kriterion 0.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.gitignore +2 -0
- data/.ruby-version +1 -0
- data/.travis.yml +5 -0
- data/Dockerfile +18 -0
- data/Gemfile +12 -0
- data/Gemfile.lock +62 -0
- data/LICENSE.txt +21 -0
- data/README.md +58 -0
- data/Rakefile +6 -0
- data/bin/setup +8 -0
- data/bin/update_stigs.rb +42 -0
- data/criterion.gemspec +31 -0
- data/docker-compose.yml +14 -0
- data/exe/kriterion +16 -0
- data/lib/kriterion.rb +16 -0
- data/lib/kriterion/api.rb +27 -0
- data/lib/kriterion/backend.rb +13 -0
- data/lib/kriterion/backend/mongodb.rb +235 -0
- data/lib/kriterion/cli.rb +28 -0
- data/lib/kriterion/cli/api.rb +35 -0
- data/lib/kriterion/cli/worker.rb +35 -0
- data/lib/kriterion/event.rb +36 -0
- data/lib/kriterion/item.rb +42 -0
- data/lib/kriterion/logs.rb +14 -0
- data/lib/kriterion/metrics.rb +22 -0
- data/lib/kriterion/object.rb +50 -0
- data/lib/kriterion/report.rb +69 -0
- data/lib/kriterion/resource.rb +60 -0
- data/lib/kriterion/section.rb +32 -0
- data/lib/kriterion/standard.rb +65 -0
- data/lib/kriterion/version.rb +3 -0
- data/lib/kriterion/worker.rb +280 -0
- data/standards/cis_red_hat_enterprise_linux_7.json +34 -0
- data/standards/stig_a10_networks_adc_alg.json +209 -0
- data/standards/stig_a10_networks_adc_ndm.json +233 -0
- data/standards/stig_active_directory_domain.json +257 -0
- data/standards/stig_active_directory_forest.json +41 -0
- data/standards/stig_active_directory_service_2003.json +173 -0
- data/standards/stig_active_directory_service_2008.json +167 -0
- data/standards/stig_adobe_acrobat_pro_xi.json +167 -0
- data/standards/stig_adobe_acrobat_reader_dc_classic_track.json +179 -0
- data/standards/stig_adobe_acrobat_reader_dc_continuous_track.json +179 -0
- data/standards/stig_adobe_coldfusion_11.json +611 -0
- data/standards/stig_airwatch_mdm.json +185 -0
- data/standards/stig_aix_5.3.json +3095 -0
- data/standards/stig_aix_6.1.json +3047 -0
- data/standards/stig_akamai_ksd_service_impact_level_2_alg.json +209 -0
- data/standards/stig_akamai_ksd_service_impact_level_2_ndm.json +155 -0
- data/standards/stig_android_2.2_dell.json +311 -0
- data/standards/stig_apache_2.2_serverwindows.json +347 -0
- data/standards/stig_apache_2.2_sitewindows_security_implementation_guide.json +179 -0
- data/standards/stig_apache_server_2.0unix.json +341 -0
- data/standards/stig_apache_server_2.0windows.json +341 -0
- data/standards/stig_apache_server_2.2unix.json +347 -0
- data/standards/stig_apache_server_2.2windows.json +347 -0
- data/standards/stig_apache_site_2.0unix.json +185 -0
- data/standards/stig_apache_site_2.0windows.json +179 -0
- data/standards/stig_apache_site_2.2unix.json +185 -0
- data/standards/stig_apache_site_2.2windows.json +179 -0
- data/standards/stig_apple_ios6.json +341 -0
- data/standards/stig_apple_ios_10.json +245 -0
- data/standards/stig_apple_ios_11.json +269 -0
- data/standards/stig_apple_ios_4_good_mobility_suite_interim_security_configuration_guide_iscg.json +257 -0
- data/standards/stig_apple_ios_5.json +329 -0
- data/standards/stig_apple_ios_6.json +335 -0
- data/standards/stig_apple_ios_6_interim_security_configuration_guide_iscg.json +371 -0
- data/standards/stig_apple_ios_7.json +185 -0
- data/standards/stig_apple_ios_8_interim_security_configuration_guide.json +251 -0
- data/standards/stig_apple_ios_9_interim_security_configuration_guide.json +245 -0
- data/standards/stig_apple_os_x_10.10_yosemite_workstation.json +851 -0
- data/standards/stig_apple_os_x_10.11.json +725 -0
- data/standards/stig_apple_os_x_10.12.json +737 -0
- data/standards/stig_apple_os_x_10.8_mountain_lion_workstation.json +1241 -0
- data/standards/stig_apple_os_x_10.9_mavericks_workstation.json +809 -0
- data/standards/stig_application_layer_gateway_alg_security_requirements_guide_srg.json +911 -0
- data/standards/stig_application_layer_gateway_security_requirements_guide.json +911 -0
- data/standards/stig_application_security_and_development.json +1745 -0
- data/standards/stig_application_security_and_development_checklist.json +959 -0
- data/standards/stig_application_security_requirements_guide.json +1961 -0
- data/standards/stig_application_server_security_requirements_guide.json +791 -0
- data/standards/stig_arcgisserver_10.3.json +143 -0
- data/standards/stig_arista_mls_dcs-7000_series_l2s.json +53 -0
- data/standards/stig_arista_mls_dcs-7000_series_ndm.json +197 -0
- data/standards/stig_arista_mls_dcs-7000_series_rtr.json +143 -0
- data/standards/stig_bind_9.x.json +431 -0
- data/standards/stig_bind_dns.json +317 -0
- data/standards/stig_blackberry_10.2.x_os.json +179 -0
- data/standards/stig_blackberry_10_os.json +227 -0
- data/standards/stig_blackberry_bes_12.3.x_mdm.json +65 -0
- data/standards/stig_blackberry_bes_12.5.x_mdm.json +65 -0
- data/standards/stig_blackberry_device_service_6.2.json +425 -0
- data/standards/stig_blackberry_enterprise_mobility_server_2.x.json +149 -0
- data/standards/stig_blackberry_enterprise_server,_part_1.json +35 -0
- data/standards/stig_blackberry_enterprise_server,_part_2.json +155 -0
- data/standards/stig_blackberry_enterprise_server,_part_3.json +647 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_1.json +35 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_2.json +155 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_3.json +653 -0
- data/standards/stig_blackberry_enterprise_service_v10.1.x_blackberry_device_service.json +317 -0
- data/standards/stig_blackberry_enterprise_service_v10.2.x_blackberry_device_service.json +263 -0
- data/standards/stig_blackberry_handheld_device.json +125 -0
- data/standards/stig_blackberry_os_10.3.x.json +257 -0
- data/standards/stig_blackberry_os_7.x.json +107 -0
- data/standards/stig_blackberry_os_7.x.x.json +101 -0
- data/standards/stig_blackberry_os_version_5-7.json +107 -0
- data/standards/stig_blackberry_playbook.json +65 -0
- data/standards/stig_blackberry_playbook_os_nea_mode.json +65 -0
- data/standards/stig_blackberry_playbook_os_v2.1.json +197 -0
- data/standards/stig_blackberry_uem_12.7.json +59 -0
- data/standards/stig_bluetoothzigbee.json +35 -0
- data/standards/stig_ca_api_gateway_alg.json +497 -0
- data/standards/stig_cisco_css_dns.json +71 -0
- data/standards/stig_cisco_ios_xe_release_3_ndm.json +395 -0
- data/standards/stig_cisco_ios_xe_release_3_rtr.json +149 -0
- data/standards/stig_cmd_management_server_policy.json +53 -0
- data/standards/stig_commercial_mobile_device_cmd_policy.json +83 -0
- data/standards/stig_csfc_campus_wlan_policy_security_implementation_guide.json +95 -0
- data/standards/stig_database_security_requirements_guide.json +767 -0
- data/standards/stig_dbn-6300_idps.json +107 -0
- data/standards/stig_dbn-6300_ndm.json +359 -0
- data/standards/stig_defense_switched_network.json +683 -0
- data/standards/stig_defense_switched_network_dsn.json +653 -0
- data/standards/stig_desktop_applications_general.json +41 -0
- data/standards/stig_dns_policy.json +155 -0
- data/standards/stig_domain_name_system_dns_security_requirements_guide.json +599 -0
- data/standards/stig_draft_aix.json +3503 -0
- data/standards/stig_edb_postgres_advanced_server.json +665 -0
- data/standards/stig_email_services_policy.json +137 -0
- data/standards/stig_exchange_2010_client_access_server.json +179 -0
- data/standards/stig_exchange_2010_edge_transport_server.json +389 -0
- data/standards/stig_exchange_2010_hub_transport_server.json +269 -0
- data/standards/stig_exchange_2010_mailbox_server.json +209 -0
- data/standards/stig_f5_big-ip_access_policy_manager_11.x.json +149 -0
