{
"stig": {
"date": "2019-10-02",
"description": "This STIG contains the technical security controls for the operation of a WLAN access point (Enclave-NIPRNet Connected role) in the DoD environment.",
"findings": {
"V-14671": {
"checkid": "C-12793r9_chk",
"checktext": "Review the network element configuration and verify that it is authenticating NTP messages received from the NTP server or peer using a FIPS-approved message authentication code algorithm. FIPS-approved algorithms for authentication are the cipher-based message authentication code (CMAC) and the keyed-hash message authentication code (HMAC). AES and 3DES are NIST-approved CMAC algorithms. The following are NIST-approved HMAC algorithms: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256.\n\nDowngrade:\nIf the network device is not capable of authenticating the NTP server or peer using a FIPS-approved message authentication code algorithm, then MD5 can be utilized for NTP message authentication and the finding can be downgraded to a CAT III.\n\nIf the network element is not configured to authenticate received NTP messages using a FIPS-approved message authentication code algorithm, this is a finding. A downgrade can be determined based on the criteria above.",
"description": "Since NTP is used to ensure accurate log file time stamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. \n\nTwo NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka \"symmetric mode\"). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client's stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers.\n\nA hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device loses connectivity to its upstream NTP server, it will be able to choose time from one of its peers. \n\nThe NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It is not used to authenticate NTP clients because NTP servers do not care about the authenticity of their clients, as they never accept any time from them.",
"fixid": "F-14132r4_fix",
"fixtext": "Configure the device to authenticate all received NTP messages using a FIPS-approved message authentication code algorithm.",
"iacontrols": null,
"id": "V-14671",
"ruleID": "SV-15327r6_rule",
"severity": "medium",
"title": "Network devices must authenticate all NTP messages received from NTP servers and peers.",
"version": "NET0813"
},
"V-14717": {
"checkid": "C-12924r8_chk",
"checktext": "Review the configuration and verify SSH Version 1 is not being used for administrative access.\n\nIf the device is using an SSHv1 session, this is a finding.",
"description": "SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to attacks, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1.",
"fixid": "F-14184r5_fix",
"fixtext": "Configure the network device to use SSH version 2.",
"iacontrols": null,
"id": "V-14717",
"ruleID": "SV-15459r4_rule",
"severity": "medium",
"title": "The network device must not allow SSH Version 1 to be used for administrative access.",
"version": "NET1647"
},
"V-14846": {
"checkid": "C-13276r1_chk",
"checktext": "Review device configuration. \n1. Obtain the SSID using a wireless scanner or the AP or WLAN controller management software. \n2. Verify the name is not meaningful (e.g., site name, product name, room number, etc.) or set to the manufacturer's default value.\n\nMark as a finding if the SSID does not meet the requirement listed above.",
"description": "An SSID identifying the unit, site or purpose of the WLAN or is set to the manufacturer default may cause an OPSEC vulnerability.",
"fixid": "F-34142r1_fix",
"fixtext": "Change the SSID to a pseudo random word that does not identify the unit, base, or organization. ",
"iacontrols": null,
"id": "V-14846",
"ruleID": "SV-15614r1_rule",
"severity": "low",
"title": "WLAN SSIDs must be changed from the manufacturer\u2019s default to a pseudo random word that does not identify the unit, base, organization, etc. ",
"version": "WIR0105"
},
"V-14886": {
"checkid": "C-13412r3_chk",
"checktext": "Detailed policy requirements:\n\nWireless access points and bridges must not be directly connected to the enclave network. A network device must separate wireless access from other elements of the enclave network. Sites must also comply with the Network Infrastructure STIG configuration requirements for DMZ, VLAN, and VPN configurations, as applicable.\n\nExamples of acceptable architectures include placing access points or controllers in a screened subnet (e.g. DMZ separating intranet and wireless network) or dedicated virtual LAN (VLAN) with ACLs. \n\nCheck Procedures:\n\nReview network architecture with the network administrator.\n1. Verify compliance by inspecting the site network topology diagrams.\n2. Since many network diagrams are not kept up-to-date, walk through the connections with the network administrator using network management tools or diagnostic commands to verify the diagrams are current.\n\nIf the site\u2019s wireless infrastructure, such as access points and bridges, is not isolated from the enclave network, this is a finding.",
"description": "If an adversary is able to compromise an access point or controller that is directly connected to an enclave network, then the adversary can easily surveil and attack other devices from that beachhead. A defense-in-depth approach requires an additional layer of protection exist between the WLAN and the enclave network. This is particularly important for wireless networks, which may be vulnerable to attack from outside physical perimeter of the facility or base given the inherent nature of radio communications to penetrate walls, fences, and other physical boundaries.",
"fixid": "F-3448r1_fix",
"fixtext": "Remove wireless network devices with direct connections to an enclave network. If feasible, reconfigure network connections to isolate the WLAN infrastructure from the enclave network, separating them with a firewall or equivalent protection.",
"iacontrols": null,
"id": "V-14886",
"ruleID": "SV-15654r2_rule",
"severity": "medium",
"title": "Wireless access points and bridges must be placed in dedicated subnets outside the enclave\u2019s perimeter.",
"version": "WIR0135"
},
"V-14888": {
"checkid": "C-13416r1_chk",
