description": "Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If logs cannot be successfully compared between each of the routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.",
"fixid": "F-3044r1_fix",
"fixtext": "Specify two NTP server IP addresses on the device to be used to request time from.",
"iacontrols": [
"ECSC-1"
],
"id": "V-23747",
"ruleID": "SV-28651r2_rule",
"severity": "low",
"title": "The network element must use two or more NTP servers to synchronize time.",
"version": "NET0812"
},
"V-28784": {
"checkid": "C-35853r2_chk",
"checktext": "Verify the call home service or feature is disabled on the device. ",
"description": "Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.",
"fixid": "F-31103r1_fix",
"fixtext": "Configure the network device to disable the call home service or feature.",
"iacontrols": [
"ECSC-1"
],
"id": "V-28784",
"ruleID": "SV-36774r2_rule",
"severity": "medium",
"title": "A service or feature that calls home to the vendor must be disabled. \n",
"version": "NET0405"
},
"V-3012": {
"checkid": "C-3456r3_chk",
"checktext": "Review the network element configuration to determine if administrative access to the device requires some form of authentication\u2014at a minimum a password is required.",
"description": "Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization\u2019s security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network element. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network element providing opportunity for intruders to compromise resources within the network infrastructure.",
"fixid": "F-3037r5_fix",
"fixtext": "Configure the network element so it will require a password to gain administrative access to the device.",
"iacontrols": [
"ECSC-1",
"IAIA-1",
"IAIA-2"
],
"id": "V-3012",
"ruleID": "SV-3012r2_rule",
"severity": "high",
"title": "The network element must be password protected.",
"version": "NET0230"
},
"V-3013": {
"checkid": "C-3474r8_chk",
"checktext": "Review the device configuration or request that the administrator login to the device and observe the terminal. Verify either Option A or Option B (for systems with character limitations) of the Standard Mandatory DoD Notice and Consent Banner is displayed at logon. The required banner verbiage follows and must be displayed verbatim:\n\nOption A\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and\ncounterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\n\nOption B\n\nIf the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: \u201cI've read & consent to terms in IS user agreem't.\u201d",
"description": "All network devices must present a DoD approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required login warning banner prior to logon attempts will limit DoD\u2019s ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA\u2019s ability to monitor the device\u2019s usage is limited unless a proper warning banner is displayed.\n\nDoD CIO has issued new, mandatory policy standardizing the wording of \u201cnotice and consent\u201d banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, \u201cPolicy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement\u201d, dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.\n",
"fixid": "F-3038r6_fix",
"fixtext": "Configure all management interfaces to the network device to display the DoD mandated warning banner verbiage at login regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows:\n\nOption A\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and\ncounterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\n\nOption B\n\nIf the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: \u201cI've read & consent to terms in IS user agreem't.\u201d",
"iacontrols": [
"ECWM-1"
],
"id": "V-3013",
"ruleID": "SV-3013r2_rule",
"severity": "medium",
"title": "The network element must display the DoD approved login banner warning in accordance with the CYBERCOM DTM-08-060 document.",
"version": "NET0340"
},
"V-3014": {
"checkid": "C-3540r4_chk",
"checktext": "Review the management connection for administrative access and verify the network element is configured to time-out the connection after 10 minutes or less of inactivity.",
"description": "Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled between the managed network element and a PC or terminal server when the later has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network element as well as reduce the risk of a management session from being hijacked. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.",