- data/standards/stig_f5_big-ip_advanced_firewall_manager_11.x.json +41 -0
- data/standards/stig_f5_big-ip_application_security_manager_11.x.json +89 -0
- data/standards/stig_f5_big-ip_device_management_11.x.json +467 -0
- data/standards/stig_f5_big-ip_local_traffic_manager_11.x.json +407 -0
- data/standards/stig_final_draft_general_wireless_policy.json +71 -0
- data/standards/stig_firewall.json +449 -0
- data/standards/stig_firewall_-_cisco.json +449 -0
- data/standards/stig_firewall_security_requirements_guide.json +257 -0
- data/standards/stig_forescout_counteract_alg.json +83 -0
- data/standards/stig_forescout_counteract_ndm.json +239 -0
- data/standards/stig_free_space_optics_device.json +143 -0
- data/standards/stig_general_mobile_device_policy_non-enterprise_activated.json +113 -0
- data/standards/stig_general_mobile_device_technical_non-enterprise_activated.json +59 -0
- data/standards/stig_general_purpose_operating_system_srg.json +1199 -0
- data/standards/stig_general_wireless_policy.json +71 -0
- data/standards/stig_good_mobility_suite_server_android_os.json +203 -0
- data/standards/stig_good_mobility_suite_server_apple_ios_4_interim_security_configuration_guide_iscg.json +209 -0
- data/standards/stig_good_mobility_suite_server_windows_phone_6.5.json +449 -0
- data/standards/stig_goodenterprise_8.x.json +401 -0
- data/standards/stig_google_chrome_browser.json +209 -0
- data/standards/stig_google_chrome_current_windows.json +215 -0
- data/standards/stig_google_chrome_draft.json +281 -0
- data/standards/stig_google_chrome_v23_windows.json +275 -0
- data/standards/stig_google_chrome_v24_windows.json +263 -0
- data/standards/stig_google_chrome_v24_windows_benchmark.json +227 -0
- data/standards/stig_google_search_appliance.json +209 -0
- data/standards/stig_harris_secnet_11_54.json +89 -0
- data/standards/stig_hp-ux_11.23.json +3215 -0
- data/standards/stig_hp-ux_11.31.json +3155 -0
- data/standards/stig_hp-ux_smse.json +431 -0
- data/standards/stig_hpe_3par_storeserv_3.2.x.json +131 -0
- data/standards/stig_ibm_datapower_alg.json +401 -0
- data/standards/stig_ibm_datapower_network_device_management.json +395 -0
- data/standards/stig_ibm_db2_v10.5_luw.json +575 -0
- data/standards/stig_ibm_hardware_management_console_hmc.json +221 -0
- data/standards/stig_ibm_hardware_management_console_hmc_policies.json +35 -0
- data/standards/stig_ibm_maas360_v2.3.x_mdm.json +59 -0
- data/standards/stig_ibm_zvm_using_ca_vm:secure.json +473 -0
- data/standards/stig_idps_security_requirements_guide_srg.json +1865 -0
- data/standards/stig_idsips.json +257 -0
- data/standards/stig_iis6_server.json +221 -0
- data/standards/stig_iis6_site.json +263 -0
- data/standards/stig_iis_7.0_web_server.json +155 -0
- data/standards/stig_iis_7.0_web_site.json +299 -0
- data/standards/stig_iis_8.5_server.json +293 -0
- data/standards/stig_iis_8.5_site.json +347 -0
- data/standards/stig_infoblox_7.x_dns.json +419 -0
- data/standards/stig_infrastructure_l3_switch.json +599 -0
- data/standards/stig_infrastructure_l3_switch_-_cisco.json +659 -0
- data/standards/stig_infrastructure_l3_switch_secure_technical_implementation_guide_-_cisco.json +659 -0
- data/standards/stig_infrastructure_router.json +479 -0
- data/standards/stig_infrastructure_router_-_cisco.json +539 -0
- data/standards/stig_infrastructure_router_-_juniper.json +485 -0
- data/standards/stig_infrastructure_router__cisco.json +539 -0
- data/standards/stig_infrastructure_router__juniper.json +485 -0
- data/standards/stig_internet_explorer_8.json +821 -0
- data/standards/stig_internet_explorer_9.json +815 -0
- data/standards/stig_intrusion_detection_and_prevention_systems_idps_security_requirements_guide.json +371 -0
- data/standards/stig_ipsec_vpn_gateway.json +521 -0
- data/standards/stig_java_runtime_environment_jre_6_unix.json +65 -0
- data/standards/stig_java_runtime_environment_jre_6_win7.json +65 -0
- data/standards/stig_java_runtime_environment_jre_6_windows_xp.json +77 -0
- data/standards/stig_java_runtime_environment_jre_6_winxp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_unix.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_win7.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_winxp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_version_6_unix.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_6_windows_7.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_6_windows_xp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_version_7_unix.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_7_windows_7.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_7_winxp.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_8_unix.json +107 -0
- data/standards/stig_java_runtime_environment_jre_version_8_windows.json +107 -0
- data/standards/stig_jboss_eap_6.3.json +413 -0
- data/standards/stig_juniper_srx_sg_alg.json +155 -0
- data/standards/stig_juniper_srx_sg_idps.json +179 -0
- data/standards/stig_juniper_srx_sg_ndm.json +443 -0
- data/standards/stig_juniper_srx_sg_vpn.json +185 -0
- data/standards/stig_keyboard_video_and_mouse_switch.json +269 -0
- data/standards/stig_l3_kov-26_talon_wireless_role.json +77 -0
- data/standards/stig_layer_2_switch.json +347 -0
- data/standards/stig_layer_2_switch_-_cisco.json +365 -0
- data/standards/stig_lg_android_5.x_interim_security_configuration_guide.json +245 -0
- data/standards/stig_lg_android_6.x.json +281 -0
- data/standards/stig_mac_osx_10.6_workstation.json +1319 -0
- data/standards/stig_mac_osx_10.6_workstation_draft.json +1319 -0
- data/standards/stig_mainframe_product_security_requirements_guide.json +1115 -0
- data/standards/stig_mcafee_application_control_7.x.json +203 -0
- data/standards/stig_mcafee_move_2.63.6.1_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_2.63.6.1_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_2.6_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_2.6_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_3.6.1_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_3.6.1_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_agentless_3.03.6.1_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_agentless_3.0_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_agentless_3.0_vsel_1.9sva.json +203 -0
- data/standards/stig_mcafee_move_agentless_3.6.1_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_av_agentless_4.5.json +155 -0
- data/standards/stig_mcafee_move_av_multi-platform_4.5.json +215 -0
- data/standards/stig_mcafee_virusscan_8.8_local_client.json +533 -0
- data/standards/stig_mcafee_virusscan_8.8_managed_client.json +533 -0
- data/standards/stig_mcafee_vsel_1.92.0_local_client.json +245 -0
- data/standards/stig_mcafee_vsel_1.92.0_managed_client.json +239 -0
- data/standards/stig_mdm_server_policy.json +47 -0
- data/standards/stig_microsoft_access_2003.json +47 -0
- data/standards/stig_microsoft_access_2007.json +77 -0
- data/standards/stig_microsoft_access_2010.json +119 -0
- data/standards/stig_microsoft_access_2013.json +113 -0
- data/standards/stig_microsoft_access_2016.json +107 -0
- data/standards/stig_microsoft_dot_net_framework_4.0.json +101 -0
- data/standards/stig_microsoft_excel_2003.json +47 -0
- data/standards/stig_microsoft_excel_2007.json +155 -0
- data/standards/stig_microsoft_excel_2010.json +287 -0
- data/standards/stig_microsoft_excel_2013.json +293 -0
- data/standards/stig_microsoft_excel_2016.json +257 -0
- data/standards/stig_microsoft_exchange_2010_client_access_server_role.json +71 -0
