{
"stig": {
"date": "2019-01-09",
"description": "Layer 2 Switch Security Technical Implementation Guide - Cisco",
"findings": {
"V-14669": {
"checkid": "C-12780r2_chk",
"checktext": "Verify that the following BSDr global commands are not defined in the configuration:\n\n ip rcmd rcp-enable\n ip rcmd rsh-enable\n\nThese commands have been disabled by default in IOS since version 12.0. \n",
"description": "Berkeley Software Distribution (BSD) \u201cr\u201d commands allow users to execute commands on remote systems using a variety of protocols. The BSD \"r\" commands (e.g., rsh, rlogin, rcp, rdump, rrestore, and rdist) are designed to provide convenient remote access without passwords to services such as remote command execution (rsh), remote login (rlogin), and remote file copy (rcp and rdist). The difficulty with these commands is that they use address-based authentication. An attacker who convinces a server that he is coming from a \"trusted\" machine can essentially get complete and unrestricted access to a system. The attacker can convince the server by impersonating a trusted machine and using IP address, by confusing DNS so that DNS thinks that the attacker's IP address maps to a trusted machine's name, or by any of a number of other methods",
"fixid": "F-14130r4_fix",
"fixtext": "Configure the device to disable BSDr command services.",
"iacontrols": null,
"id": "V-14669",
"ruleID": "SV-15314r2_rule",
"severity": "medium",
"title": "The administrator must ensure BSD r command services are disabled. ",
"version": "NET0744"
},
"V-14671": {
"checkid": "C-12793r9_chk",
"checktext": "Review the network element configuration and verify that it is authenticating NTP messages received from the NTP server or peer using a FIPS-approved message authentication code algorithm. FIPS-approved algorithms for authentication are the cipher-based message authentication code (CMAC) and the keyed-hash message authentication code (HMAC). AES and 3DES are NIST-approved CMAC algorithms. The following are NIST-approved HMAC algorithms: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256.\n\nDowngrade:\nIf the network device is not capable of authenticating the NTP server or peer using a FIPS-approved message authentication code algorithm, then MD5 can be utilized for NTP message authentication and the finding can be downgraded to a CAT III.\n\nIf the network element is not configured to authenticate received NTP messages using a FIPS-approved message authentication code algorithm, this is a finding. A downgrade can be determined based on the criteria above.",
"description": "Since NTP is used to ensure accurate log file time stamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. \n\nTwo NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka \"symmetric mode\"). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client's stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers.\n\nA hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device loses connectivity to its upstream NTP server, it will be able to choose time from one of its peers. \n\nThe NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It is not used to authenticate NTP clients because NTP servers do not care about the authenticity of their clients, as they never accept any time from them.",
"fixid": "F-14132r4_fix",
"fixtext": "Configure the device to authenticate all received NTP messages using a FIPS-approved message authentication code algorithm.",
"iacontrols": null,
"id": "V-14671",
"ruleID": "SV-15327r6_rule",
"severity": "medium",
"title": "Network devices must authenticate all NTP messages received from NTP servers and peers.",
"version": "NET0813"
},
"V-14717": {
"checkid": "C-12925r2_chk",
"checktext": "If SSH is used for administrative access, then Version 2 must be configured as shown in the following example:\n\nip ssh version 2\n",
"description": "SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1. ",
"fixid": "F-14184r5_fix",
"fixtext": "Configure the network device to use SSH version 2.",
"iacontrols": null,
"id": "V-14717",
"ruleID": "SV-15460r2_rule",
"severity": "medium",
"title": "The network element must not use SSH Version 1 for administrative access.",
"version": "NET1647"
},
"V-15432": {
"checkid": "C-14439r6_chk",
"checktext": "Verify an authentication server is required to access the device and that there are two or more authentication servers defined.\n\nIf the device is not configured for two separate authentication servers, this is a finding.",
"description": "The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ or RADIUS, the administrators can easily add or remove user accounts, add or remove command authorizations, and maintain a log of user activity.\n\nThe use of an authentication server provides the capability to assign router administrators to tiered groups that contain their privilege level that is used for authorization of specific commands. For example, user mode would be authorized for all authenticated administrators while configuration or edit mode should only be granted to those administrators that are permitted to implement router configuration changes.",
"fixid": "F-15096r3_fix",
"fixtext": "Configure the device to use two separate authentication servers.",
"iacontrols": null,
"id": "V-15432",
"ruleID": "SV-16259r4_rule",
"severity": "medium",
"title": "Network devices must use two or more authentication servers for the purpose of granting administrative access.",
"version": "NET0433"
},
"V-15434": {
"checkid": "C-14441r6_chk",
"checktext": "Review the emergency administration account configured on the network devices and verify that it has been assigned to a privilege level that will enable the administrator to perform necessary administrative functions when the authentication server is not online.\n\nIf the emergency administration account is configured for more access than needed to troubleshoot issues, this is a finding.",
"description": "The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate authorization level to perform necessary administrative functions during this time.",
"fixid": "F-15098r7_fix",
"fixtext": "Assign a privilege level to the emergency administration account to allow the administrator to perform necessary administrative functions when the authentication server is not online.",
"iacontrols": null,
"id": "V-15434",
"ruleID": "SV-16261r5_rule",
"severity": "high",
"title": "The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online.",
"version": "NET0441"
},
"V-17820": {
"checkid": "C-19237r1_chk",
"checktext": "Examine the connection from the OOBM access switch to the managed network elements. Verify which interface is being used at the managed network elements so that it can be determined if the interface is a true OOBM interface.",
"description": "The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element must be directly connected to the OOBM network to ensure seperation. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. ",
"fixid": "F-17735r1_fix",
"fixtext": "Physically connected the OOBM access switch to the managed network element OOBM interface.",
"iacontrols": [
"ECSC-1"
],
"id": "V-17820",
"ruleID": "SV-19074r1_rule",
"severity": "medium",
"title": "The OOBM access switch is not physically connected to the managed network element OOBM interface.",
"version": "NET0990"
},
"V-17821": {
"checkid": "C-27274r2_chk",
"checktext": "The managed network element\u2019s OOBM interface must be configured with an IP address from the address space belonging to the OOBM network. After determining which interface is connected to the OOBM access switch, review the managed device configuration and verify that the interface has been assigned an address from the local management address block. In this example, that is 10.1.1.0/24. interface VLAN 101 description Management_VLAN ip address 10.1.1.22 255.255.255.0 \u2026 \u2026 interface FastEthernet1/6 switchport access vlan 101 switchport mode access \n",
"description": "The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.",
"fixid": "F-17736r2_fix",
"fixtext": "Configure the OOB management interface with an IP address from the address space belonging to the OOBM network.",
"iacontrols": null,
"id": "V-17821",
"ruleID": "SV-25881r2_rule",
"severity": "medium",
"title": "Managed NE OOBM interface is not configured with an OOBM network address.",
"version": "NET0991"
},
"V-17824": {
"checkid": "C-20316r1_chk",
"checktext": "Review the managed switch configuration and verify that the access port connected to the OOBM access switch has been assigned to the management VLAN. By default, the management VLAN is VLAN 1; however, the management VLAN must be configured to a different VLAN. As shown in the following configuration example, FastEthernet0/1 is the port connected to the OOBM access switch and VLAN 101 is the management VLAN. \n\ninterface FastEthernet0/1\n switchport access vlan 10\n switchport mode access\n!\ninterface FastEthernet0/2\n switchport access vlan 2\n switchport mode access\n!\ninterface FastEthernet0/3\n switchport access vlan 2\n switchport mode access\n!\ninterface FastEthernet0/4\n switchport access vlan 2\n switchport mode access\n\nThis can also be verified by entering a Privileged EXEC show vlan command on the switch CLI as illustrated in the following example output of a Cisco 2950:\n\n2950#show vlan \nVLAN Name Status Ports \n---- ------------------------ --------- ------------------------------- \n2 Production active Fa0/2, Fa0/3, Fa0/4, Fa0/5, \n ...\n Fa0/21, Fa0/22, Fa0/23, Fa0/24\n10 Management active Fa0/1 \n",
"description": "The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network.",
"fixid": "F-17739r1_fix",
"fixtext": "If the management interface is an access switchport, assign it to a separate management VLAN while the remainder of the access switchports can be assigned to user VLANs belonging to the managed network. This provides some level of separation between the management network and the managed network. ",
"iacontrols": null,
"id": "V-17824",
"ruleID": "SV-19337r1_rule",
"severity": "medium",
"title": "The management interface is an access switchport and has not been assigned to a separate management VLAN. ",
"version": "NET0994"
},
"V-17825": {
"checkid": "C-20317r1_chk",
"checktext": "Review the managed switch configuration and verify that an address has been configured for management VLAN from space belonging to the OOBM network that has been assigned to that site. \n\ninterface VLAN10\n ip address 10.1.1.10 255.255.255.0\n description Management VLAN\n\nNote: The IP address of the switch can be accessed only by nodes connected to ports that belong to the management VLAN. \n\nA default gateway address as shown below must be configured using the address of the OOBM gateway router interface connecting to the OOBM access switch. This will ensure that all management traffic is forwarded toward the NOC using the switchport attached to the OOBM access switch.\n\nip default-gateway 10.1.1.1\n \n",
"description": "The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network.\n\nAn OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. ",
"fixid": "F-17740r1_fix",
"fixtext": "Assign an IP address to the management VLAN from the address space belonging to the OOBM network.",