"checktext": "1. Review the relevant configuration screen of the WLAN controller or access point. \n2. Verify the session timeout setting is set for 30 minutes or less. \n4. Mark as a finding if any of the following are found.\n- Session timeout is not set to 30 minutes or less for the entire WLAN.\n- The WLAN does not have the capability to enable the session time-out feature.",
"description": "A WLAN session that never terminates due to inactivity may allow an opening for an adversary to highjack the session to obtain access to the network. ",
"fixid": "F-34136r1_fix",
"fixtext": "Set the WLAN inactive session timeout to 30 minutes or less.",
"iacontrols": null,
"id": "V-14888",
"ruleID": "SV-15656r1_rule",
"severity": "medium",
"title": "The WLAN inactive session timeout must be set for 30 minutes or less. ",
"version": "WIR0110"
},
"V-14889": {
"checkid": "C-13418r1_chk",
"checktext": "Review documentation and inspect AP locations.\n\n1. Review documentation showing signal strength analysis from site survey activities, if available. \n2. Use testing equipment or WLAN clients to determine if the signal strength is, in the reviewer\u2019s judgment, excessively outside the required area (e.g., strong signal in the parking area, public areas, or uncontrolled spaces). \n3. Lower end APs will not have this setting available\u2014in this case, the site should locate the APs away from exterior walls to achieve compliance with this requirement. \n4. Mark as a finding if any of the following is found.\no Visual inspection of equipment shows obvious improper placement of APs where it will emanate into uncontrolled spaces (e.g., next to external walls, windows, or doors; uncontrolled areas; or public areas).\no Building walk-through testing shows signals of sufficient quality and strength to allow wireless access to exist in areas not authorized for WLAN access.",
"description": "Vulnerability Discussion: Most commercially-available WLAN equipment is pre-configured for signal power appropriate to most applications of the WLAN equipment. In some cases, this may permit the signals to be received outside the physical areas for which they are intended. This may occur when the intended area is relatively small, such as a conference room, or when the access point is placed near or window or wall, thereby allowing signals to be received in neighboring areas. In such cases, an adversary may be able to compromise the site\u2019s OPSEC posture by measuring the presence of the signal and the quantity of data transmitted to obtain information about when personnel are active and what they are doing. Furthermore, if the signal is not appropriately protected through defense-in-depth mechanisms, the adversary could possibly use the connection to access DoD networks and sensitive information.",
"fixid": "F-3445r1_fix",
"fixtext": "Move APs to areas in which signals do not emanate in a manner making them usable outside the areas authorized for WLAN access. Alternatively, replace omni-directional antennae with directional antennae if this will solve the problem. If these solutions are not effective, then adjust the transmission power settings on the AP to reduce the usability of signals in unauthorized areas. If the WLAN equipment does not allow the transmission power to be adjusted, and the APs are placed in a location where the IAO determines there is significant risk that an adversary could be present in location where signals may be intercepted, then the site should procure WLAN equipment that permits power adjustment.",
"iacontrols": null,
"id": "V-14889",
"ruleID": "SV-15657r1_rule",
"severity": "low",
"title": "WLAN signals must not be intercepted outside areas authorized for WLAN access.",
"version": "WIR0120"
},
"V-15432": {
"checkid": "C-14439r6_chk",
"checktext": "Verify an authentication server is required to access the device and that there are two or more authentication servers defined.\n\nIf the device is not configured for two separate authentication servers, this is a finding.",
"description": "The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ or RADIUS, the administrators can easily add or remove user accounts, add or remove command authorizations, and maintain a log of user activity.\n\nThe use of an authentication server provides the capability to assign router administrators to tiered groups that contain their privilege level that is used for authorization of specific commands. For example, user mode would be authorized for all authenticated administrators while configuration or edit mode should only be granted to those administrators that are permitted to implement router configuration changes.",
"fixid": "F-15096r3_fix",
"fixtext": "Configure the device to use two separate authentication servers.",
"iacontrols": null,
"id": "V-15432",
"ruleID": "SV-16259r4_rule",
"severity": "medium",
"title": "Network devices must use two or more authentication servers for the purpose of granting administrative access.",
"version": "NET0433"
},
"V-15434": {
"checkid": "C-14441r6_chk",
"checktext": "Review the emergency administration account configured on the network devices and verify that it has been assigned to a privilege level that will enable the administrator to perform necessary administrative functions when the authentication server is not online.\n\nIf the emergency administration account is configured for more access than needed to troubleshoot issues, this is a finding.",
"description": "The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate authorization level to perform necessary administrative functions during this time.",
"fixid": "F-15098r7_fix",
"fixtext": "Assign a privilege level to the emergency administration account to allow the administrator to perform necessary administrative functions when the authentication server is not online.",
"iacontrols": null,
"id": "V-15434",
"ruleID": "SV-16261r5_rule",
"severity": "high",
"title": "The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online.",
"version": "NET0441"
},
"V-17821": {
"checkid": "C-19238r5_chk",
"checktext": "Review the device configuration to determine if the OOB management interface is assigned an appropriate IP address from the authorized OOB management network.\n\nIf an IP address assigned to the interface is not from an authorized OOB management network, this is a finding.",