- data/standards/stig_microsoft_exchange_2010_core_server.json +47 -0
- data/standards/stig_microsoft_exchange_2010_edge_transport_server_role.json +233 -0
- data/standards/stig_microsoft_exchange_2010_hub_transport_server_role.json +125 -0
- data/standards/stig_microsoft_exchange_2010_mailbox_server_role.json +107 -0
- data/standards/stig_microsoft_exchange_server_2003.json +647 -0
- data/standards/stig_microsoft_groove_2013.json +71 -0
- data/standards/stig_microsoft_ie_version_6.json +599 -0
- data/standards/stig_microsoft_ie_version_7.json +749 -0
- data/standards/stig_microsoft_infopath_2003.json +41 -0
- data/standards/stig_microsoft_infopath_2007.json +167 -0
- data/standards/stig_microsoft_infopath_2010.json +155 -0
- data/standards/stig_microsoft_infopath_2013.json +149 -0
- data/standards/stig_microsoft_internet_explorer_10.json +857 -0
- data/standards/stig_microsoft_internet_explorer_11.json +839 -0
- data/standards/stig_microsoft_internet_explorer_9.json +821 -0
- data/standards/stig_microsoft_lync_2013.json +29 -0
- data/standards/stig_microsoft_office_system_2007.json +221 -0
- data/standards/stig_microsoft_office_system_2010.json +233 -0
- data/standards/stig_microsoft_office_system_2013.json +293 -0
- data/standards/stig_microsoft_office_system_2016.json +131 -0
- data/standards/stig_microsoft_onedrivebusiness_2016.json +89 -0
- data/standards/stig_microsoft_onenote_2010.json +77 -0
- data/standards/stig_microsoft_onenote_2013.json +71 -0
- data/standards/stig_microsoft_onenote_2016.json +71 -0
- data/standards/stig_microsoft_outlook_2003.json +65 -0
- data/standards/stig_microsoft_outlook_2007.json +479 -0
- data/standards/stig_microsoft_outlook_2010.json +515 -0
- data/standards/stig_microsoft_outlook_2013.json +497 -0
- data/standards/stig_microsoft_outlook_2016.json +359 -0
- data/standards/stig_microsoft_powerpoint_2003.json +47 -0
- data/standards/stig_microsoft_powerpoint_2007.json +131 -0
- data/standards/stig_microsoft_powerpoint_2010.json +191 -0
- data/standards/stig_microsoft_powerpoint_2013.json +251 -0
- data/standards/stig_microsoft_powerpoint_2016.json +233 -0
- data/standards/stig_microsoft_project_2010.json +83 -0
- data/standards/stig_microsoft_project_2013.json +95 -0
- data/standards/stig_microsoft_project_2016.json +95 -0
- data/standards/stig_microsoft_publisher_2010.json +107 -0
- data/standards/stig_microsoft_publisher_2013.json +101 -0
- data/standards/stig_microsoft_publisher_2016.json +101 -0
- data/standards/stig_microsoft_sharepoint_designer_2013.json +71 -0
- data/standards/stig_microsoft_skypebusiness_2016.json +29 -0
- data/standards/stig_microsoft_sql_server_2005_database.json +167 -0
- data/standards/stig_microsoft_sql_server_2005_instance.json +1001 -0
- data/standards/stig_microsoft_sql_server_2012_database.json +179 -0
- data/standards/stig_microsoft_sql_server_2012_database_instance.json +929 -0
- data/standards/stig_microsoft_visio_2013.json +89 -0
- data/standards/stig_microsoft_visio_2016.json +89 -0
- data/standards/stig_microsoft_windows_10_mobile.json +215 -0
- data/standards/stig_microsoft_windows_2008_server_domain_name_system.json +269 -0
- data/standards/stig_microsoft_windows_2012_server_domain_name_system.json +551 -0
- data/standards/stig_microsoft_windows_phone_8.1.json +161 -0
- data/standards/stig_microsoft_windows_server_2012_domain_controller.json +2633 -0
- data/standards/stig_microsoft_windows_server_2012_member_server.json +2411 -0
- data/standards/stig_microsoft_word_2003.json +47 -0
- data/standards/stig_microsoft_word_2007.json +119 -0
- data/standards/stig_microsoft_word_2010.json +221 -0
- data/standards/stig_microsoft_word_2013.json +221 -0
- data/standards/stig_microsoft_word_2016.json +215 -0
- data/standards/stig_mobile_application_management_mam_server.json +95 -0
- data/standards/stig_mobile_application_security_requirements_guide.json +233 -0
- data/standards/stig_mobile_device_integrity_scanning_mdis_server.json +119 -0
- data/standards/stig_mobile_device_management_mdm_server.json +125 -0
- data/standards/stig_mobile_device_manager_security_requirements_guide.json +2555 -0
- data/standards/stig_mobile_email_management_mem_server.json +197 -0
- data/standards/stig_mobile_operating_system_security_requirements_guide.json +1943 -0
- data/standards/stig_mobile_policy.json +35 -0
- data/standards/stig_mobile_policy_security_requirements_guide.json +437 -0
- data/standards/stig_mobileiron_core_v9.x_mdm.json +89 -0
- data/standards/stig_mobility_policy.json +65 -0
- data/standards/stig_mozilla_firefox.json +161 -0
- data/standards/stig_ms_exchange_2013_client_access_server.json +209 -0
- data/standards/stig_ms_exchange_2013_edge_transport_server.json +443 -0
- data/standards/stig_ms_exchange_2013_mailbox_server.json +437 -0
- data/standards/stig_ms_sharepoint_2010.json +269 -0
- data/standards/stig_ms_sharepoint_2013.json +245 -0
- data/standards/stig_ms_sharepoint_designer_2013.json +71 -0
- data/standards/stig_ms_sql_server_2014_database.json +263 -0
- data/standards/stig_ms_sql_server_2014_instance.json +575 -0
- data/standards/stig_ms_sql_server_2016_database.json +185 -0
- data/standards/stig_ms_sql_server_2016_instance.json +731 -0
- data/standards/stig_ms_windows_defender_antivirus.json +257 -0
- data/standards/stig_multifunction_device_and_network_printers.json +131 -0
- data/standards/stig_network_device_management_security_requirements_guide.json +863 -0
- data/standards/stig_network_devices.json +389 -0
- data/standards/stig_network_infrastructure_policy.json +455 -0
- data/standards/stig_network_security_requirements_guide.json +1961 -0
- data/standards/stig_operating_system_security_requirements_guide.json +1961 -0
- data/standards/stig_oracle_10_database_installation.json +527 -0
- data/standards/stig_oracle_10_database_instance.json +569 -0
- data/standards/stig_oracle_11_database_installation.json +527 -0
- data/standards/stig_oracle_11_database_instance.json +551 -0
- data/standards/stig_oracle_database_10g_installation.json +527 -0
- data/standards/stig_oracle_database_10g_instance.json +581 -0
- data/standards/stig_oracle_database_11.2g.json +1229 -0
- data/standards/stig_oracle_database_11g_installation.json +527 -0
- data/standards/stig_oracle_database_11g_instance.json +575 -0
- data/standards/stig_oracle_database_12c.json +1217 -0
- data/standards/stig_oracle_http_server_12.1.3.json +1703 -0
- data/standards/stig_oracle_linux_5.json +3431 -0
- data/standards/stig_oracle_linux_6.json +1583 -0
- data/standards/stig_oracle_weblogic_server_12c.json +443 -0
- data/standards/stig_palo_alto_networks_alg.json +311 -0
- data/standards/stig_palo_alto_networks_idps.json +185 -0
- data/standards/stig_palo_alto_networks_ndm.json +251 -0
- data/standards/stig_pda.json +83 -0
- data/standards/stig_pdasmartphone.json +95 -0
- data/standards/stig_perimeter_l3_switch.json +923 -0
- data/standards/stig_perimeter_l3_switch_-_cisco.json +1001 -0
- data/standards/stig_perimeter_router.json +803 -0
- data/standards/stig_perimeter_router_cisco.json +881 -0
- data/standards/stig_perimeter_router_juniper.json +803 -0
- data/standards/stig_postgresql_9.x.json +677 -0
- data/standards/stig_red_hat_enterprise_linux_5.json +3437 -0
- data/standards/stig_red_hat_enterprise_linux_6.json +1565 -0
- data/standards/stig_red_hat_enterprise_linux_7.json +1451 -0
- data/standards/stig_remote_access_policy.json +317 -0
- data/standards/stig_removable_storage_and_external_connection_technologies.json +143 -0
- data/standards/stig_removable_storage_and_external_connections.json +137 -0
