The network device must isolate security functions used to enforce access and information flow control from both non-security functions and other security functions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000186-NDM-000144	SRG-NET-000186-NDM-000144	SRG-NET-000186-NDM-000144_rule		Medium

Description
The network device must be designed and configured to isolate security functions enforcing access and information flow control. Isolation must separate processes that perform security functions from those performing non-security functions. An isolation boundary is implemented via partitions and domains. This boundary must provide access control and integrity protection of the hardware, software, and firmware of the network device. The network device application must maintain a separate execution domain (e.g., address space) for each executing process to minimize the risk of leakage or corruption of privileged information. For most network devices, internal information flow control is a product of system design.

Description

The network device must be designed and configured to isolate security functions enforcing access and information flow control. Isolation must separate processes that perform security functions from those performing non-security functions. An isolation boundary is implemented via partitions and domains. This boundary must provide access control and integrity protection of the hardware, software, and firmware of the network device. The network device application must maintain a separate execution domain (e.g., address space) for each executing process to minimize the risk of leakage or corruption of privileged information. For most network devices, internal information flow control is a product of system design.

STIG	Date
Network Device Management Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000186-NDM-000144_chk )
Verify the network device isolates security functions used to enforce access and information flow control from both non-security functions and other security functions. If the network device does not isolate security functions used to enforce access and information flow control from both non-security functions and other security functions, this is a finding.

Fix Text (F-SRG-NET-000186-NDM-000144_fix)
Configure the network device to isolate security functions used to enforce access and information flow control from both non-security functions and other security functions.