"fixid": "F-3039r4_fix",
"fixtext": "Configure the network element to ensure the timeout for unattended administrative access connections is no longer than 10 minutes. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-3014",
"ruleID": "SV-3014r2_rule",
"severity": "medium",
"title": "The network element must timeout management connections for administrative access after 10 minutes or less of inactivity.",
"version": "NET1639"
},
"V-3056": {
"checkid": "C-3503r9_chk",
"checktext": "Review the network device configuration and validate there are no group accounts configured for access.",
"description": "Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network.",
"fixid": "F-3081r9_fix",
"fixtext": "Configure individual user accounts for each authorized person then remove any group accounts.",
"iacontrols": [
"IAIA-1",
"IAIA-2"
],
"id": "V-3056",
"ruleID": "SV-3056r5_rule",
"severity": "high",
"title": "Group accounts must not be configured for use on the network device.\n",
"version": "NET0460"
},
"V-3057": {
"checkid": "C-3504r6_chk",
"checktext": "Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the greatest privilege level unless deemed necessary for assigned duties.\n\nIf it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding.",
"description": "By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personell are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.",
"fixid": "F-3082r5_fix",
"fixtext": "Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.",
"iacontrols": [
"ECSC-1"
],
"id": "V-3057",
"ruleID": "SV-3057r3_rule",
"severity": "medium",
"title": "Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.\n",
"version": "NET0465"
},
"V-3058": {
"checkid": "C-3505r4_chk",
"checktext": "Review the organization's responsibilities list and reconcile the list of authorized account with those accounts defined for access to the network device.\n\nIf an unauthorized account is configured for access to the device, this is a finding.",
"description": "A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service, interception of sensitive information, or other destructive actions could potentially take place if an unauthorized account is configured to access the network device.",
"fixid": "F-3083r5_fix",
"fixtext": "Remove any account configured for access to the network device that is not defined in the organization's responsibilities list.",
"iacontrols": [
"ECSC-1",
"IAAC-1"
],
"id": "V-3058",
"ruleID": "SV-3058r3_rule",
"severity": "medium",
"title": "Unauthorized accounts must not be configured for access to the network device.",
"version": "NET0470"
},
"V-3069": {
"checkid": "C-3532r7_chk",
"checktext": "Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols. \n\n-SSHv2\n-SCP\n-HTTPS\n-SSL\n-TLS\n\nIf management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.",
"description": "Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.",
"fixid": "F-3094r5_fix",
"fixtext": "Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.",
"iacontrols": [
"DCNR-1",
"ECSC-1"
],
"id": "V-3069",
"ruleID": "SV-3069r3_rule",
"severity": "medium",
"title": "Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.",
"version": "NET1638"
},
"V-3070": {
"checkid": "C-3542r4_chk",
"checktext": "Review the configuration to verify all attempts to access the device via management connection are logged.",
"description": "Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.",
"fixid": "F-3095r3_fix",
"fixtext": "Configure the device to log all access attempts to the device to establish a management connection for administrative access.",
"iacontrols": [
"ECAT-1",
"ECAT-2"
],
"id": "V-3070",
"ruleID": "SV-3070r2_rule",
"severity": "low",
"title": "The network element must log all attempts to establish a management connection for administrative access.",
"version": "NET1640"
},
"V-3143": {
"checkid": "C-40236r1_chk",
"checktext": "Review the network element configuration to determine if the vendor default password is active.",
"description": "Network elements not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well known; hence, not removing them prior to deploying the network element into production provides an opportunity for a malicious user to gain unauthorized access to the device.",
"fixid": "F-35391r2_fix",
"fixtext": "Remove any vendor default passwords from the network element configuration.",
"iacontrols": [
"ECSC-1"
],
"id": "V-3143",
"ruleID": "SV-3143r2_rule",
"severity": "high",
"title": "The network element must not have any default manufacturer passwords.",