"description": "The OOBM access switch will connect to the management interface of the managed network device. The management interface of the managed network device will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.",
"fixid": "F-17736r2_fix",
"fixtext": "Configure the OOB management interface with an IP address from the address space belonging to the OOBM network.",
"iacontrols": null,
"id": "V-17821",
"ruleID": "SV-19075r4_rule",
"severity": "medium",
"title": "The network devices OOBM interface must be configured with an OOBM network address.",
"version": "NET0991"
},
"V-17822": {
"checkid": "C-19239r5_chk",
"checktext": "Step 1: Verify the managed interface has an inbound and outbound ACL or filter.\n\nStep 2: Verify the ingress ACL blocks all transit traffic--that is, any traffic not destined to the router itself. In addition, traffic accessing the managed elements should be originated at the NOC.\n\nStep 3: Verify the egress ACL blocks any traffic not originated by the managed element.\n\nIf management interface does not have an ingress and egress filter configured and applied, this is a finding.",
"description": "The OOBM access switch will connect to the management interface of the managed network device. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network device will be directly connected to the OOBM network.\n\nAn OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network.",
"fixid": "F-17737r2_fix",
"fixtext": "If the management interface is a routed interface, it must be configured with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.",
"iacontrols": null,
"id": "V-17822",
"ruleID": "SV-19076r4_rule",
"severity": "medium",
"title": "The network devices management interface must be configured with both an ingress and egress ACL.",
"version": "NET0992"
},
"V-23747": {
"checkid": "C-3581r5_chk",
"checktext": "Review the configuration and verify two NTP servers have been defined.\n\nIf the device is not configured to use two separate NTP servers, this is a finding.",
"description": "Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If logs cannot be successfully compared between each of the routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network devices to synchronize to an accurate time source.",
"fixid": "F-3044r2_fix",
"fixtext": "Configure the device to use two separate NTP servers.",
"iacontrols": null,
"id": "V-23747",
"ruleID": "SV-28651r4_rule",
"severity": "low",
"title": "Network devices must use at least two NTP servers to synchronize time.",
"version": "NET0812"
},
"V-28784": {
"checkid": "C-35853r4_chk",
"checktext": "Review the device configuration to determine if the call home service or feature is disabled on the device. If the call home service is enabled on the device, this is a finding.\n\nNote: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.\n",
"description": "Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.",
"fixid": "F-31103r2_fix",
"fixtext": "Configure the network device to disable the call home service or feature.\n\nNote: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.\n",
"iacontrols": null,
"id": "V-28784",
"ruleID": "SV-36774r5_rule",
"severity": "medium",
"title": "A service or feature that calls home to the vendor must be disabled.",
"version": "NET0405"
},
"V-3012": {
"checkid": "C-3456r6_chk",
"checktext": "Review the network devices configuration to determine if administrative access to the device requires some form of authentication--at a minimum a password is required.\n\nIf passwords aren't used to administrative access to the device, this is a finding.",
"description": "Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network device. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network device providing opportunity for intruders to compromise resources within the network infrastructure.",
"fixid": "F-3037r6_fix",
"fixtext": "Configure the network devices so it will require a password to gain administrative access to the device.",
"iacontrols": null,
"id": "V-3012",
"ruleID": "SV-3012r4_rule",
"severity": "high",
"title": "Network devices must be password protected.",
"version": "NET0230"
},
"V-3013": {
"checkid": "C-3474r11_chk",
"checktext": "Review the device configuration or request that the administrator logon to the device and observe the terminal. Verify either Option A or Option B (for systems with character limitations) of the Standard Mandatory DoD Notice and Consent Banner is displayed at logon. The required banner verbiage follows and must be displayed verbatim:\n\nOption A\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. \n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\nOption B\n\nIf the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: \"I've read & consent to terms in IS user agreem't.\"\n\nIf the device configuration does not have a logon banner as stated above, this is a finding.",
"description": "All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required logon warning banner prior to logon attempts will limit DoD's ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA's ability to monitor the device's usage is limited unless a proper warning banner is displayed.\n\nDoD CIO has issued new, mandatory policy standardizing the wording of \"notice and consent\" banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, \"Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement\", dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.",
"fixid": "F-3038r12_fix",
"fixtext": "Configure all management interfaces to the network device to display the DoD-mandated warning banner verbiage at logon regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows:\n\nOption A\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\n\nOption B\n\nIf the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: \"I've read & consent to terms in IS user agreem't.\"",
"iacontrols": null,
"id": "V-3013",
"ruleID": "SV-3013r5_rule",
"severity": "medium",
"title": "Network devices must display the DoD-approved logon banner warning.",
"version": "NET0340"
},
"V-3014": {
"checkid": "C-3540r6_chk",
