The implementation of an IP-based VTC system supporting conferences on multiple networks having different classification levels must maintain isolation between the networks to which it connects by implementing separation of equipment and cabling between the various networks having differing classification levels in accordance with NSTISSAM TEMPEST-2-95, RED/BLACK installation guidance.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-43025	RTS-VTC 7200	SV-55754r1_rule	ECTC-1	Medium

Description
Information leakage is the intentional or unintentional release of information to an untrusted environment from electromagnetic signals emanations. Security categories or classifications of information systems (with respect to confidentiality) and organizational security policies guide the selection of security controls employed to protect systems against information leakage due to electromagnetic signals emanations. • The facility housing the secure VTC equipment (i.e., the secure conference room) must meet the physical and/or TEMPEST requirements for such rooms. • The appropriate and required separations between RED and BLACK equipment and cables must be met. This includes cable routing inside equipment cabinets. Depending on the TEMPEST ZONE, the separation requirements are: Minimum equipment separation - 50 cm or 1m Minimum cable separation - 5 cm or 15 cm • Separate power sources are required for RED equipment and BLACK equipment. The unencrypted information, wiring, and processing equipment are considered RED, while the encrypted information, wiring, and processing equipment are considered BLACK.

Description

Information leakage is the intentional or unintentional release of information to an untrusted environment from electromagnetic signals emanations. Security categories or classifications of information systems (with respect to confidentiality) and organizational security policies guide the selection of security controls employed to protect systems against information leakage due to electromagnetic signals emanations. • The facility housing the secure VTC equipment (i.e., the secure conference room) must meet the physical and/or TEMPEST requirements for such rooms. • The appropriate and required separations between RED and BLACK equipment and cables must be met. This includes cable routing inside equipment cabinets. Depending on the TEMPEST ZONE, the separation requirements are: Minimum equipment separation - 50 cm or 1m Minimum cable separation - 5 cm or 15 cm • Separate power sources are required for RED equipment and BLACK equipment. The unencrypted information, wiring, and processing equipment are considered RED, while the encrypted information, wiring, and processing equipment are considered BLACK.

STIG	Date
Video Teleconference STIG	2014-02-11

Details

Check Text ( C-49182r6_chk )
Cabling and Equipment Check – Based on the TEMPEST ZONE, verify whether the required separations between RED and BLACK equipment and cables have been met. This includes cable routing inside equipment cabinets. Depending on the TEMPEST ZONE, the separation requirements are: • Minimum equipment separation - 50 cm or 1m • Minimum cable separation - 5 cm or 15 cm If the cables or equipment are closer than the minimum cable and equipment separation distances, this is a finding. Power source check – Verify that RED equipment and BLACK equipment have separate power sources. If they do not have separate power sources, this is a finding. In the event a CTTA has reviewed the system’s installation and provided a favorable report or certification, this is not a finding.

Check Text ( C-49182r6_chk )

Cabling and Equipment Check –
Based on the TEMPEST ZONE, verify whether the required separations between RED and BLACK equipment and cables have been met. This includes cable routing inside equipment cabinets. Depending on the TEMPEST ZONE, the separation requirements are:
• Minimum equipment separation - 50 cm or 1m
• Minimum cable separation - 5 cm or 15 cm
If the cables or equipment are closer than the minimum cable and equipment separation distances, this is a finding.

Power source check –
Verify that RED equipment and BLACK equipment have separate power sources. If they do not have separate power sources, this is a finding.

In the event a CTTA has reviewed the system’s installation and provided a favorable report or certification, this is not a finding.

Fix Text (F-48609r4_fix)
Install cabling and equipment in accordance with NSTISSAM TEMPEST-2-95, RED/BLACK installation guidance. Depending on the TEMPEST ZONE, the separation requirements are: • Minimum equipment separation - 50 cm or 1m. • Minimum cable separation - 5 cm or 15 cm.