"version": "NET0240"
},
"V-3160": {
"checkid": "C-3549r2_chk",
"checktext": "Have the administrator display the OS version in operation. The OS must be current with related IAVMs addressed. \n",
"description": "Network devices not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches, as well as enhancements to IP security. Viruses, denial of service attacks, system weaknesses, back doors and other potentially harmful situations could render a system vulnerable, allowing unauthorized access to DoD assets.",
"fixid": "F-3185r2_fix",
"fixtext": "Update operating system and address all related IAVMs. \n",
"iacontrols": [
"ECSC-1"
],
"id": "V-3160",
"ruleID": "SV-3160r2_rule",
"severity": "medium",
"title": "The network element must be running a current and supported operating system with all IAVMs addressed.",
"version": "NET0700"
},
"V-3175": {
"checkid": "C-3516r7_chk",
"checktext": "Review the network device configuration to verify all management connections for administrative access require authentication.",
"description": "Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.",
"fixid": "F-3200r3_fix",
"fixtext": "Configure authentication for all management connections.",
"iacontrols": [
"ECSC-1"
],
"id": "V-3175",
"ruleID": "SV-3175r3_rule",
"severity": "high",
"title": "The network device must require authentication prior to establishing a management connection for administrative access.",
"version": "NET1636"
},
"V-3176": {
"checkid": "C-3680r1_chk",
"checktext": "The SA shall define clipping levels / thresholds as a baseline to display alert messages on specific attacks identifying the potential security violation or attack. Review the IDS or firewall configuration to determine what alerts have been defined and how the notifications are performed.",
"description": "The IDS or firewall is the first device that is under the sites control that has the possibility to alarm the local staff of an ongoing attack. An alert from either of these devices can be the first indication of an attack or system failure.\n",
"fixid": "F-3201r1_fix",
"fixtext": "Configure the IDS or firewall to alarm the SA of potential attacks or system failure.\n\n",
"iacontrols": [
"ECAT-2",
"ECSC-1"
],
"id": "V-3176",
"ruleID": "SV-3176r1_rule",
"severity": "medium",
"title": "The IAO/NSO will ensure the IDS or firewall is configured to alert the administrator of a potential attack or system failure. ",
"version": "NET0390"
},
"V-3179": {
"checkid": "C-21184r1_chk",
"checktext": "Verify the mechanism controlling the spooling of IDPS data is in place to move the data to the Network Management network.",
"description": "Events on the sensor are typically stored on a large input queue. The queue in the sensor is typically very large and can hold several days of logging events under normal conditions. Nevertheless, the monitoring application must retrieve events from the sensor before the queue becomes full; otherwise the sensor will start overwriting the unread events.",
"fixid": "F-19091r1_fix",
"fixtext": "Configure the IDPS sensor to spool the IDS data before data overflow occurs.",
"iacontrols": [
"ECAT-2",
"ECTP-1"
],
"id": "V-3179",
"ruleID": "SV-3179r1_rule",
"severity": "medium",
"title": "The IAO/NSO will ensure the sensor\u2019s monitoring application or mechanism retrieves events from the sensor before the queue becomes full.",
"version": "NET-IDPS-003"
},
"V-3196": {
"checkid": "C-3820r5_chk",
"checktext": "Review the device configuration to verify it is configured to use SNMPv3 with both SHA authentication and privacy using AES encryption.\n\nIf the site is using Version 1 or Version 2 with all of the appropriate patches and has developed a migration plan to implement the Version 3 Security Model, this finding can be downgraded to a Category II.\n\nTo verify the appropriate patches on CISCO devices: Check the following IAVMs associated with SNMPv1: \n\n1. 2001-B-0001 (V0005809) Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability\n2. 2002-A-SNMP-001 (V0005835) Multiple Simple Network Management Protocol Vulnerabilities in Perimeter Devices (Cisco Security Advisory: Malformed SNMP Message-Handling Vulnerabilities)\n\nTo verify the appropriate patches on other vendors refer to this web site: http://www.cert.org/advisories/CA-2002-03.html.\n\nIf the targeted asset is running SNMPv3 and does not support SHA or AES, but the device is configured to use MD5 authentication and DES or 3DES encryption, then the finding can be downgraded to a Category III.\n\nIf the site is using Version 1 or Version 2 and has installed all of the appropriate patches or upgrades to mitigate any known security vulnerabilities, this finding can be downgraded to a Category II. In addition, if the device does not support SNMPv3, this finding can be downgraded to a Category III provided all of the appropriate patches to mitigate any known security vulnerabilities have been applied and has developed a migration plan that includes the device upgrade to support Version 3 and the implementation of the Version 3 Security Model.\n ",
