Ensure unused management interfaces, ports, protocols, and services are removed or disabled on devices providing remote access services to remote users.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-18536	SRC-RAP-090	SV-20079r1_rule		Medium

Description
When services, ports, and protocols are enabled by default or are not regularly used, SAs can neglect to secure or updates them. These services can then become a path for exploitation since they are often well known vulnerabilities to attackers.

STIG	Date
Remote Access Policy STIG	2016-03-28

Details

Check Text ( C-21325r1_chk )
Have the SA display the services running on the remote access device or underlying OS. CAVEAT: Anti-virus software running on the OS would be an exception to the above requirement. In fact, it is recommended that anti-virus software be implemented on any gateway, if supported. However, there are currently no specific configuration guidance.

Fix Text (F-20527r1_fix)
The IAO will ensure unused management interfaces, ports, protocols and services are removed or disabled on devices providing remote access services to remote users.