"iacontrols": null,
"id": "V-17825",
"ruleID": "SV-19338r1_rule",
"severity": "low",
"title": "An address has not been configured for the management VLAN from space belonging to the OOBM network assigned to that site.",
"version": "NET0995"
},
"V-17826": {
"checkid": "C-20318r1_chk",
"checktext": "The management VLAN must be pruned from any VLAN trunk links belonging to the managed network\u2019s infrastructure. By default all the VLANs that exist on a switch are active on a trunk link. Since the switch is being managed via OOBM connection, management traffic should not traverse any trunk links. The following Catalyst IOS configuration is an example of a trunk link with the management VLAN (i.e. 10) pruned from a trunk.\n\n\ninterface fastEthernet0/1\n switchport trunk encapsulation dot1q\n switchport mode dynamic desirable\n switchport trunk native vlan 3\n switchport trunk allowed vlan 2-9\n\nThis can also be verified with the show interface trunk command as shown below:\n\nSwitch-A# show interface trunk\nPort Mode Encapsulation Status Native vlan\nFa0/1 desirable 802.1q trunking 3\nPort Vlans allowed on trunk\nFa0/1 2-9\nPort Vlans in spanning tree forwarding state and not pruned\nFa0/1 2-5\n\nNote: VTP pruning allows the switch to not forward user traffic for VLANs that are not active on a remote switch. This feature dynamically prunes unneeded traffic across trunk links. VTP pruning needs to be enabled on the server for the VTP domains\u2014after which all VTP clients in the VTP domain will automatically enable VTP pruning. To enable VTP pruning on a Cisco IOS switch, you use the vtp pruning VLAN configuration or global configuration command. Since, the management VLAN will be active on all managed switchs, VTP will never prune this VLAN. Hence, it will have to be manually removed as shown above. \n",
"description": "The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network.\n\nAn OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. ",
"fixid": "F-17741r1_fix",
"fixtext": "Ensure that the access switchport connecting to the OOBM access switch is the only port with membership to the management VLAN",
"iacontrols": null,
"id": "V-17826",
"ruleID": "SV-19339r1_rule",
"severity": "medium",
"title": "The access switchport connecting to the OOBM access switch is not the only port with membership to the management VLAN.",
"version": "NET0996"
},
"V-17827": {
"checkid": "C-20319r1_chk",
"checktext": "The management VLAN must be pruned from any VLAN trunk links belonging to the managed network\u2019s infrastructure. By default all the VLANs that exist on a switch are active on a trunk link. Since the switch is being managed via OOBM connection, management traffic should not traverse any trunk links. The following Catalyst IOS configuration is an example of a trunk link with the management VLAN (i.e. 10) pruned from a trunk.\n\n\ninterface fastEthernet0/1\n switchport trunk encapsulation dot1q\n switchport mode dynamic desirable\n switchport trunk native vlan 3\n switchport trunk allowed vlan 2-9\n\nThis can also be verified with the show interface trunk command as shown below:\n\nSwitch-A# show interface trunk\nPort Mode Encapsulation Status Native vlan\nFa0/1 desirable 802.1q trunking 3\nPort Vlans allowed on trunk\nFa0/1 2-9\nPort Vlans in spanning tree forwarding state and not pruned\nFa0/1 2-5\n\nNote: VTP pruning allows the switch to not forward user traffic for VLANs that are not active on a remote switch. This feature dynamically prunes unneeded traffic across trunk links. VTP pruning needs to be enabled on the server for the VTP domains\u2014after which all VTP clients in the VTP domain will automatically enable VTP pruning. To enable VTP pruning on a Cisco IOS switch, you use the vtp pruning VLAN configuration or global configuration command. Since, the management VLAN will be active on all managed switchs, VTP will never prune this VLAN. Hence, it will have to be manually removed as shown above. \n",
"description": "The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network.\n\nAn OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network. ISL and 802.1q trunking enables multiple VLANs to traverse the same physical links between layer 2 switches or between a layer 2 switch and a router. If the management VLAN is not pruned from any VLAN trunk links belonging to the managed network\u2019s infrastructure, management traffic has the potential to leak into the production network.\n",
"fixid": "F-17744r1_fix",
"fixtext": "Prune the management VLAN from any VLAN trunk links belonging to the managed network\u2019s infrastructure. ",
"iacontrols": null,
"id": "V-17827",
"ruleID": "SV-19340r1_rule",
"severity": "low",
"title": "The management VLAN is not pruned from any VLAN trunk links belonging to the managed network\u2019s infrastructure. \n\n",
"version": "NET0997"
},
"V-17832": {
"checkid": "C-20816r1_chk",
"checktext": "Review the switch configuration and verify that the management VLAN has been assigned an IP address from the management network address block. Following is an example for a Cisco Catalyst switch:\n\n\ninterface VLAN 10\n description Management VLAN\n ip address 10.1.1.10 255.255.255.0\n\nNote: The IP address of the switch can be accessed only by nodes connected to ports that belong to the management VLAN. \n",
"description": "If the management systems reside within the same layer 2 switching domain as the managed network elements, then separate VLANs will be deployed to provide separation at that level. In this case, the management network still has its own subnet while at the same time it is defined as a unique VLAN. ",
"fixid": "F-17749r1_fix",
"fixtext": "Configure the management VLAN with an IP address from the management network address block.",
"iacontrols": null,
"id": "V-17832",
"ruleID": "SV-19702r1_rule",
"severity": "medium",
"title": "The management VLAN is not configured with an IP address from the management network address block.",
"version": "NET1003"
},
"V-18544": {
"checkid": "C-21399r3_chk",
"checktext": "Review the device configuration to determine if a VLAN has been established for printers.",
"description": "Aspects of hardening the network wall plate may include traffic filtering or restrictions on connectivity to enforce a device-, community of interest-, or user-specific security policy. For example, if a printer were plugged into a switch port, it would be prudent to ensure that only printer traffic is allowed on that switch port. If the printer is unplugged and a substitute device other than a printer is plugged into that switch port, the substitute device should not be able to communicate arbitrarily with other devices because only printer traffic is allowed on that switch port.",
"fixid": "F-19148r3_fix",
"fixtext": "Create a VLAN on the device for print type devices and assign printers to the VLAN ID.",
"iacontrols": [
"DCSP-1"
],
"id": "V-18544",
"ruleID": "SV-20088r2_rule",
"severity": "low",
"title": "Printers must be assigned to a VLAN that is not shared by unlike devices.",
"version": "NET-VLAN-023"
},
"V-18565": {
"checkid": "C-21652r1_chk",
"checktext": "A shutdown action puts the interface into the error-disabled state immediately and sends an SNMP trap notification if it receives a frame with a different layer 2 source address that what has been configured or learned for port security. The following Catalyst IOS interface command will shutdown the interface when such an event occurs:\n\nswitchport port-security violation shutdown\n",
"description": "The Port Security feature remembers the Ethernet MAC address connected to the switch port and allows only that MAC address to communicate on that port. If any other MAC address tries to communicate through the port, port security will disable the port. ",
"fixid": "F-19192r1_fix",
"fixtext": "Configure the port to shutdown when insecure hosts are connected to the wall jack.",
"iacontrols": null,
"id": "V-18565",
"ruleID": "SV-20109r1_rule",
"severity": "low",
"title": "The IAO will ensure that all switchports configured using MAC port security will shutdown upon receiving a frame with a different layer 2 source address than what has been configured or learned for port security.",
"version": "NET-NAC-032"
},
"V-18566": {
"checkid": "C-45619r8_chk",
"checktext": "Review the switch configuration to verify each access port is configured for a single registered MAC address.\n\nConfiguring port-security on the Cisco switch access port interface will automatically set the maximum number of registered MAC addresses to one. The value will not show up in the configuration of the switch itself. To validate the access port has a maximum value of one for allowable MAC addresses, you must run the following command: \n\nSwitch# show port-security interface \n\nShow Command Example:\nSwitch# port int fa0/1\nPort Security :Enabled\nPort Status :Secure-down\nViolation Mode :Shutdown\nAging Time :0 mins\nAging Type :Absolute\nSecureStatic Address Aging :Disabled\nMaximum MAC Addresses :1\n\nSome technologies are exempt from requiring a single MAC address per access port; however, restrictions still apply. VoIP or VTC endpoints may provide a PC port so a PC can be connected. Each of the devices will need to be statically assigned to each access port.\n\nAnother green initiative where a single LAN drop is shared among several devices is called \"hot-desking\", which is related to conservation of office space and teleworking. Hot-desking is where several people are assigned to work at the same desk at different times, each user with their own PC. In this case, a different MAC address needs to be permitted for each PC that is connecting to the LAN drop in the workspace. Additionally, this workspace could contain a single phone (and possibly desktop VTC endpoint) used by all assignees and the PC port on it might be the connection for their laptop. In this case, it is best not to use sticky port security, but to use a static mapping of authorized devices or implement 802.1x. If this is not a teleworking remote location, this exemption does not apply.",
"description": "Limiting the number of registered MAC addresses on a switch access port can help prevent a CAM table overflow attack. This type of attack lets an attacker exploit the hardware and memory limitations of a switch. If there are enough entries stored in a CAM table before the expiration of other entries, no new entries can be accepted into the CAM table. An attacker will able to flood the switch with mostly invalid MAC addresses until the CAM table\u2019s resources have been depleted. When there are no more resources, the switch has no choice but to flood all ports within the VLAN with all incoming traffic. This happens because the switch cannot find the switch port number for a corresponding MAC address within the CAM table, allowing the switch to become a hub and traffic to be monitored.",
"fixid": "F-19193r3_fix",
"fixtext": "Configure the switch to limit the maximum number of registered MAC addresses on each access switch port to one.",
"iacontrols": [
"DCSP-1"
],
"id": "V-18566",
"ruleID": "SV-49133r1_rule",
"severity": "medium",
"title": "The switch must only allow a maximum of one registered MAC address per access port.",
"version": "NET-NAC-031"
},
"V-23747": {