"description": "SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network.",
"fixid": "F-3221r3_fix",
"fixtext": "If SNMP is enabled, configure the network element to use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography (i.e., SHA authentication and AES encryption).\n",
"iacontrols": [
"ECSC-1"
],
"id": "V-3196",
"ruleID": "SV-3196r2_rule",
"severity": "high",
"title": "The network element must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.",
"version": "NET1660"
},
"V-3210": {
"checkid": "C-3822r5_chk",
"checktext": "Review the network element configuration and verify if either of the SNMP community strings \u201cpublic\u201d or \u201cprivate\u201d is being used.",
"description": "Network elements may be distributed by the vendor pre-configured with an SNMP agent using the well known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network element using the read community string \"public\". In addition, an attacker can change a system configuration using the write community string \"private\".",
"fixid": "F-3235r4_fix",
"fixtext": "Configure unique SNMP community strings replacing the default community strings.",
"iacontrols": [
"ECSC-1",
"IAIA-1",
"IAIA-2"
],
"id": "V-3210",
"ruleID": "SV-3210r2_rule",
"severity": "high",
"title": "The network element must not use the default or well-known SNMP community strings public and private.",
"version": "NET1665"
},
"V-3967": {
"checkid": "C-3511r3_chk",
"checktext": "Review the configuration and verify a session using the console port will time out after 10 minutes or less of inactivity.",
"description": "Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network element. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.",
"fixid": "F-3900r4_fix",
"fixtext": "Configure the timeout for idle console connection to 10 minutes or less.",
"iacontrols": [
"ECSC-1"
],
"id": "V-3967",
"ruleID": "SV-3967r2_rule",
"severity": "medium",
"title": "The network element must time out access to the console port after 10 minutes or less of inactivity.",
"version": "NET1624"
},
"V-4582": {
"checkid": "C-3510r4_chk",
"checktext": "Review the network device's configuration and verify authentication is required for console access.",
"description": "Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.",
"fixid": "F-4515r4_fix",
"fixtext": "Configure authentication for console access on the network device.",
"iacontrols": [
"IAIA-1",
"IAIA-2"
],
"id": "V-4582",
"ruleID": "SV-4582r3_rule",
"severity": "high",
"title": "The network device must require authentication for console access.",
"version": "NET1623"
},
"V-5611": {
"checkid": "C-3527r4_chk",
"checktext": "Review the configuration and verify management access to the device is allowed only from hosts within the management network.",
"description": "Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment, could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.",
"fixid": "F-5522r3_fix",
"fixtext": "Configure an ACL or filter to restrict management access to the device from only the management network.\n\n",
"iacontrols": [
"ECSC-1"
],
"id": "V-5611",
"ruleID": "SV-5611r2_rule",
"severity": "medium",
"title": "The network element must only allow management connections for administrative access from hosts residing in the management network.",
"version": "NET1637"
},
"V-5612": {
"checkid": "C-3534r4_chk",
"checktext": "Review the configuration and verify the timeout is set for 60 seconds or less. The SSH service terminates the connection if protocol negotiation (that includes user authentication) is not complete within this timeout period.",
"description": "An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for the malicious user attempting to make a connection to the network element.",
"fixid": "F-5523r4_fix",
"fixtext": "Configure the network element so it will require a secure shell timeout of 60 seconds or less.",
"iacontrols": [
"ECSC-1"
],
"id": "V-5612",
"ruleID": "SV-5612r2_rule",
"severity": "medium",
