The organization must define networking protocols within the information system deemed to be non-secure for remote access into DoD networks.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35911	SRG-MPOL-002	SV-47227r1_rule		Low

Description
Some networking protocols are considered less secure than others (e.g., Bluetooth, peer-to-peer, etc.). In its access control policy and security procedures addressing remote access to the information system, the organization, in order to protect and secure its network, must define those network protocols considered to be non-secure. Failure to define the non-secure network protocols could result in the organization's network being open to access by these non-secure protocols, which could result in unauthorized access to, modification of, or destruction of sensitive or classified data. For mobile systems, several non-secure protocols are used routinely in the commercial world. Many of these must not be allowed on DoD networks and specified.

Description

Some networking protocols are considered less secure than others (e.g., Bluetooth, peer-to-peer, etc.). In its access control policy and security procedures addressing remote access to the information system, the organization, in order to protect and secure its network, must define those network protocols considered to be non-secure. Failure to define the non-secure network protocols could result in the organization's network being open to access by these non-secure protocols, which could result in unauthorized access to, modification of, or destruction of sensitive or classified data. For mobile systems, several non-secure protocols are used routinely in the commercial world. Many of these must not be allowed on DoD networks and specified.

STIG	Date
Mobile Policy Security Requirements Guide	2013-01-24

Details

Check Text ( C-44155r1_chk )
Review the organization's policies related to network protocols. The organization must document those networking protocols within the information system deemed to be non-secure for remote access into DoD networks. If the policies do not specifically list non-secure protocols, this is a finding.

Fix Text (F-40442r1_fix)
Create and document a list of networking protocols within the information system deemed to be non-secure for remote access into DoD networks.