"checkid": "C-12791r2_chk",
"checktext": "Review the router or switch configuration and verify that two NTP servers have been defined to synchronize time similar to the following example:\n\nntp update-calendar\nntp server 129.237.32.6 \nntp server 129.237.32.7\n\nSome platforms have a battery-powered hardware clock, referred to in the command-line interface (CLI) as the \"calendar,\" in addition to the software based system clock. The hardware clock runs continuously, even if the router is powered off or rebooted. If the software clock is synchronized to an outside time source via NTP, it is a good practice to periodically update the hardware clock with the time learned from NTP. Otherwise, the hardware clock will tend to gradually lose or gain time (drift) and the software clock and hardware clock may become out of synchronization with each other. The ntp update-calendar command will enable the hardware clock to be periodically updated with the time specified by the NTP source. The hardware clock will be updated only if NTP has synchronized to an authoritative time server. To force a single update of the hardware clock from the software clock, use the clock update-calendar command in user EXEC mode. \n\nNote: Lower end router models (i.e., 2500 series) and access switches (i.e. 2950, 2970, etc) do not have hardware clocks, so this command is not available on those platforms.\nAny NTP-enabled device that receives and accepts time from a stratum-n server can become a stratum-n+1 server. However, an NTP-enabled device will not accept time updates from an NTP server at a higher stratum; thereby enforcing a tree-level hierarchy of client-server relationships and preventing time synchronization loops. To increase availability, NTP peering can be used between NTP servers. Hence the following example configuration could be used to provide the necessary redundancy:\n\nntp update-calendar\nntp server 129.237.32.6 \nntp peer 129.237.32.7\n\nAlternative to querying an NTP server for time is to receive NTP updates via server that is broadcasting or multicasting the time update messages. The following interface command would be configured to receive an NTP broadcast message:\n\nntp broadcast client \n\nThe above command must be configured on two interfaces or there must be two NTP servers on the same LAN segment broadcasting NTP messages. \n\nThe following interface command would be configured to receive an NTP multicast message:\n\nntp multicast client 239.x.x.x \n\nFor multicast, two different administratively scoped multicast groups can be used\u2014one for each NTP server. In addition, the router or MLS must also have ip pim dense-mode configured on the interface as well as global ip multicast-routing.\n",
"description": "Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If you cannot successfully compare logs between each of your routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.",
"fixid": "F-3044r2_fix",
"fixtext": "Configure the device to use two separate NTP servers.",
"iacontrols": null,
"id": "V-23747",
"ruleID": "SV-41497r1_rule",
"severity": "low",
"title": "The network element must use two or more NTP servers to synchronize time.",
"version": "NET0812"
},
"V-28784": {
"checkid": "C-37332r2_chk",
"checktext": "Review the device configuration to determine if the call home service or feature is disabled on the device. On a Cisco product, you will not see the call-home service in the running config unless it's enabled. If the call home service is enabled on the device, this is a finding.\n\nNote: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.\n",
"description": "Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.",
"fixid": "F-32568r2_fix",
"fixtext": "Configure the network device to disable the call home service or feature. \n\nThe command below will disable the call-home service on a Cisco device. \nExample:\nhostname(config)# no service call-home\n\nNote: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.\n",
"iacontrols": null,
"id": "V-28784",
"ruleID": "SV-38003r3_rule",
"severity": "medium",
"title": "A service or feature that calls home to the vendor must be disabled. \n",
"version": "NET0405"
},
"V-3012": {
"checkid": "C-3456r6_chk",
"checktext": "Review the network devices configuration to determine if administrative access to the device requires some form of authentication--at a minimum a password is required.\n\nIf passwords aren't used to administrative access to the device, this is a finding.",
"description": "Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network device. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network device providing opportunity for intruders to compromise resources within the network infrastructure.",
"fixid": "F-3037r6_fix",
"fixtext": "Configure the network devices so it will require a password to gain administrative access to the device.",
"iacontrols": null,
"id": "V-3012",
"ruleID": "SV-3012r4_rule",
"severity": "high",
"title": "Network devices must be password protected.",
"version": "NET0230"
},
"V-3013": {
"checkid": "C-3474r11_chk",
"checktext": "Review the device configuration or request that the administrator logon to the device and observe the terminal. Verify either Option A or Option B (for systems with character limitations) of the Standard Mandatory DoD Notice and Consent Banner is displayed at logon. The required banner verbiage follows and must be displayed verbatim:\n\nOption A\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. \n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\nOption B\n\nIf the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: \"I've read & consent to terms in IS user agreem't.\"\n\nIf the device configuration does not have a logon banner as stated above, this is a finding.",
"description": "All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required logon warning banner prior to logon attempts will limit DoD's ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA's ability to monitor the device's usage is limited unless a proper warning banner is displayed.\n\nDoD CIO has issued new, mandatory policy standardizing the wording of \"notice and consent\" banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, \"Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement\", dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.",
"fixid": "F-3038r12_fix",
"fixtext": "Configure all management interfaces to the network device to display the DoD-mandated warning banner verbiage at logon regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows:\n\nOption A\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\n\nOption B\n\nIf the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: \"I've read & consent to terms in IS user agreem't.\"",
"iacontrols": null,
"id": "V-3013",
"ruleID": "SV-3013r5_rule",
"severity": "medium",
"title": "Network devices must display the DoD-approved logon banner warning.",
"version": "NET0340"
},
"V-3014": {
"checkid": "C-12918r4_chk",
"checktext": "Review the management connection for administrative access and verify the network element is configured to time-out the connection after 10 minutes or less of inactivity. The default for the VTY line is 10 minutes and may not appear in the display of the configuration. The VTY line should contain the following command:\n\nexec-timeout 10\n",
"description": "Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.",
"fixid": "F-3039r5_fix",
"fixtext": "Configure the network devices to ensure the timeout for unattended administrative access connections is no longer than 10 minutes.",
"iacontrols": null,
"id": "V-3014",
"ruleID": "SV-15453r2_rule",
"severity": "medium",
"title": "The network element must timeout management connections for administrative access after 10 minutes or less of inactivity.",
"version": "NET1639"
},
"V-3020": {
"checkid": "C-12796r2_chk",
"checktext": "Review the device configuration to ensure that DNS servers have been defined if it has been configured as a client resolver (name lookup). The configuration should look similar to one of the following examples: \nip domain-lookup\nip name-server 192.168.1.253\n\nor\n\nno ip domain-lookup\t\t\n\nThe first configuration example has DNS lookup enabled and hence has defined its DNS server. The second example has DNS lookup disabled.\n\nNote: ip domain-lookup is enabled by default. Hence it may not be shown\u2014depending on the IOS release. If it is enabled, it will be shown near the beginning of the configuration.\n",
"description": "The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a connection with a destination host and queries a DNS server for the IP address of the destination host name. If the response to this query is the IP address of a host operated by an attacker, the source host will establish a connection with the attackers host, rather than the intended target. The user on the source host might then provide logon, authentication, and other sensitive data.",
"fixid": "F-3045r2_fix",
"fixtext": "Configure the device to include DNS servers or disable domain lookup.",
"iacontrols": null,
"id": "V-3020",
"ruleID": "SV-15330r2_rule",
"severity": "low",
"title": "The network element must have DNS servers defined if it is configured as a client resolver.",
"version": "NET0820"
},
"V-3021": {
"checkid": "C-12798r3_chk",
"checktext": "Review device configuration and verify that it is configured to only allow SNMP access from only addresses belonging to the management network. The following examples for SNMP v1, 2, and 3 depict the use of an ACL to restrict SNMP access to the device.\n\nSNMP v1/v2c Configuration Example\n\nThe example ACL NMS_LIST is used to define what network management stations can access the device for write and read only (poll).\n\nip access-list standard NMS_LIST\n permit 10.1.1.24\n permit 10.1.1.22\n permit 10.1.1.23\n! \nsnmp-server community ourCommStr RO RW NMS_LIST\nsnmp-server community write_pw RW NMS_LIST\nsnmp-server enable traps snmp linkdown linkup\nsnmp-server host 10.1.1.1 trap_comm_string \n\nNote: If you enter the snmp-server host command with no keywords, the default is version 1 and to send all enabled traps to the host. No informs will be sent to this host. If no traps or informs keyword is present, traps are sent.\n\nSNMP v3 Configuration Example\n\nThe example ACL NMS_LIST and ADMIN_LIST are used to define what network management stations and administrator (users) desktops can access the device.\n\nip access-list standard ADMIN_LIST\n permit 10.1.1.35\n permit 10.1.1.36\nip access-list standard NMS_LIST\n permit 10.1.1.24\n permit 10.1.1.22\n permit 10.1.1.23\n!