- data/standards/stig_rfid_scanner.json +35 -0
- data/standards/stig_rfid_workstation.json +23 -0
- data/standards/stig_riverbed_steelhead_cx_v8_alg.json +83 -0
- data/standards/stig_riverbed_steelhead_cx_v8_ndm.json +371 -0
- data/standards/stig_router_security_requirements_guide.json +575 -0
- data/standards/stig_samsung_android_os_5_with_knox_2.0.json +365 -0
- data/standards/stig_samsung_android_os_6_with_knox_2.x.json +377 -0
- data/standards/stig_samsung_android_os_7_with_knox_2.x.json +443 -0
- data/standards/stig_samsung_android_with_knox_1.x.json +293 -0
- data/standards/stig_samsung_android_with_knox_2.x.json +371 -0
- data/standards/stig_samsung_knox_android_1.0.json +167 -0
- data/standards/stig_sharepoint_2010.json +269 -0
- data/standards/stig_sharepoint_2013.json +245 -0
- data/standards/stig_smartphone_policy.json +131 -0
- data/standards/stig_solaris_10_sparc.json +3029 -0
- data/standards/stig_solaris_10_x86.json +3065 -0
- data/standards/stig_solaris_11_sparc.json +1427 -0
- data/standards/stig_solaris_11_x86.json +1421 -0
- data/standards/stig_solaris_9_sparc.json +2915 -0
- data/standards/stig_solaris_9_x86.json +2915 -0
- data/standards/stig_sun_ray_4.json +185 -0
- data/standards/stig_sun_ray_4_policy.json +77 -0
- data/standards/stig_suse_linux_enterprise_server_v11system_z.json +3311 -0
- data/standards/stig_symantec_endpoint_protection_12.1_local_client_antivirus.json +689 -0
- data/standards/stig_symantec_endpoint_protection_12.1_managed_client_antivirus.json +695 -0
- data/standards/stig_tanium_6.5.json +461 -0
- data/standards/stig_tanium_7.0.json +803 -0
- data/standards/stig_test_and_development_zone_a.json +167 -0
- data/standards/stig_test_and_development_zone_b.json +179 -0
- data/standards/stig_test_and_development_zone_c.json +143 -0
- data/standards/stig_test_and_development_zone_d.json +143 -0
- data/standards/stig_traditional_security.json +917 -0
- data/standards/stig_unix_srg.json +3287 -0
- data/standards/stig_video_services_policy.json +497 -0
- data/standards/stig_video_teleconference.json +47 -0
- data/standards/stig_video_teleconference_vtc.json +12 -0
- data/standards/stig_vmware_esx_3_policy.json +155 -0
- data/standards/stig_vmware_esx_3_server.json +3791 -0
- data/standards/stig_vmware_esx_3_virtual_center.json +257 -0
- data/standards/stig_vmware_esx_3_virtual_machine.json +53 -0
- data/standards/stig_vmware_esxi_server_5.0.json +809 -0
- data/standards/stig_vmware_esxi_v5.json +5177 -0
- data/standards/stig_vmware_esxi_version_5_virtual_machine.json +317 -0
- data/standards/stig_vmware_nsx_distributed_firewall.json +83 -0
- data/standards/stig_vmware_nsx_distributed_logical_router.json +35 -0
- data/standards/stig_vmware_nsx_manager.json +191 -0
- data/standards/stig_vmware_vcenter_server.json +179 -0
- data/standards/stig_vmware_vcenter_server_version_5.json +149 -0
- data/standards/stig_vmware_vsphere_esxi_6.0.json +659 -0
- data/standards/stig_vmware_vsphere_vcenter_server_version_6.json +311 -0
- data/standards/stig_vmware_vsphere_virtual_machine_version_6.json +269 -0
- data/standards/stig_voice_and_video_over_internet_protocol_vvoip_policy.json +407 -0
- data/standards/stig_voice_video_endpoint_security_requirements_guide.json +395 -0
- data/standards/stig_voice_video_services_policy.json +671 -0
- data/standards/stig_voice_video_session_management_security_requirements_guide.json +329 -0
- data/standards/stig_voicevideo_over_internet_protocol.json +419 -0
- data/standards/stig_voicevideo_over_internet_protocol_vvoip.json +263 -0
- data/standards/stig_voicevideo_services_policy.json +569 -0
- data/standards/stig_web_policy.json +95 -0
- data/standards/stig_web_server.json +317 -0
- data/standards/stig_web_server_security_requirements_guide.json +587 -0
- data/standards/stig_win2k3_audit.json +761 -0
- data/standards/stig_win2k8_audit.json +1085 -0
- data/standards/stig_win2k8_r2_audit.json +1637 -0
- data/standards/stig_win7_audit.json +1613 -0
- data/standards/stig_windows_10.json +1691 -0
- data/standards/stig_windows_2003_domain_controller.json +893 -0
- data/standards/stig_windows_2003_member_server.json +845 -0
- data/standards/stig_windows_2008_domain_controller.json +1475 -0
- data/standards/stig_windows_2008_member_server.json +1301 -0
- data/standards/stig_windows_7.json +1781 -0
- data/standards/stig_windows_8.json +2399 -0
- data/standards/stig_windows_88.1.json +2273 -0
- data/standards/stig_windows_8_8.1.json +2297 -0
- data/standards/stig_windows_defender_antivirus.json +239 -0
- data/standards/stig_windows_dns.json +185 -0
- data/standards/stig_windows_firewall_with_advanced_security.json +137 -0
- data/standards/stig_windows_paw.json +155 -0
- data/standards/stig_windows_phone_6.5_with_good_mobility_suite.json +65 -0
- data/standards/stig_windows_server_2008_r2_domain_controller.json +1961 -0
- data/standards/stig_windows_server_2008_r2_member_server.json +1745 -0
- data/standards/stig_windows_server_20122012_r2_domain_controller.json +2255 -0
- data/standards/stig_windows_server_20122012_r2_member_server.json +2045 -0
- data/standards/stig_windows_server_2012_2012_r2_domain_controller.json +2279 -0
- data/standards/stig_windows_server_2012_2012_r2_member_server.json +2075 -0
- data/standards/stig_windows_server_2012_domain_controller.json +2471 -0
- data/standards/stig_windows_server_2012_member_server.json +2249 -0
- data/standards/stig_windows_server_2016.json +1661 -0
- data/standards/stig_windows_vista.json +1517 -0
- data/standards/stig_windows_xp.json +893 -0
- data/standards/stig_wireless_keyboard_and_mouse.json +23 -0
- data/standards/stig_wireless_management_server_policy.json +53 -0
- data/standards/stig_wireless_remote_access_policy_security_implementation_guide.json +29 -0
- data/standards/stig_wlan_access_point_enclave-niprnet_connected.json +227 -0
- data/standards/stig_wlan_access_point_internet_gateway_only_connection.json +209 -0
- data/standards/stig_wlan_access_point_policy.json +17 -0
- data/standards/stig_wlan_authentication_server.json +29 -0
- data/standards/stig_wlan_bridge.json +209 -0
- data/standards/stig_wlan_client.json +65 -0
- data/standards/stig_wlan_controller.json +215 -0
- data/standards/stig_wlan_ids_sensorserver.json +23 -0
- data/standards/stig_wman_access_point.json +263 -0
- data/standards/stig_wman_bridge.json +209 -0
- data/standards/stig_wman_subscriber.json +65 -0
- data/standards/stig_zos_acf2.json +1451 -0
- data/standards/stig_zos_bmc_control-dacf2.json +53 -0
- data/standards/stig_zos_bmc_control-dracf.json +59 -0
- data/standards/stig_zos_bmc_control-dtss.json +65 -0
- data/standards/stig_zos_bmc_control-macf2.json +59 -0
- data/standards/stig_zos_bmc_control-mracf.json +65 -0
- data/standards/stig_zos_bmc_control-mrestartacf2.json +23 -0
- data/standards/stig_zos_bmc_control-mrestartracf.json +23 -0
- data/standards/stig_zos_bmc_control-mrestarttss.json +23 -0
- data/standards/stig_zos_bmc_control-mtss.json +71 -0
- data/standards/stig_zos_bmc_control-oacf2.json +53 -0
- data/standards/stig_zos_bmc_control-oracf.json +59 -0
- data/standards/stig_zos_bmc_control-otss.json +65 -0
- data/standards/stig_zos_bmc_ioaacf2.json +53 -0
- data/standards/stig_zos_bmc_ioaracf.json +59 -0
- data/standards/stig_zos_bmc_ioatss.json +65 -0
- data/standards/stig_zos_bmc_mainviewzosacf2.json +47 -0
- data/standards/stig_zos_bmc_mainviewzosracf.json +53 -0
- data/standards/stig_zos_bmc_mainviewzostss.json +59 -0
- data/standards/stig_zos_ca_1_tape_managementacf2.json +65 -0
