Unused USB ports on the KVM switch must be blocked with tamper resistant/evident seals on a KVM switch that can encapsulate and send the USB protocol over the network to the client.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6715	KVM03.011.00	SV-6915r2_rule	DCBP-1	Medium

Description
By blocking the unused USB ports on a network attached KVM switch that can encapsulate USB over IP with tamper resistant/evident seals there will be an indication if someone has attached an unauthorized USB connection to the KVM switch. When a seal is found to have been tampered with or broken, it should be investigated. The ISSO will ensure any open USB ports on the KVM switch are blocked with tamper resistant/evident seals.

Description

By blocking the unused USB ports on a network attached KVM switch that can encapsulate USB over IP with tamper resistant/evident seals there will be an indication if someone has attached an unauthorized USB connection to the KVM switch. When a seal is found to have been tampered with or broken, it should be investigated. The ISSO will ensure any open USB ports on the KVM switch are blocked with tamper resistant/evident seals.

STIG	Date
Keyboard Video and Mouse Switch STIG	2015-06-30

Details

Check Text ( C-2731r2_chk )
If the KVM switch can encrypt USB and send it over the network, the reviewer will view the KVM switch and verify that unused USB ports are blocked with tamper resistant/evident seals. If unused USB ports are not blocked with tamper resistant/evident seals, this is a finding.

Fix Text (F-6322r2_fix)
Block unused USB ports on a network attached KVM switch that can encapsulate USB over IP with tamper resistant seals. Tamper resistant/evident seals are available from Protective Technologies: ptproducts@radium.ncsc.mil.