\nsnmp-server group NOC v3 priv read VIEW_ALL write VIEW_LIMIT access NMS_LIST\nsnmp-server group TRAP_GROUP v3 priv notify\n*tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF0F \nsnmp-server group ADMIN_GROUP v3 priv read VIEW_ALL write VIEW_ALL access ADMIN_LIST\nsnmp-server view VIEW_ALL internet included\nsnmp-server view VIEW_LIMIT internet included\nsnmp-server view VIEW_LIMIT internet.6.3.15 excluded\nsnmp-server view VIEW_LIMIT internet.6.3.16 excluded\nsnmp-server view VIEW_LIMIT internet.6.3.18 excluded\nsnmp-server enable traps snmp linkdown linkup\nsnmp-server host 10.1.1.24 version 3 priv TRAP_NMS1 \n\nNote: For the configured group TRAP_GROUP, the notify view is auto-generated by the snmp-server host command which bind the user (TRAP_NMS1) and the group it belongs to (TRAP_GROUP) to the list of notifications (traps or informs) which are sent to the host. Hence, the configuration snmp-server group TRAP_GROUP v3 results in the following:\nsnmp-server group TRAP_GROUP v3 priv notify *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF0F\n\n\nNote: Not required but for illustration purpose, the VIEW_LIMIT excludes MIB objects which could potentially reveal information about configured SNMP credentials. These objects are snmpUsmMIB, snmpVacmMIB, and snmpCommunityMIB which is configured as 1.3.6.1.6.3.15, 1.3.6.1.6.3.16, and 1.3.6.1.6.3.18 respectively\n\n\nNote that SNMPv3 users are not shown in a running configuration. You can view them with the show snmp user command. So for example, if the following users were configured as such.\n\nsnmp-server user HP_OV NOC v3 auth sha HPOVpswd priv aes 256 HPOVsecretkey\nsnmp-server user Admin1 ADMIN_GROUP v3 auth sha Admin1PW priv aes 256 Admin1key\nsnmp-server user Admin2 ADMIN_GROUP v3 auth md5 Admin2pass priv 3des Admin2key\nsnmp-server user TRAP_NMS1 TRAP_GROUP v3 auth sha trap_nms1_pw priv aes trap_nms1_key\n\nThe show snmp user command would depict the configured users as follows:\n\nR1#show snmp user\n\nUser name: HP_OV\nEngine ID: AB12CD34EF56\nstorage-type: nonvolatile active\nAuthentication Protocol: SHA\nPrivacy Protocol: AES256\nGroup-name: NOC\n\nUser name: Admin1\nEngine ID: 800000090300C20013080000\nstorage-type: nonvolatile active\nAuthentication Protocol: SHA\nPrivacy Protocol: AES256\nGroup-name: ADMIN_GROUP\n\nUser name: Admin2\nEngine ID: 800000090300C20013080000\nstorage-type: nonvolatile active\nAuthentication Protocol: MD5\nPrivacy Protocol: 3DES\nGroup-name: ADMIN_GROUP\n\nUser name: TRAP_NMS1\nEngine ID: 800000090300C20013080000\nstorage-type: nonvolatile active\nAuthentication Protocol: SHA\nPrivacy Protocol: AES256\nGroup-name: TRAP_GROUP\n\nR1#\n",
"description": "Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.",
"fixid": "F-3046r4_fix",
"fixtext": "Configure the network devices to only allow SNMP access from only addresses belonging to the management network.",
"iacontrols": null,
"id": "V-3021",
"ruleID": "SV-15332r2_rule",
"severity": "medium",
"title": "The network element must only allow SNMP access from addresses belonging to the management network.",
"version": "NET0890"
},
"V-3043": {
"checkid": "C-3825r7_chk",
"checktext": "Review the SNMP configuration of all managed nodes to ensure different community names (V1/2) or groups/users (V3) are configured for read-only and read-write access.\n\nIf unique community strings or accounts are not used for SNMP peers, this is a finding.",
"description": "Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking experts. If a hacker gains access to these devices and can easily guess the name, this could result in denial of service, interception of sensitive information, or other destructive actions.",
"fixid": "F-3068r4_fix",
"fixtext": "Configure the SNMP community strings on the network device and change them from the default values. SNMP community strings and user passwords must be unique and not match any other network device passwords. Different community strings (V1/2) or groups (V3) must be configured for various levels of read and write access.",
"iacontrols": null,
"id": "V-3043",
"ruleID": "SV-3043r4_rule",
"severity": "medium",
"title": "The network device must use different SNMP community names or groups for various levels of read and write access.",
"version": "NET1675"
},
"V-3056": {
"checkid": "C-3503r11_chk",
"checktext": "Review the network device configuration and validate there are no group accounts configured for access.\n\nIf a group account is configured on the device, this is a finding.",
"description": "Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network.",
"fixid": "F-3081r9_fix",
"fixtext": "Configure individual user accounts for each authorized person then remove any group accounts.",
"iacontrols": null,
"id": "V-3056",
"ruleID": "SV-3056r7_rule",
"severity": "high",
"title": "Group accounts must not be configured for use on the network device.",
"version": "NET0460"
},
"V-3057": {
"checkid": "C-3504r8_chk",
"checktext": "Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the least privilege level unless deemed necessary for assigned duties.\n\nIf it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding.",
"description": "By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personnel are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.",
"fixid": "F-3082r5_fix",
"fixtext": "Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.",
"iacontrols": null,
"id": "V-3057",
"ruleID": "SV-3057r6_rule",
"severity": "medium",
"title": "Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.",
"version": "NET0465"
},
"V-3058": {
"checkid": "C-3505r5_chk",
"checktext": "Review the organization's responsibilities list and reconcile the list of authorized accounts with those accounts defined for access to the network device.\n\nIf an unauthorized account is configured for access to the device, this is a finding.",
"description": "A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service, interception of sensitive information, or other destructive actions could potentially take place if an unauthorized account is configured to access the network device.",
"fixid": "F-3083r5_fix",
"fixtext": "Remove any account configured for access to the network device that is not defined in the organization's responsibilities list.",
"iacontrols": null,
"id": "V-3058",
"ruleID": "SV-3058r5_rule",
"severity": "medium",
"title": "Unauthorized accounts must not be configured for access to the network device.",
"version": "NET0470"
},
"V-3062": {
"checkid": "C-39960r6_chk",
"checktext": "Review all Cisco IOS routers and switches to determine if the global command \"service password-encryption\" is present in the configurations.\n\nAlso, review all accounts created on the device to ensure they have been setup using the \"username name secret password\" command. The following command will be found in the device configurations\n\nDevice# show run\n!\nservice password-encryption\n!\nusername name secret 5 $1$geU5$vc/uDRS5dWiOrpQJTimBw/\nenable secret 5 $1%mer9396y30d$FDA/292/",
"description": "Many attacks information systems and network elements are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the console or printout of the configuration. \n",
"fixid": "F-40534r1_fix",
"fixtext": "Configure the network element to ensure passwords are not viewable when displaying configuration information.\n\nDevice(config)# service password\nDevice(config)# username name secret S3cr3T!\nDevice(config)# enable secret $MyS3cr3TPW$\nDevice(config)# end",
"iacontrols": [
"ECSC-1"
],
"id": "V-3062",
"ruleID": "SV-41449r2_rule",
"severity": "high",
"title": "The network element must be configured to ensure passwords are not viewable when displaying configuration information. ",
"version": "NET0600"
},
"V-3069": {
"checkid": "C-12916r6_chk",
"checktext": "Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols.\n\n-SSHv2\n-SCP\n-HTTPS\n-SSL\n-TLS\n\nThis is an example that enables SSHv2/SCP/HTTPS on an IOS Device:\n!\nip domain-name example.com\n!\ncrypto key generate rsa modulus 2048\n!\nip ssh time-out 60\nip ssh authentication-retries 3\nip ssh source-interface GigabitEthernet 0/1\nip ssh version 2\nip ssh server algorithm mac hmac-sha1 hmac-sha1-96\nip ssh server algorithm encryption aes128-cbc aes192-cbc aes256-cbc\n!\nline vty 0 15\ntransport input ssh\n!\nip scp server enable\n!\nip http secure-server\n\nIf management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.",
"description": "Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.\n",
"fixid": "F-3094r5_fix",
"fixtext": "Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.",
"iacontrols": null,
"id": "V-3069",
"ruleID": "SV-15451r4_rule",
"severity": "medium",
"title": "Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.",
"version": "NET1638"
},
"V-3070": {
"checkid": "C-12920r3_chk",
"checktext": "Review the router or switch configuration to ensure that all logon connection attempts are logged as shown in the following example:\n\nlogging on\nlogin on-failure log every 1\nlogin on-success log every 1\n\nIf all logon connection attempts are not logged, this is a finding.\n\n",
"description": "Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.",
"fixid": "F-3095r3_fix",
"fixtext": "Configure the device to log all access attempts to the device to establish a management connection for administrative access.",
"iacontrols": null,
"id": "V-3070",
"ruleID": "SV-15455r3_rule",
"severity": "low",
"title": "The network element must log all attempts to establish a management connection for administrative access.",
"version": "NET1640"
},
"V-3072": {
"checkid": "C-3636r6_chk",
"checktext": "Review the running and boot configurations to determine if they are synchronized.\n\nIOS Procedure: With online editing, the \"show running-config\" command will only show the current running configuration settings, which are different from the IOS defaults. The \"show startup-config\" command will show the NVRAM startup configuration. Compare the two configurations to ensure they are synchronized. \n\nJUNOS Procedure: This will never be a finding. The active configuration is stored on flash as juniper.conf. A candidate configuration allows configuration changes while in configuration mode without initiating operational changes. The router implements the candidate configuration when it is committed; thereby, making it the new active configuration--at which time it will be stored on flash as juniper.conf and the old juniper.conf will become juniper.conf.1.\n\nIf running configuration and boot configurations are not the same, this is a finding.",
"description": "If the running and startup router configurations are not synchronized properly and a router malfunctions, it will not restart with all of the recent changes incorporated. If the recent changes were security related, then the routers would be vulnerable to attack.",
"fixid": "F-3097r4_fix",
"fixtext": "Add procedures to the standard operating procedure to keep the running configuration synchronized with the startup configuration.",
"iacontrols": null,
"id": "V-3072",
"ruleID": "SV-3072r3_rule",
"severity": "low",
"title": "The running configuration must be synchronized with the startup configuration after changes have been made and implemented.",
"version": "NET1030"
},
"V-3078": {
"checkid": "C-3551r5_chk",
"checktext": "Review all Cisco device configurations to verify service udp-small-servers and service tcp-small-servers are not found.\n\nIf TCP and UDP servers are not disabled, this is a finding.\n\nNote: The TCP and UDP small servers are enabled by default on Cisco IOS Software Version 11.2 and earlier. They are disabled by default on Cisco IOS Software Versions 11.3 and later.",