- data/standards/stig_zos_ca_1_tape_managementracf.json +77 -0
- data/standards/stig_zos_ca_1_tape_managementtss.json +77 -0
- data/standards/stig_zos_ca_auditoracf2.json +29 -0
- data/standards/stig_zos_ca_auditorracf.json +29 -0
- data/standards/stig_zos_ca_auditortss.json +29 -0
- data/standards/stig_zos_ca_common_servicesacf2.json +23 -0
- data/standards/stig_zos_ca_common_servicesracf.json +29 -0
- data/standards/stig_zos_ca_common_servicestss.json +29 -0
- data/standards/stig_zos_ca_micsacf2.json +23 -0
- data/standards/stig_zos_ca_micsracf.json +23 -0
- data/standards/stig_zos_ca_micstss.json +23 -0
- data/standards/stig_zos_ca_mimacf2.json +41 -0
- data/standards/stig_zos_ca_mimracf.json +47 -0
- data/standards/stig_zos_ca_mimtss.json +47 -0
- data/standards/stig_zos_ca_vtapeacf2.json +29 -0
- data/standards/stig_zos_ca_vtaperacf.json +35 -0
- data/standards/stig_zos_ca_vtapetss.json +35 -0
- data/standards/stig_zos_catalog_solutionsacf2.json +23 -0
- data/standards/stig_zos_catalog_solutionsracf.json +23 -0
- data/standards/stig_zos_catalog_solutionstss.json +23 -0
- data/standards/stig_zos_clsupersessionacf2.json +53 -0
- data/standards/stig_zos_clsupersessionracf.json +65 -0
- data/standards/stig_zos_clsupersessiontss.json +71 -0
- data/standards/stig_zos_compuware_abend-aidacf2.json +47 -0
- data/standards/stig_zos_compuware_abend-aidracf.json +53 -0
- data/standards/stig_zos_compuware_abend-aidtss.json +53 -0
- data/standards/stig_zos_cssmtpacf2.json +23 -0
- data/standards/stig_zos_cssmtpracf.json +29 -0
- data/standards/stig_zos_cssmtptss.json +29 -0
- data/standards/stig_zos_fdracf2.json +23 -0
- data/standards/stig_zos_fdrracf.json +23 -0
- data/standards/stig_zos_fdrtss.json +23 -0
- data/standards/stig_zos_hcdacf2.json +29 -0
- data/standards/stig_zos_hcdracf.json +29 -0
- data/standards/stig_zos_hcdtss.json +29 -0
- data/standards/stig_zos_ibm_cics_transaction_serveracf2.json +17 -0
- data/standards/stig_zos_ibm_cics_transaction_serverracf.json +17 -0
- data/standards/stig_zos_ibm_cics_transaction_servertss.json +17 -0
- data/standards/stig_zos_ibm_health_checkeracf2.json +23 -0
- data/standards/stig_zos_ibm_health_checkerracf.json +29 -0
- data/standards/stig_zos_ibm_health_checkertss.json +29 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsfacf2.json +53 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsfracf.json +59 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsftss.json +53 -0
- data/standards/stig_zos_icsfacf2.json +29 -0
- data/standards/stig_zos_icsfracf.json +35 -0
- data/standards/stig_zos_icsftss.json +35 -0
- data/standards/stig_zos_netviewacf2.json +41 -0
- data/standards/stig_zos_netviewracf.json +47 -0
- data/standards/stig_zos_netviewtss.json +53 -0
- data/standards/stig_zos_quest_nc-passacf2.json +35 -0
- data/standards/stig_zos_quest_nc-passracf.json +41 -0
- data/standards/stig_zos_quest_nc-passtss.json +47 -0
- data/standards/stig_zos_racf.json +1415 -0
- data/standards/stig_zos_roscoeacf2.json +47 -0
- data/standards/stig_zos_roscoeracf.json +53 -0
- data/standards/stig_zos_roscoetss.json +59 -0
- data/standards/stig_zos_srrauditacf2.json +23 -0
- data/standards/stig_zos_srrauditracf.json +23 -0
- data/standards/stig_zos_srraudittss.json +23 -0
- data/standards/stig_zos_tadzacf2.json +29 -0
- data/standards/stig_zos_tadzracf.json +35 -0
- data/standards/stig_zos_tadztss.json +35 -0
- data/standards/stig_zos_tdmfacf2.json +23 -0
- data/standards/stig_zos_tdmfracf.json +23 -0
- data/standards/stig_zos_tdmftss.json +23 -0
- data/standards/stig_zos_tss.json +1523 -0
- data/standards/stig_zos_vssracf.json +29 -0
- metadata +691 -0
|
@@ -0,0 +1,143 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_test_and_development_zone_d",
|
|
3
|
+
"date": "2015-12-17",
|
|
4
|
+
"description": "None",
|
|
5
|
+
"title": "Test and Development Zone D Security Technical Implementation Guide",
|
|
6
|
+
"version": "None",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-39344",
|
|
12
|
+
"title": "Network infrastructure and systems supporting the test and development environment must be documented within the organizations accreditation package.",
|
|
13
|
+
"description": "Up-to-date documentation is essential in assisting with the management, auditing, and security of the network infrastructure used to support the test and development environment. Network diagrams are important because they show the overall layout where devices are physically located within the network infrastructure. Diagrams also show the relationship and connectivity between devices where possible intrusive attacks could take place. Having up-to-date network diagrams will also help show what the security, traffic, and physical impact of adding a system will be on the network.",
|
|
14
|
+
"severity": "medium"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-39345",
|
|
18
|
+
"title": "Network infrastructure and systems supporting the test and development environment must follow DoD certification and accreditation procedures before connecting to a DoD operational network or Internet Service Provider.",
|
|
19
|
+
"description": "Prior to connecting to a live operational network, such as the DISN, systems, at minimum, receive an IATO. A system without an IATO does not show adequate effort to meet IA controls and security requirements and may pose a risk to other computers or systems connecting to the operational network.",
|
|
20
|
+
"severity": "medium"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-39433",
|
|
24
|
+
"title": "Network infrastructure and systems supporting the test and development environment must be registered in a DoD asset management system.",
|
|
25
|
+
"description": "An asset management system is used to send out notifications on vulnerabilities in commercial and military information infrastructures as they are discovered. If the organization's assets are not registered with an asset management system, administrators will not be notified of important vulnerabilities such as viruses, denial of service attacks, system weaknesses, back doors, and other potentially harmful situations. Additionally, there will be no way to enter, track, or resolve findings during a review.",
|
|
26
|
+
"severity": "medium"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-39434",
|
|
30
|
+
"title": "Network infrastructure and systems supporting the test and development environment must be managed from a management network.",
|
|
31
|
+
"description": "It is important to restrict administrative access to the supporting network infrastructure and systems in the test and development environment, as it reduces the risk of data theft or interception from an attacker on the operational network.",
|
|
32
|
+
"severity": "medium"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"id": "V-39435",
|
|
36
|
+
"title": "The organization must document impersistent connections to the test and development environment with approval by the organizations Authorizing Official.",
|
|
37
|
+
"description": "An impersistent connection is any temporary connection needed to another test and development environment or DoD operational network where testing is not feasible. As any unvetted connection or device will create additional risk and compromise the entire environment, it is up to the Authorizing Official for the organization to accept the risk of an impersistent connection.",
|
|
38
|
+
"severity": "medium"
|
|
39
|
+
},
|
|
40
|
+
{
|
|
41
|
+
"id": "V-39437",
|
|
42
|
+