"title": "The network element must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.",
"version": "NET1645"
},
"V-5613": {
"checkid": "C-3538r4_chk",
"checktext": "Review the configuration and verify the number of unsuccessful SSH login attempts is set at 3.",
"description": "An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.",
"fixid": "F-5524r7_fix",
"fixtext": "Configure the network element to require a maximum number of unsuccessful SSH login attempts at 3.",
"iacontrols": [
"ECSC-1"
],
"id": "V-5613",
"ruleID": "SV-5613r2_rule",
"severity": "medium",
"title": "The network element must be configured for a maximum number of unsuccessful SSH login attempts set at 3 before resetting the interface. ",
"version": "NET1646"
},
"V-5646": {
"checkid": "C-3604r8_chk",
"checktext": "Review the device configuration to determine if threshold filters or timeout periods are set for dropping excessive half-open TCP connections.\n\nFor timeout periods, the time should be set to 10 seconds or less. If the device can not be configured for 10 seconds or less, it should be set to the least amount of time allowable in the configuration. Threshold filters will need to be determined by the organization for optimal filtering.",
"description": "A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance of that acknowledgement is sent by the originator.\n\nAn attacker\u2019s goal in this scenario is to cause a denial of service to the network or device by initiating a high volume of TCP packets, then never sending an acknowledgement, leaving connections in a half-opened state. Without the device having a connection or time threshold for these half-opened sessions, the device risks being a victim of a denial of service attack. Setting a TCP timeout threshold will instruct the device to shut down any incomplete connections. Services such as SSH, BGP, SNMP, LDP, etc. are some services that may be prone to these types of denial of service attacks. If the router does not have any BGP connections with BGP neighbors across WAN links, values could be set to even tighter constraints.",
"fixid": "F-5557r6_fix",
"fixtext": "Configure the device to drop half-open TCP connections through threshold filtering or timeout periods.",
"iacontrols": [
"ECSC-1"
],
"id": "V-5646",
"ruleID": "SV-5646r4_rule",
"severity": "medium",
"title": "The network device must drop half-open TCP connections through filtering thresholds or timeout periods.",
"version": "NET0965"
},
"V-7011": {
"checkid": "C-3513r3_chk",
"checktext": "Review the configuration and verify the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected.",
"description": "The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network.\n\nSecured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.",
"fixid": "F-6614r3_fix",
"fixtext": "Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.",
"iacontrols": [
"ECSC-1"
],
"id": "V-7011",
"ruleID": "SV-7365r2_rule",
"severity": "low",
"title": "The network element\u2019s auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.",
"version": "NET1629"
}
},
"profiles": {
"MAC-1_Classified": {
"description": "",
"findings": {
"V-14646": "true",
"V-14671": "true",
"V-14717": "true",
"V-17821": "true",
"V-18484": "true",
"V-18489": "true",
"V-18501": "true",
"V-18502": "true",
"V-18508": "true",
"V-18509": "true",
"V-18512": "true",
"V-18513": "true",
"V-18632": "true",
"V-19233": "true",
"V-19246": "true",
"V-19250": "true",
"V-19256": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3176": "true",
"V-3179": "true",
"V-3196": "true",
"V-3210": "true",
"V-3967": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5646": "true",
"V-7011": "true"
},
"id": "MAC-1_Classified",
"title": "I - Mission Critial Classified"
},
"MAC-1_Public": {
"description": "",
"findings": {
"V-14646": "true",
"V-14671": "true",
"V-14717": "true",
"V-17821": "true",
"V-18484": "true",
"V-18489": "true",
"V-18501": "true",
"V-18502": "true",
"V-18508": "true",
"V-18509": "true",
"V-18512": "true",
"V-18513": "true",
"V-18632": "true",
"V-19233": "true",
"V-19246": "true",
"V-19250": "true",
"V-19256": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3176": "true",
"V-3179": "true",
"V-3196": "true",
"V-3210": "true",
"V-3967": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5646": "true",
"V-7011": "true"
},
"id": "MAC-1_Public",
"title": "I - Mission Critial Public"
},
"MAC-1_Sensitive": {
"description": "",
"findings": {
"V-14646": "true",
"V-14671": "true",
"V-14717": "true",
"V-17821": "true",