"description": "Cisco IOS provides the \"small services\" that include echo, chargen, and discard. These services, especially their User Datagram Protocol (UDP) versions, are infrequently used for legitimate purposes. However, they have been used to launch denial of service attacks that would otherwise be prevented by packet filtering. For example, an attacker might send a DNS packet, falsifying the source address to be a DNS server that would otherwise be unreachable, and falsifying the source port to be the DNS service port (port 53). If such a packet were sent to the Cisco's UDP echo port, the result would be Cisco sending a DNS packet to the server in question. No outgoing access list checks would be applied to this packet, since it would be considered locally generated by the router itself. The small services are disabled by default in Cisco IOS 12.0 and later software. In earlier software, they may be disabled using the commands no service tcp-small-servers and no service udp-small-servers.",
"fixid": "F-3103r4_fix",
"fixtext": "Change the device configuration to include the following IOS commands: no service tcp-small-servers and no service udp-small-servers for each device running an IOS version prior to 12.0. This is the default for IOS versions 12.0 and later (i.e., these commands will not appear in the running configuration.)",
"iacontrols": null,
"id": "V-3078",
"ruleID": "SV-3078r3_rule",
"severity": "low",
"title": "Network devices must have TCP and UDP small servers disabled.",
"version": "NET0720"
},
"V-3079": {
"checkid": "C-12701r2_chk",
"checktext": "Review the device configuration. Beginning with IOS 12.1(5), finger is disabled by default. For IOS version 12.0 through 12.1(4), verify that the no ip finger command is present. For any version prior to 12.0, verify that the no service finger command is present.",
"description": "The finger service supports the UNIX finger protocol, which is used for querying a host about the users that are logged on. This service is not necessary for generic users. If an attacker were to find out who is using the network, they may use social engineering practices to try to elicit classified DoD information.\n\n",
"fixid": "F-3104r4_fix",
"fixtext": "Configure the device to disable the Finger service.",
"iacontrols": null,
"id": "V-3079",
"ruleID": "SV-15305r2_rule",
"severity": "low",
"title": "The network element must have the Finger service disabled.",
"version": "NET0730"
},
"V-3085": {
"checkid": "C-39966r3_chk",
"checktext": "Verify the command \"ip http-server\" is not enabled in the configuration (the HTTPS server may be enabled for administrative access). As of 12.4, the http server is disabled by default. However, since many defaults are not shown by IOS, you may not see the command \"no ip http-server\" in the configuration depending on the release.\n\nIf the HTTP server is enabled, this is a finding.",
"description": "The additional services the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router. Most recent software versions support remote configuration and monitoring using the World Wide Web's HTTP protocol. In general, HTTP access is equivalent to interactive access to the router. The authentication protocol used for HTTP is equivalent to sending a clear-text password across the network, and, unfortunately, there is no effective provision in HTTP for challenge-based or one-time passwords. This makes HTTP a relatively risky choice for use across the public Internet. Any additional services that are enabled increase the risk for an attack since the router will listen for these services. The HTTPS server may be enabled for administrative access.",
"fixid": "F-3110r4_fix",
"fixtext": "Configure the device to disable using HTTP (port 80) for administrative access.",
"iacontrols": null,
"id": "V-3085",
"ruleID": "SV-41467r2_rule",
"severity": "medium",
"title": "The network element must have HTTP service for administrative access disabled.",
"version": "NET0740"
},
"V-3143": {
"checkid": "C-40236r3_chk",
"checktext": "Review the network devices configuration to determine if the vendor default password is active.\n\nIf any vendor default passwords are used on the device, this is a finding.",
"description": "Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not removing them prior to deploying the network devices into production provides an opportunity for a malicious user to gain unauthorized access to the device.",
"fixid": "F-35391r3_fix",
"fixtext": "Remove any vendor default passwords from the network devices configuration.",
"iacontrols": null,
"id": "V-3143",
"ruleID": "SV-3143r4_rule",
"severity": "high",
"title": "Network devices must not have any default manufacturer passwords.",
"version": "NET0240"
},
"V-3160": {
"checkid": "C-12697r2_chk",
"checktext": "Have the administrator enter the show version command to determine the installed IOS version. As of June 2010, the latest major release is 12.4 for routers and 12.2 for switches (both access and multi-layer). The release being used must have all IAVMs resolved and must not be in a Cisco deferred status or has been made obsolete. \n\nAsk the administrator login to the Cisco Software Center to download software. Select the specific router or switch model. Select the IOS Software link and then Verify that the release being used is listed under the release family (will need to expand the list) and not in the deferred list. If the release is not listed in either the release family or deferred, then the release is obsolete.\n\nVerify that all IAVMs have been addressed.\n\nNote: Cisco software in a differed state will still be at the Cisco Software Center and available for download under the deferred group, whereas software made obsolete is no longer available for download. Deferred status occurs when a software maintenance release is made obsolete and removed from order ability and service outside of Cisco's normal release schedule, or Cisco cancels a scheduled maintenance release from reaching the First-Customer-Ship (FCS) milestone. Deferrals are most often related to software quality issues. A deferral can be performed for an entire maintenance release, or just for certain sets of platforms or features within a release. A deferral prior to the FCS milestone may be performed by Cisco to protect customers from receiving software with known catastrophic defects. A deferral after FCS will expedite obsolescence for the release to limit the exposure of customers.\n",
"description": "Network devices that are not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches, as well as enhancements to IP security. Viruses, denial of service attacks, system weaknesses, back doors and other potentially harmful situations could render a system vulnerable, allowing unauthorized access to DoD assets.",
"fixid": "F-3185r4_fix",
"fixtext": "Update operating system to a supported version that addresses all related IAVMs.",
"iacontrols": null,
"id": "V-3160",
"ruleID": "SV-15302r2_rule",
"severity": "medium",
"title": "The network element must be running a current and supported operating system with all IAVMs addressed.",
"version": "NET0700"
},
"V-3175": {
"checkid": "C-12913r8_chk",
"checktext": "Review the network device configuration to verify all management connections for administrative access require authentication.\n\naaa authentication login AUTH_LIST group tacacs+ local\n!\nline vty 0 4\n login authentication AUTH_LIST\n exec-timeout 10 0\n transport input ssh\n\nOr using the default method list as shown in the example below.\n \naaa authentication login default group tacacs+ local\n!\nline vty 0 4\n exec-timeout 10 0\n transport input ssh\n",
"description": "Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.",
"fixid": "F-3200r3_fix",
"fixtext": "Configure authentication for all management connections.",
"iacontrols": null,
"id": "V-3175",
"ruleID": "SV-15448r4_rule",
"severity": "high",
"title": "The network devices must require authentication prior to establishing a management connection for administrative access.",
"version": "NET1636"
},
"V-3196": {
"checkid": "C-3820r6_chk",
"checktext": "Review the device configuration to verify it is configured to use SNMPv3 with both SHA authentication and privacy using AES encryption.\n\nDowngrades:\nIf the site is using Version 1 or Version 2 with all of the appropriate patches and has developed a migration plan to implement the Version 3 Security Model, this finding can be downgraded to a Category II.\n\nIf the targeted asset is running SNMPv3 and does not support SHA or AES, but the device is configured to use MD5 authentication and DES or 3DES encryption, then the finding can be downgraded to a Category III.\n\nIf the site is using Version 1 or Version 2 and has installed all of the appropriate patches or upgrades to mitigate any known security vulnerabilities, this finding can be downgraded to a Category II. In addition, if the device does not support SNMPv3, this finding can be downgraded to a Category III provided all of the appropriate patches to mitigate any known security vulnerabilities have been applied and has developed a migration plan that includes the device upgrade to support Version 3 and the implementation of the Version 3 Security Model.\n\nIf the device is configured to use to anything other than SNMPv3 with at least SHA-1 and AES, this is a finding. Downgrades can be determined based on the criteria above.",
"description": "SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network.",
"fixid": "F-3221r5_fix",
"fixtext": "If SNMP is enabled, configure the network device to use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography (i.e., SHA authentication and AES encryption).",
"iacontrols": null,
"id": "V-3196",
"ruleID": "SV-3196r4_rule",
"severity": "high",
"title": "The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.",
"version": "NET1660"
},
"V-3210": {
"checkid": "C-3822r7_chk",
"checktext": "Review the network devices configuration and verify if either of the SNMP community strings \"public\" or \"private\" is being used.\n\nIf default or well-known community strings are used for SNMP, this is a finding.",
"description": "Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device using the read community string \"public\". In addition, an attacker can change a system configuration using the write community string \"private\".",
"fixid": "F-3235r4_fix",
"fixtext": "Configure unique SNMP community strings replacing the default community strings.",
"iacontrols": null,
"id": "V-3210",
"ruleID": "SV-3210r4_rule",
"severity": "high",
"title": "The network device must not use the default or well-known SNMP community strings public and private.",
"version": "NET1665"
},
"V-3966": {
"checkid": "C-12935r7_chk",
"checktext": "Review the network device configuration to determine if an authentication server is defined for gaining administrative access. If so, there must be only one local account of last resort configured locally for an emergency.\n\nVerify the username and password for the local account of last resort is contained within a sealed envelope kept in a safe.\n\nIf an authentication server is used and more than one local account exists, this is a finding.",
"description": "Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between the device and the authentication server is not operable. The console or local account of last resort logon credentials must be stored in a sealed envelope and kept in a safe.",
"fixid": "F-3899r9_fix",
