KVM or A/B switches must be approved prior to being connected to ISs that are at different classification levels.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6699	KVM02.005.00	SV-6876r2_rule	DCBP-1	Medium

Description
Only KVM switches that have been tested and verified to prevent the transfer of data from one IS to another will be used when the ISs connected to the switch are of differing classification levels. The switch will be operated in the approved port configuration only. When the KVM switch is attached to ISs of different classification levels, the IAO will ensure that only approved KVM or A/B switches are used.

Description

Only KVM switches that have been tested and verified to prevent the transfer of data from one IS to another will be used when the ISs connected to the switch are of differing classification levels. The switch will be operated in the approved port configuration only. When the KVM switch is attached to ISs of different classification levels, the IAO will ensure that only approved KVM or A/B switches are used.

STIG	Date
Keyboard Video and Mouse Switch STIG	2014-08-04

Details

Check Text ( C-2671r3_chk )
The reviewer will verify that the KVM or A/B switch attached to ISs of different classification levels has been evaluated and approved prior to connection. The National Information Assurance Partnership (NIAP) list can be found below: http://www.niap-ccevs.org/cc-scheme/vpl/?tech_name=Peripheral+Switch If the KVM or A/B switch is not found on the NIAP list, this is a finding.

Fix Text (F-6294r3_fix)
Immediately replace the unapproved KVM switch with an approved KVM switch. If there is not an approved KVM switch available, remove all ISs from the unapproved KVM switch and attach a separate keyboard, video monitor, and mouse to each IS. Alternately the ISs can be segregated by classification level on as many KVM switches, that are compliant with the SPAN STIG, as needed. Verify port configuration complies with guidance for the switch used.

Fix Text (F-6294r3_fix)

Immediately replace the unapproved KVM switch with an approved KVM switch. If there is not an approved KVM switch available, remove all ISs from the unapproved KVM switch and attach a separate keyboard, video monitor, and mouse to each IS. Alternately the ISs can be segregated by classification level on as many KVM switches, that are compliant with the SPAN STIG, as needed. Verify port configuration complies with guidance for the switch used.