"checktext": "Review the management connection for administrative access and verify the network device is configured to time-out the connection at 10 minutes or less of inactivity.\n\nIf the device does not terminate inactive management connections at 10 minutes or less, this is a finding.",
"description": "Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled between the managed network device and a PC or terminal server when the later has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network device as well as reduce the risk of a management session from being hijacked. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.",
"fixid": "F-3039r5_fix",
"fixtext": "Configure the network devices to ensure the timeout for unattended administrative access connections is no longer than 10 minutes.",
"iacontrols": null,
"id": "V-3014",
"ruleID": "SV-3014r4_rule",
"severity": "medium",
"title": "The network devices must timeout management connections for administrative access after 10 minutes or less of inactivity.",
"version": "NET1639"
},
"V-30257": {
"checkid": "C-38915r4_chk",
"checktext": "Detailed Policy Requirements:\n\nCertificate-based PKI authentication must be used to connect WLAN client devices to DoD networks. The certificate-based PKI authentication should directly support the WLAN EAP-TLS implementation. \nAt least one layer of user authentication must enforce network authentication requirements (e.g., CAC authentication) before the user is able to access DoD information resources.\n\nCheck Procedures:\n\nInterview the site ISSO and SA. Determine if the site\u2019s network is configured to require certificate-based PKI authentication before a WLAN user is connected to the network. If certificate-based PKI authentication is not required prior to a DoD WLAN user accessing the DoD network, this is a finding.\nNote: This check does not apply to medical devices. Medical devices are permitted to connect to the WLAN using pre-shared keys.",
"description": "DoD certificate-based PKI authentication is strong, two-factor authentication that relies on carefully evaluated cryptographic modules. Implementations of EAP-TLS that are not integrated with certificate-based PKI could have security vulnerabilities. For example, an implementation that uses a client certificate on laptop without a second factor could enable an adversary with access to the laptop to connect to the WLAN without a PIN or password. Systems that do not use the certificate-based PKI are also much more likely to be vulnerable to weaknesses in the underlying public key infrastructure (PKI) that supports EAP-TLS.",
"fixid": "F-34052r2_fix",
"fixtext": "Integrate certificate-based PKI authentication into the WLAN authentication process. ",
"iacontrols": null,
"id": "V-30257",
"ruleID": "SV-39895r3_rule",
"severity": "medium",
"title": "WLAN EAP-TLS implementation must use certificate-based PKI authentication to connect to DoD networks.",
"version": "WIR0116"
},
"V-3043": {
"checkid": "C-3825r7_chk",
"checktext": "Review the SNMP configuration of all managed nodes to ensure different community names (V1/2) or groups/users (V3) are configured for read-only and read-write access.\n\nIf unique community strings or accounts are not used for SNMP peers, this is a finding.",
"description": "Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking experts. If a hacker gains access to these devices and can easily guess the name, this could result in denial of service, interception of sensitive information, or other destructive actions.",
"fixid": "F-3068r4_fix",
"fixtext": "Configure the SNMP community strings on the network device and change them from the default values. SNMP community strings and user passwords must be unique and not match any other network device passwords. Different community strings (V1/2) or groups (V3) must be configured for various levels of read and write access.",
"iacontrols": null,
"id": "V-3043",
"ruleID": "SV-3043r4_rule",
"severity": "medium",
"title": "The network device must use different SNMP community names or groups for various levels of read and write access.",
"version": "NET1675"
},
"V-3056": {
"checkid": "C-3503r11_chk",
"checktext": "Review the network device configuration and validate there are no group accounts configured for access.\n\nIf a group account is configured on the device, this is a finding.",
"description": "Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network.",
"fixid": "F-3081r9_fix",
"fixtext": "Configure individual user accounts for each authorized person then remove any group accounts.",
"iacontrols": null,
"id": "V-3056",
"ruleID": "SV-3056r7_rule",
"severity": "high",
"title": "Group accounts must not be configured for use on the network device.",
"version": "NET0460"
},
"V-3057": {
"checkid": "C-3504r8_chk",
"checktext": "Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the least privilege level unless deemed necessary for assigned duties.\n\nIf it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding.",
"description": "By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personnel are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.",
"fixid": "F-3082r5_fix",
"fixtext": "Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.",
"iacontrols": null,
"id": "V-3057",
"ruleID": "SV-3057r6_rule",
"severity": "medium",
"title": "Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.",
"version": "NET0465"
},
"V-3058": {
"checkid": "C-3505r5_chk",
"checktext": "Review the organization's responsibilities list and reconcile the list of authorized accounts with those accounts defined for access to the network device.\n\nIf an unauthorized account is configured for access to the device, this is a finding.",
"description": "A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service, interception of sensitive information, or other destructive actions could potentially take place if an unauthorized account is configured to access the network device.",
"fixid": "F-3083r5_fix",
"fixtext": "Remove any account configured for access to the network device that is not defined in the organization's responsibilities list.",
"iacontrols": null,
"id": "V-3058",
"ruleID": "SV-3058r5_rule",
"severity": "medium",
"title": "Unauthorized accounts must not be configured for access to the network device.",