"fixtext": "Configure the device to only allow one local account of last resort for emergency access and store the credentials in a secure manner.",
"iacontrols": null,
"id": "V-3966",
"ruleID": "SV-15469r6_rule",
"severity": "medium",
"title": "In the event the authentication server is unavailable, the network device must have a single local account of last resort defined.",
"version": "NET0440"
},
"V-3967": {
"checkid": "C-12909r2_chk",
"checktext": "Review the configuration and verify that a session using the console port will time out after 10 minutes or less of inactivity as shown in the following example:\n\nline con 0\nexec-timeout 10 0 \n",
"description": "Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network element. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.",
"fixid": "F-3900r4_fix",
"fixtext": "Configure the timeout for idle console connection to 10 minutes or less.",
"iacontrols": null,
"id": "V-3967",
"ruleID": "SV-15444r2_rule",
"severity": "medium",
"title": "The network element must time out access to the console port after 10 minutes or less of inactivity.",
"version": "NET1624"
},
"V-3969": {
"checkid": "C-12800r7_chk",
"checktext": "Review the network device configuration and verify SNMP community strings are read-only when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3. \n\nIf write-access is used for SNMP versions 1, 2c, or 3-noAuthNoPriv mode and there is no documented approval by the IAO, this is a finding.\n\nSNMP v1/v2c Configuration Example\n\nDevice# show run\n!\nip access-list standard NMS_LIST\n permit 10.1.1.22\n permit 10.1.1.24\n! \nsnmp-server community c0macc3ss RO NMS_LIST\nsnmp-server community R34dWr1t3 RW NMS_LIST\nsnmp-server location Somewhere USA\nsnmp-server contact snmp.admin@snmp.mil\nsnmp-server enable traps\nsnmp host 10.1.1.22 traps SNMPv1\nsnmp host 10.1.1.24 traps SNMPv2c\n\n\nSNMP v3 Configuration Example\n\nThe example ACL NMS_LIST and ADMIN_LIST are used to define what network management stations and administrator (users) desktops can access the device. Examine all group statements to determine what groups are allowed write access. Have the administrator enter a \"show snmp user\" command and examine all users for these groups to verify that they must be authenticated.\n\nDevice# show run\n!\nip access-list standard ADMIN_LIST\n permit 10.1.1.35\n permit 10.1.1.36\nip access-list standard NMS_LIST\n permit 10.1.1.24\n permit 10.1.1.22\n permit 10.1.1.23\n!\nsnmp-server group NOC v3 priv read VIEW_ALL write VIEW_LIMIT access NMS_LIST\nsnmp-server group TRAP_GROUP v3 priv notify\n*tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF0F \nsnmp-server group ADMIN_GROUP v3 priv read VIEW_ALL write VIEW_ALL access ADMIN_LIST\nsnmp-server view VIEW_ALL internet included\nsnmp-server view VIEW_LIMIT internet included\nsnmp-server view VIEW_LIMIT internet.6.3.15 excluded\nsnmp-server view VIEW_LIMIT internet.6.3.16 excluded\nsnmp-server view VIEW_LIMIT internet.6.3.18 excluded\nsnmp-server enable traps snmp linkdown linkup\nsnmp-server host 10.1.1.24 version 3 priv TRAP_NMS1 \n\nNote: For the configured group TRAP_GROUP, the notify view is auto-generated by the snmp-server host command which bind the user (TRAP_NMS1) and the group it belongs to (TRAP_GROUP) to the list of notifications (traps or informs) which are sent to the host. Hence, the configuration snmp-server group TRAP_GROUP v3 results in the following:\nsnmp-server group TRAP_GROUP v3 priv notify *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF0F\n\nNote: Also, for illustration purpose only, the VIEW_LIMIT excludes MIB objects which could potentially reveal information about configured SNMP credentials. These objects are snmpUsmMIB, snmpVacmMIB, and snmpCommunityMIB which is configured as 1.3.6.1.6.3.15, 1.3.6.1.6.3.16, and 1.3.6.1.6.3.18 respectively\n\n\nSNMPv3 users are not shown in a running configuration. You can view them with the show \"snmp user\" command. So for example, if the following users were configured as such.\n\nsnmp-server user HP_OV NOC v3 auth sha HPOVpswd priv aes 256 HPOVsecretkey\nsnmp-server user Admin1 ADMIN_GROUP v3 auth sha Admin1PW priv aes 256 Admin1key\nsnmp-server user Admin2 ADMIN_GROUP v3 auth md5 Admin2pass priv 3des Admin2key\nsnmp-server user TRAP_NMS1 TRAP_GROUP v3 auth sha trap_nms1_pw priv aes trap_nms1_key\n\nThe show snmp user command would depict the configured users as follows:\n\nDevice#show snmp user\n\nUser name: HP_OV\nEngine ID: AB12CD34EF56\nstorage-type: nonvolatile active\nAuthentication Protocol: SHA\nPrivacy Protocol: AES256\nGroup-name: NOC\n\nUser name: Admin1\nEngine ID: 800000090300C20013080000\nstorage-type: nonvolatile active\nAuthentication Protocol: SHA\nPrivacy Protocol: AES256\nGroup-name: ADMIN_GROUP\n\nUser name: Admin2\nEngine ID: 800000090300C20013080000\nstorage-type: nonvolatile active\nAuthentication Protocol: MD5\nPrivacy Protocol: 3DES\nGroup-name: ADMIN_GROUP\n\nUser name: TRAP_NMS1\nEngine ID: 800000090300C20013080000\nstorage-type: nonvolatile active\nAuthentication Protocol: SHA\nPrivacy Protocol: AES256\nGroup-name: TRAP_GROUP",
"description": "Enabling write access to the device via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.",
"fixid": "F-3902r7_fix",
"fixtext": "Configure the network device to allow for read-only SNMP access when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3.",
"iacontrols": [
"ECSC-1"
],
"id": "V-3969",
"ruleID": "SV-30086r3_rule",
"severity": "medium",
"title": "The network device must only allow SNMP read-only access.",
"version": "NET0894"
},
"V-3971": {
"checkid": "C-4028r3_chk",
"checktext": "Review the device configuration and verify that access ports have not been assigned membership to the VLAN 1.\n\nIf any access ports are found in VLAN 1, this is a finding.",
"description": "In a VLAN-based network, switches use VLAN 1 as the default VLAN for in-band management and to communicate with other networking devices using Spanning-Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP)--all untagged traffic. As a consequence, VLAN 1 may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly.",
"fixid": "F-3904r2_fix",
"fixtext": "Best practices for VLAN-based networks is to prune unnecessary ports from gaining access to VLAN 1 as well as the management VLAN, and to separate in-band management, device protocol, and data traffic.",
"iacontrols": null,
"id": "V-3971",
"ruleID": "SV-3971r2_rule",
"severity": "medium",
"title": "VLAN 1 must not be used for user VLANs.",
"version": "NET-VLAN-004"
},
"V-3972": {
"checkid": "C-4030r3_chk",
"checktext": "Review the device configuration to determine if VLAN 1 is pruned from all trunk and access switch ports.\n\nIf VLAN 1 is not pruned from trunk or access switch ports where it's not required, this is a finding.",
"description": "VLAN 1 is a special VLAN that tags and handles most of the control plane traffic such as Spanning-Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP) all VLAN 1 tagged traffic. VLAN 1 is enabled on all trunks and ports by default. With larger campus networks, care needs to be taken about the diameter of the VLAN 1 STP domain; instability in one part of the network could affect VLAN 1, thereby influencing control-plane stability and therefore STP stability for all other VLANs.",
"fixid": "F-3905r2_fix",
"fixtext": "Best practice for VLAN-based networks is to prune unnecessary ports from gaining access to VLAN 1 and insure that it does not traverse trunks not requiring VLAN 1 traffic.",
"iacontrols": null,
"id": "V-3972",
"ruleID": "SV-3972r2_rule",
"severity": "low",
"title": "VLAN 1 must be pruned from all trunk and access ports that do not require it.",
"version": "NET-VLAN-005"
},
"V-3973": {
"checkid": "C-4035r3_chk",
"checktext": "Review the device configuration to determine if all disabled ports have been placed into an unused VLAN. The VLAN must not be VLAN 1.\n\nIf disabled ports are not assigned to an unused VLAN or have been placed into VLAN 1, this is a finding.",
"description": "It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member.",
"fixid": "F-3906r2_fix",
"fixtext": "Assign all disabled ports to an unused VLAN. Do not use VLAN1.",
"iacontrols": null,
"id": "V-3973",
"ruleID": "SV-3973r2_rule",
"severity": "low",
"title": "Disabled switch ports must be placed in an unused VLAN (do not use VLAN1).",
"version": "NET-VLAN-002"
},
"V-3984": {
"checkid": "C-4034r2_chk",
"checktext": "Review the switch configurations and examine all access ports. Verify that they do not belong to the native VLAN.\n\nIf any access switch ports are assigned to the native VLAN, it is a finding.",
"description": "Double encapsulation can be initiated by an attacker who has access to a switch port belonging to the native VLAN of the trunk port. Knowing the victim's MAC address and with the victim attached to a different switch belonging to the same trunk group, thereby requiring the trunk link and frame tagging, the malicious user can begin the attack by sending frames with two sets of tags. The outer tag that will have the attacker's VLAN ID (probably the well-known and omnipresent VLAN 1) is stripped off by the switch, and the inner tag that will have the victim's VLAN ID is used by the switch as the next hop and sent out the trunk port.",
"fixid": "F-3917r2_fix",
"fixtext": "To insure the integrity of the trunk link and prevent unauthorized access, the native VLAN of the trunk port should be changed from the default VLAN 1 to its own unique VLAN. Access switchports must never be assigned to the native VLAN.",
"iacontrols": null,
"id": "V-3984",
"ruleID": "SV-3984r2_rule",
"severity": "medium",
"title": "Access switchports must not be assigned to the native VLAN.",
"version": "NET-VLAN-009"
},
"V-4582": {
"checkid": "C-20059r4_chk",
"checktext": "Review the network device's configuration and verify authentication is required for console access. \n\nIf the device is accessed via the aux port, then verify that this port also requires authentication. If it is not used, then it must be disabled. The console port and the disabled aux port should look similar to the configuration example below that references an authentication list configured as AUTH_LIST. \n\naaa authentication login AUTH_LIST group tacacs+ local\n!\nline con 0\n login authentication AUTH_LIST\n exec-timeout 10 0\n\nOr using the default method list as shown in the example below.\n \naaa authentication login default group tacacs+ local\n!\nline con 0\n exec-timeout 10 0\n",
"description": "Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.",
"fixid": "F-4515r4_fix",
"fixtext": "Configure authentication for console access on the network device.",
"iacontrols": null,
"id": "V-4582",
"ruleID": "SV-19270r4_rule",
"severity": "high",
"title": "The network device must require authentication for console access.",
"version": "NET1623"
},
"V-4584": {
"checkid": "C-12942r2_chk",