"title": "Development systems must have antivirus installed and enabled with up-to-date signatures.",
|
|
43
|
+
"description": "Virus scan programs are a primary line of defense against the introduction of viruses and malicious code that can destroy data and even render a computer inoperable. Utilizing the most current virus scan program provides the ability to detect this malicious code before extensive damage occurs. Updated virus scan data files help protect a system, as new malware is identified by the software vendors on a regular basis.",
|
|
44
|
+
"severity": "high"
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"id": "V-39438",
|
|
48
|
+
"title": "Development systems must have HIDS or HIPS installed and configured with up-to-date signatures.",
|
|
49
|
+
"description": "A HIDS or HIPS application is a secondary line of defense behind the antivirus. The application will monitor all ports and the dynamic state of a development system. If the application detects irregularities on the system, it will block incoming traffic that may potentially compromise the development system that can lead to a DoS or data theft.",
|
|
50
|
+
"severity": "medium"
|
|
51
|
+
},
|
|
52
|
+
{
|
|
53
|
+
"id": "V-39439",
|
|
54
|
+
"title": "Development systems must have a firewall installed, configured, and enabled.",
|
|
55
|
+
"description": "A firewall provides a line of defense against malicious attacks. To be effective, it must be enabled and properly configured.",
|
|
56
|
+
"severity": "medium"
|
|
57
|
+
},
|
|
58
|
+
{
|
|
59
|
+
"id": "V-39440",
|
|
60
|
+
"title": "Development systems must be part of a patch management solution.",
|
|
61
|
+
"description": "Major software vendors release security patches and hotfixes to their products when security vulnerabilities are discovered. It is essential that these updates be applied in a timely manner to prevent unauthorized individuals from exploiting identified vulnerabilities.",
|
|
62
|
+
"severity": "medium"
|
|
63
|
+
},
|
|
64
|
+
{
|
|
65
|
+
"id": "V-39441",
|
|
66
|
+
"title": "A change management policy must be implemented for application development.",
|
|
67
|
+
"description": "Change management is the formal review process that ensures that all changes made to a system or application receives formal review and approval. Change management reduces impacts from proposed changes that could possibly have interruptions to the services provided. Recording all changes for applications will be accomplished by a configuration management policy. The configuration management policy will capture the actual changes to software code and anything else affected by the change.",
|
|
68
|
+
"severity": "medium"
|
|
69
|
+
},
|
|
70
|
+
{
|
|
71
|
+
"id": "V-39611",
|
|
72
|
+
"title": "The organization must document and gain approval from the Change Control Authority prior to migrating data to DoD operational networks.",
|
|
73
|
+
"description": "Without the approval of the Change Control Authority, data moved from the test and development network into an operational network could pose a risk of containing malicious code or cause other unintended consequences to live operational data. Data moving into operational networks from final stage preparation must always be vetted and approved.",
|
|
74
|
+
"severity": "medium"
|
|
75
|
+
},
|
|
76
|
+
{
|
|
77
|
+
"id": "V-39614",
|
|
78
|
+
"title": "Application code must go through a code review prior to deployment into DoD operational networks.",
|
|
79
|
+
"description": "Prior to release of the application receiving an IATO for deployment into a DoD operational network, the application will have a thorough code review. Along with the proper testing, the code review will specify flaws causing security, compatibility, or reliability concerns that may compromise the operational network.",
|
|
80
|
+
"severity": "medium"
|
|
81
|
+
},
|
|
82
|
+
{
|
|
83
|
+
"id": "V-39619",
|
|
84
|
+
"title": "Access to source code during application development must be restricted to authorized users.",
|
|
85
|
+
"description": "Restricting access to source code and the application to authorized users will limit the risk of source code theft or other potential compromise.",
|
|
86
|
+
"severity": "medium"
|
|
87
|
+
},
|
|
88
|
+
{
|
|
89
|
+
"id": "V-39621",
|
|
90
|
+
"title": "The organization must sanitize data transferred to test and development environments from DoD operational networks for testing to remove personal and sensitive information exempt from the Freedom of Information Act.",
|
|
91
|
+
"description": "If DoD production data is transferred to a test and development environment and personal or sensitive information has not been sanitized from the data, personal or sensitive information could be exposed or compromised.",
|
|
92
|
+
"severity": "medium"
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
"id": "V-39659",
|
|
96
|
+
"title": "The Zone D test and development environment must be physically separate and isolated from any DoD operational network.",
|
|
97
|
+
"description": "Systems found in the Zone D test and development environment are typically non-IA-compliant test systems that include hardware, software, or development systems. These systems typically do not follow the appropriate best security practices. Therefore, if they are connected to any operational network, it is possible to infect live data or degrade infrastructure in an operational network.",
|
|
98
|
+
"severity": "high"
|
|
99
|
+
},
|
|
100
|
+
{
|
|
101
|
+
"id": "V-39660",
|
|
102
|
+
"title": "The test and development environment must not have access to DoD operational networks.",
|
|
103
|
+
"description": "Systems or devices used for test data that do not meet minimum IA standards for accreditation are a risk to a DoD operational network if allowed to communicate between environments. Data that has not been fully tested and finalized for use in an operational network may cause unintended consequences, such as data loss or corruption. Unvetted data allowed into a DoD operational network from non-IA-compliant machines may also contain malicious code that could be used to steal or damage live data.",
|
|
104
|
+
"severity": "medium"
|
|
105
|
+
},
|
|
106
|
+
{
|
|
107
|
+
"id": "V-39669",
|
|
108
|
+
"title": "Remote access VPNs must prohibit the use of split tunneling on VPN connections.",
|
|
109
|
+
"description": "The VPN software on a host can be configured in either of two modes. It can be set to encrypt all IP traffic originating from that host, and send all of that traffic to the remote IP address of the network gateway. This configuration is called “tunnel-all” mode, because all IP traffic from the host must traverse the VPN tunnel to the remote system, where it will either be processed or further forwarded to additional IP addresses after decryption. Alternately, the VPN software can be set only to encrypt traffic that is specifically addressed to an IP at the other end of the VPN tunnel. All other IP traffic bypasses the VPN encryption and routing process, and is handled by the host as if the VPN relationship did not exist. This configuration is called “split-tunnel” mode, because the IP traffic from the host is split between encrypted packets sent across the VPN tunnel and unencrypted packets sent to all other external addresses. There are security and operational implications in the decision of whether to use split-tunnel or tunnel-all mode. Placing a host in tunnel-all mode makes it appear to the rest of the world as a node on the connected logical (VPN-connected) network. It no longer has an identity to the outside world based on the local physical network. In tunnel-all mode, all traffic between the remote host and any other host can be subject to inspection and processing by the security policy devices of the remote VPN-linked network. This improves the security aspects of the connected network, since it can enforce all security policies on the VPN-connected computer.",
