An IP-based VTC system implementing a single CODEC supporting conferences on multiple networks having different classification levels must be implemented in a manner such that configuration information for a network having a higher classification level is not disclosed to a network having a lower classification level.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-43021	RTS-VTC 7120	SV-55750r1_rule	EBCR-1	Medium

Description
Connecting the CODEC to a network while it is being reconfigured could lead to the disclosure of sensitive configuration information for a network having a higher classification level to a network having a lower classification level. Ideally, the CODEC will be disconnected from any network while it is being reconfigured. However, the requirement can be met by using a procedure that purges the configuration for the currently connected network, power cycling the CODEC as required (for a minimum of 60 seconds per another requirement) as the CODEC is switched to the next network, then reconfigures the CODEC for the next session.

Description

Connecting the CODEC to a network while it is being reconfigured could lead to the disclosure of sensitive configuration information for a network having a higher classification level to a network having a lower classification level. Ideally, the CODEC will be disconnected from any network while it is being reconfigured. However, the requirement can be met by using a procedure that purges the configuration for the currently connected network, power cycling the CODEC as required (for a minimum of 60 seconds per another requirement) as the CODEC is switched to the next network, then reconfigures the CODEC for the next session.

STIG	Date
Video Services Policy STIG	2017-04-06

Details

Check Text ( C-49178r4_chk )
Review the VTC system architecture documentation and observe system operation while transitioning between networks to verify one of the following: • The CODEC is switched to a disconnected/unused switch position while it is being purged/reconfigured . • The CODEC is purged while connected to one network, then power cycled as it is switched to the next network, then reconfigured for that network. • Alternately, if a manual switching procedure is used, ensure the CODEC is physically disconnected from any network while being reconfigured. If none of these procedures is being followed, this is a finding.

Check Text ( C-49178r4_chk )

Review the VTC system architecture documentation and observe system operation while transitioning between networks to verify one of the following:
• The CODEC is switched to a disconnected/unused switch position while it is being purged/reconfigured .
• The CODEC is purged while connected to one network, then power cycled as it is switched to the next network, then reconfigured for that network.
• Alternately, if a manual switching procedure is used, ensure the CODEC is physically disconnected from any network while being reconfigured.
If none of these procedures is being followed, this is a finding.

Fix Text (F-48605r8_fix)
Architect, implement, and configure the system such that the A/B, A/B/C, or A/B/C/D switch connects the CODEC to an unused switch position while it is being reconfigured during transition from one network to another. OR Architect, implement, and configure the system such that the CODEC configuration is purged before it is switched to the next network, then the CODEC is power cycled for the required time period as the A/B, A/B/C, or A/B/C/D switch connects the CODEC to the next network, then the CODEC is reconfigured for that network. OR If a manual switching procedure is used, physically disconnect the CODEC from any network while it is reconfigured for the next network.

Fix Text (F-48605r8_fix)

Architect, implement, and configure the system such that the A/B, A/B/C, or A/B/C/D switch connects the CODEC to an unused switch position while it is being reconfigured during transition from one network to another.
OR
Architect, implement, and configure the system such that the CODEC configuration is purged before it is switched to the next network, then the CODEC is power cycled for the required time period as the A/B, A/B/C, or A/B/C/D switch connects the CODEC to the next network, then the CODEC is reconfigured for that network.
OR
If a manual switching procedure is used, physically disconnect the CODEC from any network while it is reconfigured for the next network.