| V-4582 | High | The network device must require authentication for console access. | Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to... |
| V-3175 | High | The network device must require authentication prior to establishing a management connection for administrative access. | Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling... |
| V-30955 | High | IPSec Security Association parameters must be compliant with all requirements specified for VPN Suite B when transporting classified traffic across a non-classified network. | RFC 6379 Suite B Cryptographic Suites for IPSec defines four cryptographic user interface suites for deploying IPSec. Each suite provides choices for Encapsulating Security Payload (ESP) and... |
| V-15434 | High | The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online. | The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the... |
| V-30966 | High | The VPN gateway must use AES for IPSec cryptographic encryption operations required to ensure privacy of the IPSec session. | While there is much debate about the security and performance of Advance Encryption Standard (AES), there is a consensus it is significantly more secure than any of the algorithms supported by... |
| V-30967 | High | The VPN gateway must use Secure Hash Algorithm for IPSec cryptographic hashing operations required for authentication and integrity verification. | Because hash algorithms create a short fixed-length hash value to represent data of any size, there are far more possible input values than there are unique hash values. Hence, multiple input... |
| V-3062 | High | Network devices must be configured to ensure passwords are not viewable when displaying configuration information. | Many attacks on information systems and network devices are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the... |
| V-3143 | High | Network devices must not have any default manufacturer passwords. | Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of... |
| V-3210 | High | The network device must not use the default or well-known SNMP community strings public and private. | Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An... |
| V-3012 | High | Network devices must be password protected. | Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user,... |
| V-30941 | High | The VPN gateway must authenticate the remote server, peer, or client prior to establishing an IPSec session. | Both IPSec endpoints must authenticate each other to ensure the identity of each by additional means besides an IP address which can easily be spoofed. The objective of IPSec is to establish a... |
| V-3056 | High | Group accounts must not be configured for use on the network device. | Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves... |
| V-30950 | High | The VPN gateway must use Secure Hash Algorithm for IKE cryptographic hashing operations required for authentication and integrity verification. | Because hash algorithms create a short fixed-length hash value to represent data of any size, there are far more possible input values than there are unique hash values. Hence, multiple input... |
| V-30939 | High | The VPN gateway must use IKE for negotiating and establishing all IPSec security associations. | An IPSec Security Associations (SA) is established using either Internet Key Exchange (IKE) or manual configuration. When using IKE, the security associations are established when needed and... |
| V-30964 | High | The VPN gateway must use ESP tunnel mode for establishing secured paths to transport traffic between the organization’s sites or between a gateway and remote end-stations. | Encapsulating Security Payload (ESP) is the feature in the IPSec architecture providing confidentiality, data origin authentication, integrity, and anti-replay services. ESP can be deployed in... |
| V-30952 | High | The VPN gateway must use AES for IKE cryptographic encryption operations required to ensure privacy of the IKE session. | While there is much debate about the security and performance of Advance Encryption Standard (AES), there is a consensus that it is significantly more secure than any of the algorithms supported... |
| V-3196 | High | The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device. | SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain... |
| V-3085 | Medium | Network devices must have HTTP service for administrative access disabled. | The additional services that the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for... |
| V-3080 | Medium | The Configuration auto-loading feature must be disabled. | Devices can find their startup configuration either in their own NVRAM or access it over the network via TFTP or Remote Copy (rcp). Loading the image from the network is taking a security risk... |
| V-3081 | Medium | IP source routing must be disabled. | Source routing is a feature of IP, whereby individual packets can specify routes. This feature is used in several different network attacks by bypassing perimeter and internal defense mechanisms. |
| V-3069 | Medium | Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules. | Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network... |
| V-14671 | Medium | Network devices must authenticate all NTP messages received from NTP servers and peers. | Since NTP is used to ensure accurate log file time stamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP... |