|
|
110
|
+
"severity": "medium"
|
|
111
|
+
},
|
|
112
|
+
{
|
|
113
|
+
"id": "V-39670",
|
|
114
|
+
"title": "Remote access into the test and development environment must originate from a non-DoD operational network segment.",
|
|
115
|
+
"description": "If remote access is needed to access the test and development environment, it must be originated from a non-DoD operational network segment. Examples of this are a virtual machine located on government-furnished equipment used for operational tasks, or a separate physical machine sitting in a separate network segment or VLAN. Keeping direct access off the DoD operational network will reduce the risk of test and development data being leaked, potentially damaging or compromising live data.",
|
|
116
|
+
"severity": "medium"
|
|
117
|
+
},
|
|
118
|
+
{
|
|
119
|
+
"id": "V-39672",
|
|
120
|
+
"title": "Virtual machines used for application development and testing must not share the same physical host with DoD operational virtual machines.",
|
|
121
|
+
"description": "Attacks on virtual machines from other VMs through denial of service and other attacks potentially stealing sensitive data such as source code used in application development. It is imperative to keep DoD operational virtual machines on physically separate platforms from test and development virtual machines.",
|
|
122
|
+
"severity": "medium"
|
|
123
|
+
},
|
|
124
|
+
{
|
|
125
|
+
"id": "V-39674",
|
|
126
|
+
"title": "The organization must have a current ISP GIG Waiver for any ISP connections to the test and development environment.",
|
|
127
|
+
"description": "The test and development environment is typically a closed and physically separated network with no external connectivity to the DISN or Internet. In some instances, Internet connectivity is needed for this environment due to the flexibility it provides for nonoperational systems. In this case, an ISP GIG Waiver is required, along with approval from the organization's Authorizing Official.",
|
|
128
|
+
"severity": "low"
|
|
129
|
+
},
|
|
130
|
+
{
|
|
131
|
+
"id": "V-41494",
|
|
132
|
+
"title": "Data used for testing and development must be downloaded through a secure connection to an IA-compliant system for vulnerability scanning prior to deployment in the test and development environment.",
|
|
133
|
+
"description": "It is mandatory that data from an untrusted network or website that is to be used in a testing and development environment be downloaded through a secure perimeter. Bringing data directly from an untrusted network or downloaded from a personal computer or home Internet connection must be prohibited. Scanning data is crucial to ensure the integrity of the information prior to deployment for T&D processes. While not an all-inclusive list, data in this situation includes OS patches, application updates, operating systems, development tools, and test data. In the T&D environment, there will typically be one or more IA-compliant systems accessing a secure Internet connection. If a secure Internet connection is not available, such as in Zone D, a connection in another zone can be used and the data moved by approved physical media into the zone. Scanning the data with an anti-virus program will reduce the risk of exploits and of having vulnerable systems in the T&D environment taken over. Downloading data from a single workstation for all zone environments is acceptable. Organizations with NIPRNet connections must download all data through their NIPR connection for scanning at the IAPs. Contractors or other DoD organizations without any direct NIPRNet connectivity will need to use a secure Internet connection following all applicable DoD IA policy and STIG requirements. ",
|
|
134
|
+
"severity": "medium"
|
|
135
|
+
},
|
|
136
|
+
{
|
|
137
|
+
"id": "V-43317",
|
|
138
|
+
"title": "The organization must create a policy and procedures document for proper handling and transport of data entering (physically or electronically) the test and development environment.",
|
|
139
|
+
"description": "Without policies and procedures in place, the organization will not have the authority to hold personnel accountable for improperly handling or transporting data into the test and development environment. The documents need to include guidance for both physical and electronic data migration.",
|
|
140
|
+
"severity": "medium"
|
|
141
|
+
}
|
|
142
|
+
]
|
|
143
|
+
}
|
|
@@ -0,0 +1,917 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_traditional_security",
|
|
3
|
+
"date": "2013-07-11",
|
|
4
|
+
"description": "Previously the Traditional Security Checklist, consisted of five (5) component sub-checklists that were selected for use based upon the type of review being conducted. The new Traditional Security Checklist consolidates all checks into one document and is more granular both in the increased number of checks (151 total versus 96 total in the old checklists) and the details about how to conduct them. It provides a more complete and current list of references, the relationship and authority for checks relative to protection of Defense Information System Network (DISN) assets, and will enhance reviewer consistency with application of potential findings.\n \nWhile the number of potential findings have increased and are more focused to a specific check there is additional granularity within each check. In many of the primary checks there are additional considerations and \"sub-checks\". As the new checklist is further developed it may be that some of these sub-checks will become additional stand-alone primary checks.\n\nThe format and content flow of the new checklist is like other Security Technical Implementation Guide (STIG) checklists derived from the Vulnerability Management System (VMS) database, which is used by DISA FSO, the Combatant Commands, Services, and Agencies (CC/S/A) and other Federal Agencies with access to the Defense Information Systems Network (DISN) to document and follow-up findings noted during Command Cyber Readiness Inspections (CCRIs).\n\nComments or proposed revisions to this document should be sent via e-mail to the following address: disa.letterkenny.FSO.mbx.stig-customer-support-mailbox@mail.mil.\n\n\n\n",
|
|
5
|
+
"title": "Traditional Security",
|
|
6
|
+
"version": "1",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-30837",
|
|
12
|
+
"title": "COMSEC Account Management - Equipment and Key Storage ",
|
|
13
|
+
"description": "Improper handling and storage of COMSEC material can result in the loss or compromise of classified cryptologic devices or classified key or unclassified COMSEC Controlled Items (CCI).",
|
|
14
|
+
"severity": "high"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-30885",
|
|
18
|
+
"title": "COMSEC Account Management - Appointment of Responsible Person",
|
|
19
|
+
"description": "Lack of formal designation of an individual to be responsible for COMSEC items could result in mismanagement, loss or even compromise of COMSEC materials. Additionally, lack of formal vetting for a specific individual to be appointed for management of COMSEC material could result in a person (such as a non-US Citizen) having unauthorized access.\n\n",