"checktext": "Cisco IOS routers and switches use level 6 (informational) when logging packets that are dropped via access control list. (%SEC-6-IPACCESSLOGNP: list 1 denied 0 1.1.1.2 -> 1.1.1.1, 1 packet). Hence, it is imperative that log messages at level 6 are captured for further analysis and incident reporting. However, these messages do not need to go to the console, but must go to the syslog server. \n\nTo avoid being locked out of the console in the event of an intensive log message generation such as when a large number of packets are being dropped, you can implement any of the following:\n\n1. Limit the amount of logging based on same packet matching via the access-list log-update threshold command. The configured threshold specifies how often syslog messages are generated and sent after the initial packet match on a per flow basis. \n2. Rate-limit messages at specific severity levels destined to be logged at the console via logging rate-limit command.\n3. Have only messages at levels 0-5 (or 0-4) go to the console and messages at level 0-6 go to the syslog server. \n\nThe buffer could be set to notification level or altered to a different level when required (i.e. debugging).\n\nFollowing would be an example configuration:\n\n!\nlogging buffered 4096 informational\nlogging console notifications\n\u2026\n!\nlogging trap debugging \nlogging host 1.1.1.1\n!\n\nThe default state for logging is on and the default for the syslog server is informational (i.e. logging trap informational). Hence, the commands logging on and logging trap informational will not be shown via show run command. Hence, have the operator issue a show logging command to verify logging is on and the level for the syslog server (i.e. trap).\n\n\n\nR1#show logging\n\nSyslog logging: enabled (12 messages dropped, 0 messages rate-limited,\n 0 flushes, 0 overruns, xml disabled, filtering disabled)\n \n\u2026\n \n Console logging: level notifications, 56 messages logged, xml disabled,\n filtering disabled\n Monitor logging: level debugging, 0 messages logged, xml disabled,\n filtering disabled\n Buffer logging: level informational, 6 messages logged, xml disabled,\n filtering disabled\n\u2026\n\n Trap logging: level informational, 73 message lines logged\n Logging to 1.1.1.1 (udp port 514, audit disabled,\n authentication disabled, encryption disabled, link up),\n 37 message lines logged, \n 0 message lines rate-limited, \n 0 message lines dropped-by-MD, \n xml disabled, sequence number disabled\n filtering disabled \n\n\nThe table below lists the severity levels and message types for all log data.\n\nSeverity \nLevel Message Type\n\n0 Emergencies\n1 Alerts\n2 Critical\n3 Errors\n4 Warning\n5 Notifications\n6 Informational\n7 Debugging\n",
"description": "Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service disruptions, and react to probes and scans of the network. Syslog levels 0-6 are the levels required to collect the necessary information to help in the recovery process.",
"fixid": "F-4517r6_fix",
"fixtext": "Configure the network device to log all messages except debugging and send all log data to a syslog server.",
"iacontrols": null,
"id": "V-4584",
"ruleID": "SV-15476r2_rule",
"severity": "low",
"title": "The network element must log all messages except debugging and send all log data to a syslog server.",
"version": "NET1021"
},
"V-5611": {
"checkid": "C-12914r4_chk",
"checktext": "Review the configuration and verify that management access to the device is allowed only from the management network address space. The configuration should look similar to the following:\n\naccess-list 3 permit 192.168.1.10 log\naccess-list 3 permit 192.168.1.11 log\naccess-list 3 deny any log\n\u2026..\nline vty 0 4\n access-class 3 in\n\nIf management access can be gained from outside of the authorized management network, this is a finding.",
"description": "Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment, could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.",
"fixid": "F-5522r4_fix",
"fixtext": "Configure an ACL or filter to restrict management access to the device from only the management network.",
"iacontrols": null,
"id": "V-5611",
"ruleID": "SV-15449r3_rule",
"severity": "medium",
"title": "The network element must only allow management connections for administrative access from hosts residing in to the management network.",
"version": "NET1637"
},
"V-5612": {
"checkid": "C-12922r2_chk",
"checktext": "Review the configuration and verify the timeout is set for 60 seconds or less. The SSH service terminates the connection if protocol negotiation (that includes user authentication) is not complete within this timeout period.\n\nip ssh time-out 60 ",
"description": "An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for the malicious user attempting to make a connection to the network element.",
"fixid": "F-5523r5_fix",
"fixtext": "Configure the network devices so it will require a secure shell timeout of 60 seconds or less.",
"iacontrols": null,
"id": "V-5612",
"ruleID": "SV-15457r2_rule",
"severity": "medium",
"title": "The network element must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.",
"version": "NET1645"
},
"V-5613": {
"checkid": "C-12923r2_chk",
"checktext": "Review the configuration and verify the number of unsuccessful SSH login attempts is set at 3.\n\nip ssh authentication-retries 3",
"description": "An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.",
"fixid": "F-5524r9_fix",
"fixtext": "Configure the network device to require a maximum number of unsuccessful SSH logon attempts at 3.",
"iacontrols": null,
"id": "V-5613",
"ruleID": "SV-15458r2_rule",
"severity": "medium",
"title": "The network element must be configured for a maximum number of unsuccessful SSH login attempts set at 3 before resetting the interface.",
"version": "NET1646"
},
"V-5614": {
"checkid": "C-3552r5_chk",
"checktext": "Review the device configuration to determine if the PAD service is enabled.\n\nIf the PAD service is enabled, this is a finding.",
"description": "Packet Assembler Disassembler (PAD) is an X.25 component seldom used. It collects the data transmissions from the terminals and gathers them into a X.25 data stream and vice versa. PAD acts like a multiplexer for the terminals. If enabled, it can render the device open to attacks. Some voice vendors use PAD on internal routers.",
"fixid": "F-5525r5_fix",
"fixtext": "Configure the device to disable the PAD service.",
"iacontrols": null,
"id": "V-5614",
"ruleID": "SV-5614r3_rule",
"severity": "low",
"title": "Network devices must have the PAD service disabled.",
"version": "NET0722"
},
"V-5615": {
"checkid": "C-3559r7_chk",
"checktext": "Review the device configuration to verify the \"service tcp-keepalives-in\" command is configured.\n\nIf TCP Keep-Alives are not enabled, this is a finding.",
"description": "Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These \"orphaned\" sessions use up valuable router resources and can also be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keepalive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the keepalive message, the sending router will clear the connection and free resources allocated to the session.",
"fixid": "F-5526r7_fix",
"fixtext": "Configure the device to enable TCP Keep-Alives.",
"iacontrols": null,
"id": "V-5615",
"ruleID": "SV-5615r3_rule",
"severity": "low",
"title": "Network devices must have TCP Keep-Alives enabled for TCP sessions.",
"version": "NET0724"
},
"V-5622": {
"checkid": "C-3770r3_chk",
"checktext": "Review the device configuration and examine all trunk links. Verify the native VLAN has been configured to a VLAN other than the default VLAN 1.\n\nIf the native VLAN has been configured to VLAN 1, this is a finding.",
"description": "VLAN hopping can be initiated by an attacker who has access to a switch port belonging to the same VLAN as the native VLAN of the trunk link connecting to another switch in which the victim is connected to. If the attacker knows the victim's MAC address, it can forge a frame with two 802.1q tags and a layer 2 header with the destination address of the victim. Since the frame will ingress the switch from a port belonging to its native VLAN, the trunk port connecting to victim's switch will simply remove the outer tag because native VLAN traffic is to be untagged. The switch will forward the frame unto the trunk link unaware of the inner tag with a VLAN ID for which the victim's switchport is a member of.",
"fixid": "F-5533r2_fix",
"fixtext": "To ensure the integrity of the trunk link and prevent unauthorized access, the native VLAN of the trunk port should be changed from the default VLAN 1 to its own unique VLAN. The native VLAN must be the same on both ends of the trunk link; otherwise traffic could accidently leak between broadcast domains.",
"iacontrols": null,
"id": "V-5622",
"ruleID": "SV-5622r2_rule",
"severity": "medium",
"title": "The native VLAN must be assigned to a VLAN ID other than the default VLAN for all 802.1q trunk links.",
"version": "NET-VLAN-008"
},
"V-5623": {
"checkid": "C-58983r1_chk",
"checktext": "Review the device configuration to determine if trunking has been disabled on access ports.\n\nIf trunking is enabled on any access port, this is a finding.",
"description": "Double encapsulation can be initiated by an attacker who has access to a switch port belonging to the native VLAN of the trunk port. Knowing the victims MAC address and with the victim attached to a different switch belonging to the same trunk group, thereby requiring the trunk link and frame tagging, the malicious user can begin the attack by sending frames with two sets of tags. The outer tag that will have the attackers VLAN ID (probably the well-known and omnipresent VLAN 1) is stripped off by the switch, and the inner tag that will have the victims VLAN ID is used by the switch as the next hop and sent out the trunk port.",
"fixid": "F-5534r1_fix",
"fixtext": "Disable trunking on all access ports.",
"iacontrols": null,
"id": "V-5623",
"ruleID": "SV-5623r2_rule",
"severity": "medium",
"title": "Port trunking must be disabled on all access ports (do not configure trunk on, desirable, non-negotiate, or auto--only off).",
"version": "NET-VLAN-007"
},
"V-5626": {
"checkid": "C-40570r7_chk",
"checktext": "Verify if the switch configuration has 802.1x authentication implemented for all access switch ports connecting to LAN outlets (i.e., RJ-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms using the following procedure:\n\nStep 1: Verify that an 802.1x authentication server has been configured similar to the following example:\n\nradius-server host x.x.x.x auth-port 1813 key xxxxxxxxxxxxx \naaa new-model\naaa authentication dot1x default group radius\n\nStep 2: Verify 802.1x authentication has been enabled globally on the network device similar to the following example:\n\ndot1x system-auth-control\n\nStep 3: Verify that all host-facing access switchports are configured to use 802.1x similar to the examples below:\n\ninterface fastethernet0/2\nswitchport mode access\ndot1x port-control auto\n\nNote: The \u201cforce-authorized\u201d attribute must not be configured in leu of \u201cauto\u201d on the \u201cdot1x port-control\u201d command as this will bypass authentication and enable the switchport in an authorized state.\n\nNote: MAC Authentication Bypass (MAB) must be configured on those switch ports connected to devices that do not support an 802.1x supplicant as shown in the following example:\n\ninterface fastethernet0/2\nswitchport mode access\ndot1x mac-auth-bypass\n\nIf 802.1x authentication or MAB is not configured on all access switch ports connecting to LAN outlets or devices not located in the telecom room, wiring closets, or equipment rooms, this is a finding.\n",