| V-3043 | Medium | The network device must use different SNMP community names or groups for various levels of read and write access. | Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community... |
| V-14717 | Medium | The network device must not allow SSH Version 1 to be used for administrative access. | SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to attacks, e.g., man-in-the-middle attacks, it is now... |
| V-3014 | Medium | The network devices must timeout management connections for administrative access after 10 minutes or less of inactivity. | Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled between the managed network... |
| V-30947 | Medium | The VPN gateway must not accept certificates that have been revoked when using PKI for authentication. | Situations may arise in which the certificate issued by a Certificate Authority (CA) may need to be revoked before the lifetime of the certificate expires. For example, the certificate is known to... |
| V-3057 | Medium | Authorized accounts must be assigned the least privilege level necessary to perform assigned duties. | By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personnel are trained or experienced enough to use those... |
| V-31285 | Medium | Network devices must authenticate all BGP peers within the same or between autonomous systems (AS). | As specified in RFC 793, TCP utilizes sequence checking to ensure proper ordering of received packets. RFC 793 also specifies that RST (reset) control flags should be processed immediately,... |
| V-30956 | Medium | The VPN gateway must enable anti-replay for all IPSec security associations. | Replay attack is a type of injection attack when an IPSec packet is captured by an attacker and re-inserts it into the legitimate flow to disrupt service or create undesired behavior. IPSec... |
| V-5613 | Medium | The network device must be configured for a maximum number of unsuccessful SSH logon attempts set at 3 before resetting the interface. | An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens... |
| V-30944 | Medium | The VPN gateway must only accept certificates issued by a DoD-approved Certificate Authority when using PKI for authentication. | When using digital certificates, Internet Key Exchange (IKE) negotiation between peers is restricted by either manually configuring each peer with the public key for each peer to which it is... |
| V-30946 | Medium | The VPN gateway server must enforce a policy to the software client to display a DoD approved warning banner prior to allowing access to the VPN. | All software remote clients must present a DoD approved warning banner prior allowing access to VPN. The banner should warn any unauthorized user not to proceed. It also should provide clear and... |
| V-3160 | Medium | Network devices must be running a current and supported operating system with all IAVMs addressed. | Network devices not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps... |
| V-3034 | Medium | Network devices must authenticate all IGP peers. | A rogue router could send a fictitious routing update to convince a site's premise router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to... |
| V-15432 | Medium | Network devices must use two or more authentication servers for the purpose of granting administrative access. | The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in... |
| V-5646 | Medium | The network device must drop half-open TCP connections through filtering thresholds or timeout periods. | A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance... |
| V-30948 | Medium | The VPN gateway server must enforce a policy to the remote software client to check for the presence of a personal firewall before enabling access to the VPN. | The security posture of the remote PC connecting to the enclave via VPN is vital to the overall security of the enclave. While on-site hosts are behind the enclave’s perimeter defense, a remote PC... |
| V-30960 | Medium | The VPN gateway must specify Perfect Forward Secrecy during IKE negotiation. | The Internet Key Exchange (IKE) Phase-2 (Quick Mode) Security Association (SA) is used to create an IPSec session key. Hence, its rekey or key regeneration procedure is very important. The... |
| V-30945 | Medium | The VPN gateway server must enforce a policy to the software client to disallow the remote client from being able to save the logon password locally on the remote PC. | Enabling the password save function requires users to only enter their password once when establishing the VPN tunnel. After that the software client will automatically re-enter the password when... |
| V-14669 | Medium | Network devices must have BSDr commands disabled. | Berkeley Software Distribution (BSD) "r" commands allow users to execute commands on remote systems using a variety of protocols. The BSD "r" commands (e.g., rsh, rlogin, rcp, rdump, rrestore, and... |
| V-30951 | Medium | The VPN gateway server must enforce a no split-tunneling policy to all remote clients. | A VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the... |
| V-5612 | Medium | The network devices must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions. | An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and... |