"version": "NET0470"
},
"V-3069": {
"checkid": "C-3532r8_chk",
"checktext": "Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols. \n\n-SSHv2\n-SCP\n-HTTPS using TLS\n\nIf management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.",
"description": "Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.",
"fixid": "F-3094r5_fix",
"fixtext": "Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.",
"iacontrols": null,
"id": "V-3069",
"ruleID": "SV-3069r5_rule",
"severity": "medium",
"title": "Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.",
"version": "NET1638"
},
"V-3070": {
"checkid": "C-3542r6_chk",
"checktext": "Review the configuration to verify all attempts to access the device via management connection are logged.\n\nIf management connection attempts are not logged, this is a finding.",
"description": "Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.",
"fixid": "F-3095r3_fix",
"fixtext": "Configure the device to log all access attempts to the device to establish a management connection for administrative access.",
"iacontrols": null,
"id": "V-3070",
"ruleID": "SV-3070r4_rule",
"severity": "low",
"title": "Network devices must log all attempts to establish a management connection for administrative access.",
"version": "NET1640"
},
"V-3143": {
"checkid": "C-40236r3_chk",
"checktext": "Review the network devices configuration to determine if the vendor default password is active.\n\nIf any vendor default passwords are used on the device, this is a finding.",
"description": "Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not removing them prior to deploying the network devices into production provides an opportunity for a malicious user to gain unauthorized access to the device.",
"fixid": "F-35391r3_fix",
"fixtext": "Remove any vendor default passwords from the network devices configuration.",
"iacontrols": null,
"id": "V-3143",
"ruleID": "SV-3143r4_rule",
"severity": "high",
"title": "Network devices must not have any default manufacturer passwords.",
"version": "NET0240"
},
"V-3160": {
"checkid": "C-3549r4_chk",
"checktext": "Have the administrator display the OS version in operation. The OS must be current with related IAVMs addressed.\n\nIf the device is using an OS that does not meet all IAVMs or currently not supported by the vendor, this is a finding.",
"description": "Network devices not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches, as well as enhancements to IP security. Viruses, denial of service attacks, system weaknesses, back doors and other potentially harmful situations could render a system vulnerable, allowing unauthorized access to DoD assets.",
"fixid": "F-3185r4_fix",
"fixtext": "Update operating system to a supported version that addresses all related IAVMs.",
"iacontrols": null,
"id": "V-3160",
"ruleID": "SV-3160r4_rule",
"severity": "medium",
"title": "Network devices must be running a current and supported operating system with all IAVMs addressed.",
"version": "NET0700"
},
"V-3175": {
"checkid": "C-3516r9_chk",
"checktext": "Review the network device configuration to verify all management connections for administrative access require authentication.\n\nIf authentication isn't configured for management access, this is a finding.",
"description": "Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.",
"fixid": "F-3200r3_fix",
"fixtext": "Configure authentication for all management connections.",
"iacontrols": null,
"id": "V-3175",
"ruleID": "SV-3175r5_rule",
"severity": "high",
"title": "The network device must require authentication prior to establishing a management connection for administrative access.",
"version": "NET1636"
},
"V-3196": {
"checkid": "C-3820r6_chk",
"checktext": "Review the device configuration to verify it is configured to use SNMPv3 with both SHA authentication and privacy using AES encryption.\n\nDowngrades:\nIf the site is using Version 1 or Version 2 with all of the appropriate patches and has developed a migration plan to implement the Version 3 Security Model, this finding can be downgraded to a Category II.\n\nIf the targeted asset is running SNMPv3 and does not support SHA or AES, but the device is configured to use MD5 authentication and DES or 3DES encryption, then the finding can be downgraded to a Category III.\n\nIf the site is using Version 1 or Version 2 and has installed all of the appropriate patches or upgrades to mitigate any known security vulnerabilities, this finding can be downgraded to a Category II. In addition, if the device does not support SNMPv3, this finding can be downgraded to a Category III provided all of the appropriate patches to mitigate any known security vulnerabilities have been applied and has developed a migration plan that includes the device upgrade to support Version 3 and the implementation of the Version 3 Security Model.\n\nIf the device is configured to use to anything other than SNMPv3 with at least SHA-1 and AES, this is a finding. Downgrades can be determined based on the criteria above.",
"description": "SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network.",
"fixid": "F-3221r5_fix",
"fixtext": "If SNMP is enabled, configure the network device to use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography (i.e., SHA authentication and AES encryption).",
"iacontrols": null,
"id": "V-3196",
"ruleID": "SV-3196r4_rule",
"severity": "high",
"title": "The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.",
"version": "NET1660"
},
"V-3210": {
"checkid": "C-3822r7_chk",
"checktext": "Review the network devices configuration and verify if either of the SNMP community strings \"public\" or \"private\" is being used.\n\nIf default or well-known community strings are used for SNMP, this is a finding.",
"description": "Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device using the read community string \"public\". In addition, an attacker can change a system configuration using the write community string \"private\".",
"fixid": "F-3235r4_fix",
"fixtext": "Configure unique SNMP community strings replacing the default community strings.",
"iacontrols": null,
"id": "V-3210",
"ruleID": "SV-3210r4_rule",
"severity": "high",