"description": "The IEEE 802.1x standard is a client-server based access control and authentication protocol that restricts unauthorized clients from connecting to a local area network through host facing switch ports. The authentication server authenticates each client connected to to a switch port before making any services available to the client from the LAN. Unless the client is successfully authenticated, 802.1x access control allows only Extensible Authentication Protocol over LAN (EAPOL) traffic through the port to which the client is connected. After authentication is successful, normal traffic can pass through the port. Without the use of 802.1x, a malicious user could use the switch port to connect an unauthorized piece of computer or other network device to inject or steal data from the network without detection.",
"fixid": "F-5537r5_fix",
"fixtext": "Configure 802.1 x authentication on all access switch ports connecting to LAN outlets (i.e., RJ-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms. Configure MAB on those switch ports connected to devices that do not support an 802.1x supplicant. ",
"iacontrols": null,
"id": "V-5626",
"ruleID": "SV-42190r5_rule",
"severity": "high",
"title": "The switch must be configured to use 802.1x authentication on host facing access switch ports.",
"version": "NET-NAC-009"
},
"V-5628": {
"checkid": "C-3767r3_chk",
"checktext": "Review the device configurations to determine if a dedicated VLAN(s) have been implemented for the management network. VLAN 1 must not be used.\n\nIf a dedicated VLAN or VLANs have not been established for the management network, this is a finding.\n\nIf VLAN 1 is used for management, this is also a finding.",
"description": "All ports, including the internal sc0 interface, are configured by default to be members of VLAN 1. In a VLAN-based network, switches use VLAN 1 as the default VLAN for in-band management and to communicate with other networking devices using Spanning-Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP) all untagged traffic. As a consequence, VLAN 1 may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly.",
"fixid": "F-5539r2_fix",
"fixtext": "Best practices for VLAN-based networks is create a dedicated management VLAN, prune unnecessary ports from gaining access to VLAN 1 as well as the management VLAN, and to separate in-band management, device protocol, and data traffic.",
"iacontrols": null,
"id": "V-5628",
"ruleID": "SV-5628r2_rule",
"severity": "medium",
"title": "A dedicated management VLAN or VLANs must be configured to keep management traffic separate from user data and control plane traffic.",
"version": "NET-VLAN-006"
},
"V-7011": {
"checkid": "C-12911r2_chk",
"checktext": "Review the configuration and verify that the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected to it. The following configuration disables the Cisco IOS auxiliary port:\n \nline aux 0\n no exec\n\nNote: The command transport input none must be configured under the line aux 0. However, this is the default and will not be shown in the running configuration.\n",
"description": "The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network.\n\nSecured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.\n",
"fixid": "F-6614r3_fix",
"fixtext": "Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.",
"iacontrols": null,
"id": "V-7011",
"ruleID": "SV-15446r2_rule",
"severity": "low",
"title": "The network element\u2019s auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.",
"version": "NET1629"
}
},
"profiles": {
"MAC-1_Classified": {
"description": "",
"findings": {
"V-14669": "true",
"V-14671": "true",
"V-14717": "true",
"V-15432": "true",
"V-15434": "true",
"V-17820": "true",
"V-17821": "true",
"V-17824": "true",
"V-17825": "true",
"V-17826": "true",
"V-17827": "true",
"V-17832": "true",
"V-18544": "true",
"V-18565": "true",
"V-18566": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3062": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-3078": "true",
"V-3079": "true",
"V-3085": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-3971": "true",
"V-3972": "true",
"V-3973": "true",
"V-3984": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5622": "true",
"V-5623": "true",
"V-5626": "true",
"V-5628": "true",
"V-7011": "true"
},
"id": "MAC-1_Classified",
"title": "I - Mission Critical Classified"
},
"MAC-1_Public": {
"description": "",
"findings": {
"V-14669": "true",
"V-14671": "true",
"V-14717": "true",
"V-15432": "true",
"V-15434": "true",
"V-17820": "true",
"V-17821": "true",
"V-17824": "true",
"V-17825": "true",
"V-17826": "true",
"V-17827": "true",
"V-17832": "true",
"V-18544": "true",
"V-18566": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3021": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3062": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-3078": "true",
"V-3079": "true",
"V-3085": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-3971": "true",
"V-3972": "true",
"V-3973": "true",
"V-3984": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5622": "true",
"V-5623": "true",
"V-5626": "true",
"V-5628": "true",
"V-7011": "true"
},
"id": "MAC-1_Public",
"title": "I - Mission Critical Public"
},
"MAC-1_Sensitive": {
"description": "",
"findings": {
"V-14669": "true",
"V-14671": "true",
"V-14717": "true",
"V-15432": "true",
"V-15434": "true",
"V-17820": "true",
"V-17821": "true",
"V-17824": "true",
"V-17825": "true",
"V-17826": "true",
"V-17827": "true",
"V-17832": "true",
"V-18544": "true",
"V-18566": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3021": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3062": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-3078": "true",
"V-3079": "true",
"V-3085": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-3971": "true",
"V-3972": "true",
"V-3973": "true",
"V-3984": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5622": "true",
"V-5623": "true",
"V-5626": "true",
"V-5628": "true",
"V-7011": "true"
},
"id": "MAC-1_Sensitive",
"title": "I - Mission Critical Sensitive"
},
"MAC-2_Classified": {
"description": "",
"findings": {
"V-14669": "true",
"V-14671": "true",
"V-14717": "true",
"V-15432": "true",
"V-15434": "true",
"V-17820": "true",
"V-17821": "true",
"V-17824": "true",
"V-17825": "true",
"V-17826": "true",
"V-17827": "true",
"V-17832": "true",
"V-18544": "true",
"V-18565": "true",
"V-18566": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3062": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-3078": "true",
"V-3079": "true",
"V-3085": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-3971": "true",
"V-3972": "true",
"V-3973": "true",
"V-3984": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5622": "true",
"V-5623": "true",
"V-5626": "true",
"V-5628": "true",
"V-7011": "true"
},
"id": "MAC-2_Classified",
"title": "II - Mission Support Classified"
},
"MAC-2_Public": {
"description": "",
"findings": {
"V-14669": "true",
"V-14671": "true",
"V-14717": "true",
"V-15432": "true",
"V-15434": "true",
"V-17820": "true",
"V-17821": "true",
"V-17824": "true",
"V-17825": "true",
"V-17826": "true",
"V-17827": "true",
"V-17832": "true",
"V-18544": "true",
"V-18566": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3021": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3062": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-3078": "true",
"V-3079": "true",
"V-3085": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-3971": "true",
"V-3972": "true",
"V-3973": "true",
"V-3984": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5622": "true",
"V-5623": "true",
"V-5626": "true",
"V-5628": "true",
"V-7011": "true"
},
"id": "MAC-2_Public",
"title": "II - Mission Support Public"
},
"MAC-2_Sensitive": {
"description": "",
"findings": {
"V-14669": "true",
"V-14671": "true",
"V-14717": "true",
"V-15432": "true",
"V-15434": "true",
"V-17820": "true",
"V-17821": "true",
"V-17824": "true",
"V-17825": "true",
"V-17826": "true",
"V-17827": "true",
"V-17832": "true",
"V-18544": "true",
"V-18566": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3021": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3062": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-3078": "true",
"V-3079": "true",
"V-3085": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-3971": "true",
"V-3972": "true",
"V-3973": "true",
"V-3984": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5622": "true",
"V-5623": "true",
"V-5626": "true",
"V-5628": "true",
"V-7011": "true"
},
"id": "MAC-2_Sensitive",
"title": "II - Mission Support Sensitive"
},
"MAC-3_Classified": {
"description": "",
"findings": {
"V-14669": "true",
"V-14671": "true",
"V-14717": "true",
"V-15432": "true",
"V-15434": "true",
"V-17820": "true",
"V-17821": "true",
"V-17824": "true",
"V-17825": "true",
"V-17826": "true",
"V-17827": "true",
"V-17832": "true",
"V-18544": "true",
"V-18565": "true",
"V-18566": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3062": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-3078": "true",
"V-3079": "true",
"V-3085": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-3971": "true",
"V-3972": "true",
"V-3973": "true",
"V-3984": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5622": "true",
"V-5623": "true",
"V-5626": "true",
"V-5628": "true",
"V-7011": "true"
},
"id": "MAC-3_Classified",
"title": "III - Administrative Classified"
},
"MAC-3_Public": {
"description": "",
"findings": {
"V-14669": "true",
"V-14671": "true",
"V-14717": "true",
"V-15432": "true",
"V-15434": "true",
"V-17820": "true",
"V-17821": "true",
"V-17824": "true",
"V-17825": "true",
"V-17826": "true",
"V-17827": "true",
"V-17832": "true",
"V-18544": "true",
"V-18566": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3021": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3062": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-3078": "true",
"V-3079": "true",
"V-3085": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-3971": "true",
"V-3972": "true",
"V-3973": "true",
"V-3984": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5622": "true",
"V-5623": "true",
"V-5626": "true",
"V-5628": "true",
"V-7011": "true"
},
"id": "MAC-3_Public",
"title": "III - Administrative Public"
},
"MAC-3_Sensitive": {
"description": "",
"findings": {
"V-14669": "true",
"V-14671": "true",
"V-14717": "true",
"V-15432": "true",
"V-15434": "true",
"V-17820": "true",
"V-17821": "true",
"V-17824": "true",
"V-17825": "true",
"V-17826": "true",
"V-17827": "true",
"V-17832": "true",
"V-18544": "true",
"V-18566": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3021": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3062": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-3078": "true",
"V-3079": "true",
"V-3085": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-3971": "true",
"V-3972": "true",
"V-3973": "true",
"V-3984": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5622": "true",
"V-5623": "true",
"V-5626": "true",
"V-5628": "true",
"V-7011": "true"
},
"id": "MAC-3_Sensitive",
"title": "III - Administrative Sensitive"
}
},
"slug": "layer_2_switch_-_cisco",
"title": "Layer 2 Switch Security Technical Implementation Guide - Cisco",
"version": "8"
}
}