| V-3969 | Medium | Network devices must only allow SNMP read-only access. | Enabling write access to the device via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations. |
| V-30943 | Medium | The VPN gateway must use PKI or digital-signature for authenticating the remote server, peer, or client. | Using shared secrets between two IPSec endpoints is easy to implement but are also easy to compromise. Regardless of the strength of the password, they can be cracked using software tools that are... |
| V-3966 | Medium | In the event the authentication server is unavailable, the network device must have a single local account of last resort defined. | Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when... |
| V-3013 | Medium | Network devices must display the DoD-approved logon banner warning. | All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear... |
| V-19188 | Medium | The network device must have control plane protection enabled. | The Route Processor (RP) is critical to all network operations as it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental... |
| V-17821 | Medium | The network devices OOBM interface must be configured with an OOBM network address. | The OOBM access switch will connect to the management interface of the managed network device. The management interface of the managed network device will be directly connected to the OOBM... |
| V-17822 | Medium | The network devices management interface must be configured with both an ingress and egress ACL. | The OOBM access switch will connect to the management interface of the managed network device. The management interface can be a true OOBM interface or a standard interface functioning as the... |
| V-5611 | Medium | The network devices must only allow management connections for administrative access from hosts residing in the management network. | Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment could acquire the device account and password information. With this intercepted... |
| V-30954 | Medium | The VPN gateway must ensure traffic from a remote client with an outbound destination does not bypass the enclaves perimeter defense mechanisms deployed for egress traffic. | Packets from a remote client destined outbound must be inspected and proxied the same as any other traffic that will egress the enclave. Otherwise, there is the risk that the return traffic that... |
| V-30953 | Medium | The VPN gateway peer at a remote site must receive all ingress traffic and forward all egress traffic via the IPSec tunnel or other provisoned WAN links connected to the central or remote site. | A VPN gateway peer at the remote site provides connectivity to the central or other remote sites belonging to the enclave via an IPSec tunnel across an IP backbone network such as the NIPRNet.... |
| V-3058 | Medium | Unauthorized accounts must not be configured for access to the network device. | A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that... |
| V-3967 | Medium | The network devices must time out access to the console port at 10 minutes or less of inactivity. | Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port... |
| V-5618 | Medium | Gratuitous ARP must be disabled. | A gratuitous ARP is an ARP broadcast in which the source and destination MAC addresses are the same. It is used to inform the network about a host IP address. A spoofed gratuitous ARP message can... |
| V-3086 | Low | BOOTP services must be disabled. | BOOTP is a user datagram protocol (UDP) that can be used by Cisco routers to access copies of Cisco IOS Software on another Cisco router running the BOOTP service. In this scenario, one Cisco... |
| V-14672 | Low | The network device must use its loopback or OOB management interface address as the source address when originating authentication services traffic. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for... |
| V-14675 | Low | The network device must use its loopback or OOB management interface address as the source address when originating SNMP traffic. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for... |
| V-14676 | Low | The network device must use its loopback or OOB management interface address as the source address when originating IP Flow/NetFlow traffic. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for... |
| V-14677 | Low | The network device must use its loopback or OOB management interface address as the source address when originating TFTP or FTP traffic. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of network devices. It is easier to construct appropriate ingress... |
| V-4584 | Low | The network device must log all messages except debugging and send all log data to a syslog server. | Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service... |
| V-23747 | Low | Network devices must use at least two NTP servers to synchronize time. | Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If logs cannot be successfully compared between each of the routers, switches,... |
| V-3078 | Low | Network devices must have TCP and UDP small servers disabled. | Cisco IOS provides the "small services" that include echo, chargen, and discard. These services, especially their User Datagram Protocol (UDP) versions, are infrequently used for legitimate... |