"title": "The network device must not use the default or well-known SNMP community strings public and private.",
"version": "NET1665"
},
"V-3692": {
"checkid": "C-16042r4_chk",
"checktext": "Note: If the equipment is WPA2/WPA3 certified, then it is capable of supporting this requirement.\n\nReview the WLAN equipment configuration to check EAP-TLS is actively used and no other methods are enabled.\n\nIf EAP-TLS is not used or if the WLAN system allows users to connect with other methods, this is a finding.",
"description": "EAP-TLS provides strong cryptographic mutual authentication and key distribution services not found in other EAP methods, and thus provides significantly more protection against attacks than other methods. Additionally, EAP-TLS supports two-factor user authentication on the WLAN client, which provides significantly more protection than methods that rely on a password or certificate alone. EAP-TLS also can leverage DoD CAC in its authentication services, providing additional security and convenience.",
"fixid": "F-34114r1_fix",
"fixtext": "Change the WLAN configuration so it supports EAP-TLS, implementing supporting PKI and AAA infrastructure as necessary. If the WLAN equipment is not capable of supporting EAP-TLS, procure new equipment capable of such support.",
"iacontrols": null,
"id": "V-3692",
"ruleID": "SV-3692r3_rule",
"severity": "medium",
"title": "WLAN must use EAP-TLS.",
"version": "WIR0115-01"
},
"V-3966": {
"checkid": "C-3502r7_chk",
"checktext": "Review the network device configuration to determine if an authentication server is defined for gaining administrative access. If so, there must be only one account of last resort configured locally for an emergency.\n\nVerify the username and password for the local account of last resort is contained within a sealed envelope kept in a safe.\n\nIf an authentication server is used and more than one local account exists, this is a finding.",
"description": "Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between the device and the authentication server is not operable. The console or local account of last resort logon credentials must be stored in a sealed envelope and kept in a safe.",
"fixid": "F-3899r9_fix",
"fixtext": "Configure the device to only allow one local account of last resort for emergency access and store the credentials in a secure manner.",
"iacontrols": null,
"id": "V-3966",
"ruleID": "SV-3966r6_rule",
"severity": "medium",
"title": "In the event the authentication server is unavailable, the network device must have a single local account of last resort defined.",
"version": "NET0440"
},
"V-3967": {
"checkid": "C-3511r5_chk",
"checktext": "Review the configuration and verify a session using the console port will time out after 10 minutes or less of inactivity.\n\nIf console access is not configured to timeout at 10 minutes or less, this is a finding.",
"description": "Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network device. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.",
"fixid": "F-3900r4_fix",
"fixtext": "Configure the timeout for idle console connection to 10 minutes or less.",
"iacontrols": null,
"id": "V-3967",
"ruleID": "SV-3967r4_rule",
"severity": "medium",
"title": "The network devices must time out access to the console port at 10 minutes or less of inactivity.",
"version": "NET1624"
},
"V-3969": {
"checkid": "C-3942r10_chk",
"checktext": "Review the network device configuration and verify SNMP community strings are read-only when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3. \n\nIf write-access is used for SNMP versions 1, 2c, or 3-noAuthNoPriv mode and there is no documented approval by the ISSO, this is a finding.",
"description": "Enabling write access to the device via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.",
"fixid": "F-3902r7_fix",
"fixtext": "Configure the network device to allow for read-only SNMP access when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3.",
"iacontrols": null,
"id": "V-3969",
"ruleID": "SV-3969r5_rule",
"severity": "medium",
"title": "Network devices must only allow SNMP read-only access.",
"version": "NET0894"
},
"V-4582": {
"checkid": "C-3510r6_chk",
"checktext": "Review the network device's configuration and verify authentication is required for console access.\n\nIf authentication is not configured for console access, this is a finding.",
"description": "Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.",
"fixid": "F-4515r4_fix",
"fixtext": "Configure authentication for console access on the network device.",
"iacontrols": null,
"id": "V-4582",
"ruleID": "SV-4582r5_rule",
"severity": "high",
"title": "The network device must require authentication for console access.",
"version": "NET1623"
},
"V-5611": {
"checkid": "C-3527r6_chk",
"checktext": "Review the configuration and verify management access to the device is allowed only from hosts within the management network.\n\nIf management access can be gained from outside of the authorized management network, this is a finding.",
"description": "Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.",
"fixid": "F-5522r4_fix",
"fixtext": "Configure an ACL or filter to restrict management access to the device from only the management network.",
"iacontrols": null,
"id": "V-5611",
"ruleID": "SV-5611r5_rule",
"severity": "medium",
"title": "The network devices must only allow management connections for administrative access from hosts residing in the management network.",
"version": "NET1637"
},
"V-5612": {
"checkid": "C-3534r6_chk",
"checktext": "Review the configuration and verify the timeout is set for 60 seconds or less. The SSH service terminates the connection if protocol negotiation (that includes user authentication) is not complete within this timeout period.\n\nIf the device is not configured to drop broken SSH sessions after 60 seconds, this is a finding.",
"description": "An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for the malicious user attempting to make a connection to the network device.",
"fixid": "F-5523r5_fix",
"fixtext": "Configure the network devices so it will require a secure shell timeout of 60 seconds or less.",
"iacontrols": null,
"id": "V-5612",
"ruleID": "SV-5612r4_rule",
"severity": "medium",