"V-18484": "true",
"V-18489": "true",
"V-18501": "true",
"V-18502": "true",
"V-18508": "true",
"V-18509": "true",
"V-18512": "true",
"V-18513": "true",
"V-18632": "true",
"V-19233": "true",
"V-19246": "true",
"V-19250": "true",
"V-19256": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3176": "true",
"V-3179": "true",
"V-3196": "true",
"V-3210": "true",
"V-3967": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5646": "true",
"V-7011": "true"
},
"id": "MAC-1_Sensitive",
"title": "I - Mission Critial Sensitive"
},
"MAC-2_Classified": {
"description": "",
"findings": {
"V-14646": "true",
"V-14671": "true",
"V-14717": "true",
"V-17821": "true",
"V-18484": "true",
"V-18489": "true",
"V-18501": "true",
"V-18502": "true",
"V-18508": "true",
"V-18509": "true",
"V-18512": "true",
"V-18513": "true",
"V-18632": "true",
"V-19233": "true",
"V-19246": "true",
"V-19250": "true",
"V-19256": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3176": "true",
"V-3179": "true",
"V-3196": "true",
"V-3210": "true",
"V-3967": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5646": "true",
"V-7011": "true"
},
"id": "MAC-2_Classified",
"title": "II - Mission Support Classified"
},
"MAC-2_Public": {
"description": "",
"findings": {
"V-14646": "true",
"V-14671": "true",
"V-14717": "true",
"V-17821": "true",
"V-18484": "true",
"V-18489": "true",
"V-18501": "true",
"V-18502": "true",
"V-18508": "true",
"V-18509": "true",
"V-18512": "true",
"V-18513": "true",
"V-18632": "true",
"V-19233": "true",
"V-19246": "true",
"V-19250": "true",
"V-19256": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3176": "true",
"V-3179": "true",
"V-3196": "true",
"V-3210": "true",
"V-3967": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5646": "true",
"V-7011": "true"
},
"id": "MAC-2_Public",
"title": "II - Mission Support Public"
},
"MAC-2_Sensitive": {
"description": "",
"findings": {
"V-14646": "true",
"V-14671": "true",
"V-14717": "true",
"V-17821": "true",
"V-18484": "true",
"V-18489": "true",
"V-18501": "true",
"V-18502": "true",
"V-18508": "true",
"V-18509": "true",
"V-18512": "true",
"V-18513": "true",
"V-18632": "true",
"V-19233": "true",
"V-19246": "true",
"V-19250": "true",
"V-19256": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3176": "true",
"V-3179": "true",
"V-3196": "true",
"V-3210": "true",
"V-3967": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5646": "true",
"V-7011": "true"
},
"id": "MAC-2_Sensitive",
"title": "II - Mission Support Sensitive"
},
"MAC-3_Classified": {
"description": "",
"findings": {
"V-14646": "true",
"V-14671": "true",
"V-14717": "true",
"V-17821": "true",
"V-18484": "true",
"V-18489": "true",
"V-18501": "true",
"V-18502": "true",
"V-18508": "true",
"V-18509": "true",
"V-18512": "true",
"V-18513": "true",
"V-18632": "true",
"V-19233": "true",
"V-19246": "true",
"V-19250": "true",
"V-19256": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3176": "true",
"V-3179": "true",
"V-3196": "true",
"V-3210": "true",
"V-3967": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5646": "true",
"V-7011": "true"
},
"id": "MAC-3_Classified",
"title": "III - Administrative Classified"
},
"MAC-3_Public": {
"description": "",
"findings": {
"V-14646": "true",
"V-14671": "true",
"V-14717": "true",
"V-17821": "true",
"V-18484": "true",
"V-18489": "true",
"V-18501": "true",
"V-18502": "true",
"V-18508": "true",
"V-18509": "true",
"V-18512": "true",
"V-18513": "true",
"V-18632": "true",
"V-19233": "true",
"V-19246": "true",
"V-19250": "true",
"V-19256": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3176": "true",
"V-3179": "true",
"V-3196": "true",
"V-3210": "true",
"V-3967": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5646": "true",
"V-7011": "true"
},
"id": "MAC-3_Public",
"title": "III - Administrative Public"
},
"MAC-3_Sensitive": {
"description": "",
"findings": {
"V-14646": "true",
"V-14671": "true",
"V-14717": "true",
"V-17821": "true",
"V-18484": "true",
"V-18489": "true",
"V-18501": "true",
"V-18502": "true",
"V-18508": "true",
"V-18509": "true",
"V-18512": "true",
"V-18513": "true",
"V-18632": "true",
"V-19233": "true",
"V-19246": "true",
"V-19250": "true",
"V-19256": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3176": "true",
"V-3179": "true",
"V-3196": "true",
"V-3210": "true",
"V-3967": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5646": "true",
"V-7011": "true"
},
"id": "MAC-3_Sensitive",
"title": "III - Administrative Sensitive"
}
},
"slug": "idsips",
"title": "IDS/IPS Security Technical Implementation Guide",
"version": "8"
}
}