| V-3083 | Low | IP directed broadcast must be disabled on all layer 3 interfaces. | An IP directed broadcast is a datagram sent to the broadcast address of a subnet that is not directly attached to the sending machine. The directed broadcast is routed through the network as a... |
| V-30965 | Low | The VPN gateway must implement IKE Security Associations that terminate within 24 hours or less. | The Security Association (SA) and its corresponding key will expire after the number of seconds has exceeded the configured limit. A new SA is negotiated before the lifetime threshold of the... |
| V-30963 | Low | The VPN gateway must use a key size from Diffie-Hellman Group 2 or larger during IKE Phase 2. | Diffie-Hellman (DH) is a public -key cryptography scheme allowing two parties to establish a shared secret over an insecure communications channel. IKE uses Diffie-Hellman to create keys used to... |
| V-30961 | Low | The VPN gateway must implement IPSec security associations that terminate after one hour or less of idle time. | When a VPN gateway creates an IPSec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPSec endpoint inactivity which could... |
| V-14673 | Low | The network device must use its loopback or OOB management interface address as the source address when originating syslog traffic. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for... |
| V-3079 | Low | Network devices must have the Finger service disabled. | The Finger service supports the UNIX Finger protocol, which is used for querying a host about the users that are logged on. This service is not necessary for generic users. If an attacker were to... |
| V-14667 | Low | Network devices must be configured with rotating keys used for authenticating IGP peers that have a duration exceeding 180 days. | If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Changing the... |
| V-3072 | Low | The running configuration must be synchronized with the startup configuration after changes have been made and implemented. | If the running and startup router configurations are not synchronized properly and a router malfunctions, it will not restart with all of the recent changes incorporated. If the recent changes... |
| V-17823 | Low | The management interface must be configured as passive for the IGP instance deployed in the managed network. | The OOBM access switch will connect to the management interface of the managed network devices. The management interface can be a true OOBM interface or a standard interface functioning as the... |
| V-14674 | Low | The network device must use its loopback or OOB management interface address as the source address when originating NTP traffic. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for... |
| V-5614 | Low | Network devices must have the PAD service disabled. | Packet Assembler Disassembler (PAD) is an X.25 component seldom used. It collects the data transmissions from the terminals and gathers them into a X.25 data stream and vice versa. PAD acts like... |
| V-14681 | Low | The network device must use its loopback interface address as the source address for all iBGP peering sessions. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability. It is easier to construct appropriate filters for control plane... |
| V-30962 | Low | The VPN gateway must implement IPSec security associations that terminate within 8 hours or less. | The IPSec SA and its corresponding key will expire either after the number of seconds or amount of traffic volume has exceeded the configured limit. A new SA is negotiated before the lifetime... |
| V-30959 | Low | The VPN gateway must use a key size from Diffie-Hellman Group 2 or larger during IKE Phase 1. | Diffie-Hellman (DH) is a public-key cryptography scheme that allows two parties to establish a shared secret over an insecure communications channel. IKE uses DH to create keys used to encrypt... |
| V-30957 | Low | The VPN gateway must use IKE main mode for the purpose of negotiating an IPSec security association policy when pre-shared keys are used for authentication | Aggressive mode is completed using only three messages instead of the six used in main mode. Essentially, all the information needed to generate the Diffie-Hellman secret is exchanged in the first... |
| V-5616 | Low | Network devices must have identification support disabled. | Identification support allows one to query a TCP port for identification. This feature enables an unsecured protocol to report the identity of a client initiating a TCP connection and a host... |
| V-5615 | Low | Network devices must have TCP Keep-Alives enabled for TCP sessions. | Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If... |
| V-7011 | Low | The auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication. | The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. ... |
| V-3020 | Low | Network devices must have DNS servers defined if it is configured as a client resolver. | The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a connection with a... |
| V-3000 | Low | The network device must log all interface access control lists (ACL) deny statements. | Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, attempted to be done, and by whom in order to compile an... |
| V-3070 | Low | Network devices must log all attempts to establish a management connection for administrative access. | Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders... |