"title": "The network devices must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.",
"version": "NET1645"
},
"V-5613": {
"checkid": "C-3538r8_chk",
"checktext": "Review the configuration and verify the number of unsuccessful SSH logon attempts is set at 3.\n\nIf the device is not configured to reset unsuccessful SSH logon attempts at 3, this is a finding.",
"description": "An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.",
"fixid": "F-5524r9_fix",
"fixtext": "Configure the network device to require a maximum number of unsuccessful SSH logon attempts at 3.",
"iacontrols": null,
"id": "V-5613",
"ruleID": "SV-5613r4_rule",
"severity": "medium",
"title": "The network device must be configured for a maximum number of unsuccessful SSH logon attempts set at 3 before resetting the interface.",
"version": "NET1646"
},
"V-7011": {
"checkid": "C-3513r5_chk",
"checktext": "Review the configuration and verify the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected.\n\nIf the auxiliary port is enabled without the use of a secured modem, this is a finding.",
"description": "The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network.\n\nSecured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.",
"fixid": "F-6614r3_fix",
"fixtext": "Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.",
"iacontrols": null,
"id": "V-7011",
"ruleID": "SV-7365r4_rule",
"severity": "low",
"title": "The auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.",
"version": "NET1629"
},
"V-92237": {
"checkid": "C-91401r1_chk",
"checktext": "Review the WLAN equipment specification and verify it is FIPS 140-2 (CMVP) certified for data in transit, including authentication credentials.\n\nIf the WLAN equipment is not is FIPS 140-2 (CMVP) certified, this is a finding.\n",
"description": "If the DoD WLAN components (WLAN AP, controller, or client) are not NIST FIPS 140-2 (Cryptographic Module Validation Program \u2013 CMVP) certified, the WLAN system may not adequately protect sensitive unclassified DoD data from compromise during transmission.",
"fixid": "F-98445r1_fix",
"fixtext": "Use WLAN equipment that is FIPS 140-2 (CMVP) certified.",
"iacontrols": null,
"id": "V-92237",
"ruleID": "SV-102339r1_rule",
"severity": "medium",
"title": "WLAN components must be FIPS 140-2 certified.",
"version": "WIR0115-3"
},
"V-92239": {
"checkid": "C-91405r2_chk",
"checktext": "Review the WLAN equipment specification and verify it is Wi-Fi Alliance certified with either the older WPA2 certification or the newer WPA3 certification. WPA3 is preferred but not required at this time.\n\nIf the WLAN equipment is not Wi-Fi Alliance certified with WPA2 or WPA3, this is a finding.\n",
"description": null,
"fixid": "F-98447r1_fix",
"fixtext": "Use WLAN equipment that is Wi-Fi Alliance certified with WPA2 or WPA3.",
"iacontrols": null,
"id": "V-92239",
"ruleID": "SV-102341r1_rule",
"severity": "medium",
"title": "WLAN components must be Wi-Fi Alliance certified with WPA2 or WPA3.",
"version": "WIR0114-1"
},
"V-97417": {
"checkid": "C-96253r1_chk",
"checktext": "Detailed Policy Requirements:\nDoD components will ensure that a Wireless Intrusion Detection System (WIDS) is implemented that allows for monitoring of WLAN activity and the detection of WLAN-related policy violations on all unclassified and classified DoD wired and wireless LANs. The WIDS must be implemented regardless of whether or not an authorized WLAN has been deployed.\nThe WIDS shall be capable of monitoring IEEE 802.11 transmissions within all DoD LAN environments and detect nearby unauthorized WLAN devices. The WIDS is not be required to monitor non-IEEE 802.11 transmissions.\nWIDS Implementation Criteria. The WIDS shall continuously scan for and detect authorized and unauthorized WLAN activities 24 hours a day, 7 days a week.\n\nNote: Exceptions to WIDS implementation criteria may be made by the AO for DoD wired and wireless LAN operating environments. This exception allows the AO to implement periodic scanning conducted by designated personnel using handheld scanners during walk-through assessments. Periodic scanning may be conducted as the alternative to the continuous scanning only in special circumstances, where it has been determined on a case-by-case basis that continuous scanning is either infeasible or unwarranted. The AO exception must be documented.\n\nThe \"infeasible\" criteria includes the following use case examples:\n- It's not my building - this scenario means that for contractual, or other similar reasons, the DoD component is not allowed to install a WIDS.\n- There's no power or space is limited - this scenarios means that for space weight and power (SWAP) reasons, the addition of continuous scanning capabilities cannot be accomplished because it would exceeds SWAP availability. Another reason power would affect your decision to waive continuous scanning requirements is if the entire LAN is only in operation periodically (e.g. the wired/wireless LAN is enabled on a vehicle that is only operating when the vehicle is being used for a specific operation).\n- The exception for \"Minimal Impact WLAN Systems\" that: Do not provide connectivity to WLAN-enabled PEDs (e.g., backhaul systems); have no available FIPS 140 validated 802.1X EAP-TLS supplicant; support a very small number of users for a specific mission (e.g., 10 or less users); are standalone networks; or are highly specialized WLAN systems that are isolated from the DoDIN (e.g., handheld personal digital assistants [PDAs] used as radio-frequency identification [RFID] readers, a network of WLAN-enabled Voice over Internet Protocol [VoIP] phones) allows the AO to waive any of the security requirements in the Instruction. This includes using non-standard/proprietary FIPS validated encryption, using an alternative FIPS validated EAP type, and not having a continuous WIDS.\n-The cost of the continuous WIDS capability is more expensive that the total cost of the LAN without a WIDS.\n\nThe AO must conduct a wireless threat risk assessment where it has been shown by analysis that the threat environment is extremely unlikely to non-existent to meet the \"unwarranted\" exception criteria.\n\nCheck Procedures:\nInterview the site ISSO. Determine if the scanning by a WIDS is being conducted and if it is continuous or periodic.\nIf a continuous scanning WIDS is used, there is no finding. \nIf periodic scanning is used, verify the exception to policy is documented and signed by the AO. Verify the exception meets one of the required criteria.\nIf periodic scanning is being performed but requirements have not been met, this is a finding.\nIf no WIDS scanning is being performed at the site, this is a finding.\n",
"description": "DoD networks are at risk and DoD data could be compromised if wireless scanning is not conducted to identify unauthorized WLAN clients and access points connected to or attempting to connect to the network.",
"fixid": "F-103097r1_fix",
"fixtext": "Perform required WIDS scanning.",
"iacontrols": null,
"id": "V-97417",
"ruleID": "SV-106521r1_rule",
"severity": "medium",
"title": "The site must conduct continuous wireless Intrusion Detection System (IDS) scanning.",
"version": "NET-WIDS-010"
}
},
"profiles": {
"MAC-1_Classified": {
"description": "",
"findings": {
"V-14671": "true",
"V-14717": "true",
"V-14846": "true",
"V-14886": "true",
"V-14888": "true",
"V-14889": "true",
"V-15432": "true",
"V-15434": "true",
"V-17821": "true",
"V-17822": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-30257": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3692": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-7011": "true",
"V-92237": "true",
"V-92239": "true",
"V-97417": "true"
},
"id": "MAC-1_Classified",
"title": "I - Mission Critical Classified"
},
"MAC-1_Public": {
"description": "",
"findings": {
"V-14671": "true",
"V-14717": "true",
"V-14846": "true",
"V-14886": "true",
"V-14888": "true",
"V-14889": "true",
"V-15432": "true",
"V-15434": "true",
"V-17821": "true",
"V-17822": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-30257": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3692": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-7011": "true",
"V-92237": "true",
"V-92239": "true",
"V-97417": "true"
},
"id": "MAC-1_Public",
"title": "I - Mission Critical Public"
},
"MAC-1_Sensitive": {
"description": "",
"findings": {
"V-14671": "true",
"V-14717": "true",
"V-14846": "true",
"V-14886": "true",
"V-14888": "true",
"V-14889": "true",
"V-15432": "true",
"V-15434": "true",
"V-17821": "true",
"V-17822": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-30257": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3692": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-7011": "true",
"V-92237": "true",
"V-92239": "true",
"V-97417": "true"
},
"id": "MAC-1_Sensitive",
"title": "I - Mission Critical Sensitive"
},
"MAC-2_Classified": {
"description": "",
"findings": {
"V-14671": "true",
"V-14717": "true",
"V-14846": "true",
"V-14886": "true",
"V-14888": "true",
"V-14889": "true",
"V-15432": "true",
"V-15434": "true",
"V-17821": "true",
"V-17822": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-30257": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3692": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-7011": "true",
"V-92237": "true",
"V-92239": "true",
"V-97417": "true"
},
"id": "MAC-2_Classified",
"title": "II - Mission Support Classified"
},
"MAC-2_Public": {
"description": "",
"findings": {
"V-14671": "true",
"V-14717": "true",
"V-14846": "true",
"V-14886": "true",
"V-14888": "true",
"V-14889": "true",
"V-15432": "true",
"V-15434": "true",
"V-17821": "true",
"V-17822": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-30257": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3692": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-7011": "true",
"V-92237": "true",
"V-92239": "true",
"V-97417": "true"
},
"id": "MAC-2_Public",
"title": "II - Mission Support Public"
},
"MAC-2_Sensitive": {
"description": "",
"findings": {
"V-14671": "true",
"V-14717": "true",
"V-14846": "true",
"V-14886": "true",
"V-14888": "true",
"V-14889": "true",
"V-15432": "true",
"V-15434": "true",
"V-17821": "true",
"V-17822": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-30257": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3692": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-7011": "true",
"V-92237": "true",
"V-92239": "true",
"V-97417": "true"
},
"id": "MAC-2_Sensitive",
"title": "II - Mission Support Sensitive"
},
"MAC-3_Classified": {
"description": "",
"findings": {
"V-14671": "true",
"V-14717": "true",
"V-14846": "true",
"V-14886": "true",
"V-14888": "true",
"V-14889": "true",
"V-15432": "true",
"V-15434": "true",
"V-17821": "true",
"V-17822": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-30257": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3692": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-7011": "true",
"V-92237": "true",
"V-92239": "true",
"V-97417": "true"
},
"id": "MAC-3_Classified",
"title": "III - Administrative Classified"
},
"MAC-3_Public": {
"description": "",
"findings": {
"V-14671": "true",
"V-14717": "true",
"V-14846": "true",
"V-14886": "true",
"V-14888": "true",
"V-14889": "true",
"V-15432": "true",
"V-15434": "true",
"V-17821": "true",
"V-17822": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-30257": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3692": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-7011": "true",
"V-92237": "true",
"V-92239": "true",
"V-97417": "true"
},
"id": "MAC-3_Public",
"title": "III - Administrative Public"
},
"MAC-3_Sensitive": {
"description": "",
"findings": {
"V-14671": "true",
"V-14717": "true",
"V-14846": "true",
"V-14886": "true",
"V-14888": "true",
"V-14889": "true",
"V-15432": "true",
"V-15434": "true",
"V-17821": "true",
"V-17822": "true",
"V-23747": "true",
"V-28784": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-30257": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-3058": "true",
"V-3069": "true",
"V-3070": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3692": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-7011": "true",
"V-92237": "true",
"V-92239": "true",
"V-97417": "true"
},
"id": "MAC-3_Sensitive",
"title": "III - Administrative Sensitive"
}
},
"slug": "wlan_access_point_enclave-niprnet_connected",
"title": "WLAN Access Point (Enclave-NIPRNet Connected) Security Technical Implementation Guide (STIG)",
"version": "6"
}
}