|
|
20
|
+
"severity": "low"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-30928",
|
|
24
|
+
"title": "COMSEC Account Management - Program Management and Standards Compliance\n",
|
|
25
|
+
"description": "Recipients of NSA or Service COMSEC accounts are responsible to properly maintain the accounts. Procedures covering security, transport, handling, etc. of COMSEC must be developed to supplement regulatory guidelines. NSA or sponsoring Services of the COMSEC accounts maintain oversight by conducting required inspections. If COMSEC accounts are not properly maintained and findings are noted during an inspection they must be addressed properly and promptly. Should this not be done, the integrity of COMSEC items may be adversely impacted resulting in the loss or compromise of COMSEC equipment or key material. ",
|
|
26
|
+
"severity": "low"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-30931",
|
|
30
|
+
"title": "COMSEC Training - COMSEC Custodian or Hand Receipt Holder\n",
|
|
31
|
+
"description": "Lack of appropriate training for managers of COMSEC accounts could result in the mismanagement of COMSEC records, inadequate physical protection and ultimately lead to the loss or compromise of COMSEC keying material. ",
|
|
32
|
+
"severity": "medium"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"id": "V-30933",
|
|
36
|
+
"title": "COMSEC Training - COMSEC User\n",
|
|
37
|
+
"description": "Failure to properly brief COMSEC users could result in the loss of cryptologic devices or key, or\nthe compromise of classified information.",
|
|
38
|
+
"severity": "medium"
|
|
39
|
+
},
|
|
40
|
+
{
|
|
41
|
+
"id": "V-30934",
|
|
42
|
+
"title": "Classified Transmission - Electronic Means using Cryptographic System Authorized by the Director, NSA",
|
|
43
|
+
"description": "Failure to properly encrypt classified data in transit can lead to the loss or compromise of\nclassified or sensitive information.",
|
|
44
|
+
"severity": "high"
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"id": "V-30938",
|
|
48
|
+
"title": "Protected Distribution System (PDS) Construction - Point of Presence (PoP) and Terminal Equipment Protection. This requirement concerns security of both the starting and ending points for PDS within proper physically protected and access controlled environments. ",
|
|
49
|
+
"description": "A PDS that is not constructed and physically protected as required could result in the covert or undetected interception of classified information.",
|
|
50
|
+
"severity": "high"
|
|
51
|
+
},
|
|
52
|
+
{
|
|
53
|
+
"id": "V-30940",
|
|
54
|
+
"title": "Protected Distribution System (PDS) Construction - Visible for Inspection\n",
|
|
55
|
+
"description": "A PDS that is not inspected and monitored as required could result in undetected access, sabotage or tampering of the unencrypted transmission lines. This could directly lead to the loss or compromise of classified.",
|
|
56
|
+
"severity": "medium"
|
|
57
|
+
},
|
|
58
|
+
{
|
|
59
|
+
"id": "V-30942",
|
|
60
|
+
"title": "Protected Distribution System (PDS) Construction - Hardened Carrier\n",
|
|
61
|
+
"description": "A PDS that is not constructed and configured as required could result in the undetected interception of classified information.",
|
|
62
|
+
"severity": "high"
|
|
63
|
+
},
|
|
64
|
+
{
|
|
65
|
+
"id": "V-30949",
|
|
66
|
+
"title": "Protected Distribution System (PDS) Construction - Sealed Joints\n",
|
|
67
|
+
"description": "A PDS that is not constructed and sealed as required could result in the undetected interception of classified information. Sealing of joints is necessary to ensure that daily visual inspections of the PDS for signs of attempted or actual intrusion can be accurately and thoroughly conducted. ",
|
|
68
|
+
"severity": "medium"
|
|
69
|
+
},
|
|
70
|
+
{
|
|
71
|
+
"id": "V-30958",
|
|
72
|
+
"title": "Protected Distribution System (PDS) Construction - Accessible Pull Box Security\n",
|
|
73
|
+
"description": "A PDS that is not constructed and configured as required could result in the undetected interception of classified information.",
|
|
74
|
+
"severity": "high"
|
|
75
|
+
},
|
|
76
|
+
{
|
|
77
|
+
"id": "V-30969",
|
|
78
|
+
"title": "Protected Distribution System (PDS) Construction - Buried PDS Carrier\n",
|
|
79
|
+
"description": "A PDS that is not constructed, configured and physically secured as required could result in the undetected interception of classified information.",
|
|
80
|
+
"severity": "high"
|
|
81
|
+
},
|
|
82
|
+
{
|
|
83
|
+
"id": "V-30970",
|
|
84
|
+
"title": "Protected Distribution System (PDS) Construction - External Suspended PDS\n",
|
|
85
|
+
"description": "A PDS that is not constructed and configured as required could result in the undetected interception of classified information.",
|
|
86
|
+
"severity": "high"
|
|
87
|
+
},
|
|
88
|
+
{
|
|
89
|
+
"id": "V-30971",
|
|
90
|
+
"title": "Protected Distribution System (PDS) Construction - Continuously Viewed Carrier\n",
|
|
91
|
+
"description": "A PDS that is not constructed and configured as required could result in the undetected interception of classified information. A continuously viewed PDS may not be in a physically hardened carrier and the primary means of protection is continuous observation and control of the unencrypted transmission line. If not maintained under continuous observation an attacker (insider or external) could have an opportunity to tap and intercept unencrypted communications on the exposed cable.",
|
|
92
|
+
"severity": "high"
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
"id": "V-30973",
|
|
96
|
+
"title": "Protected Distribution System (PDS) Construction - Tactical Environment Application\n",
|
|
97
|
+
"description": "A PDS that is not constructed and configured as required could result in the undetected interception of classified information. Within mobile tactical situations a hardened carrier is not possible and therefore the unencrypted SIPRNet cable must be maintained within the confines of the tactical encampment with the cable under continuous observation and control to prevent exploitation by enemy forces. In theaters of operation where fixed facilities are well established, standard PDS applications must be employed unless a risk assessment is conducted to determine the vulnerabilities and risks associated with using unencrypted cable that is not in a hardened carrier.",
|
|
98
|
+
"severity": "high"
|
|
99
|
+
},
|
|
100
|
+
{
|
|
101
|
+
"id": "V-30974",
|
|
102
|
+
"title": "Protected Distribution System (PDS) Documentation - Signed Approval\n",
|
|
103
|
+
"description": "A PDS that is not approved could cause an Information Assurance Manager, Designated Approving Authority and other concerned managerial personnel to not be fully aware of all vulnerabilities and residual risk of IA systems under their purview.",
|
|
104
|
+
"severity": "low"
|
|
105
|
+
},
|
|
106
|
+
{
|
|
107
|
+
"id": "V-30975",
|
|
108
|
+
"title": "Protected Distribution System (PDS) Documentation - Request for Approval Documentation\n",
|
|
109
|
+
"description": "A PDS that is not approved could cause an Information Assurance Manager, Designated Accrediting Authority and other concerned managerial personnel to not be fully aware of all vulnerabilities and residual risk of IA systems under their purview.",
|
|
110
|
+
"severity": "low"
|
|
111
|
+
},
|
|
112
|
+
{
|
|
113
|
+
"id": "V-30976",
|
|
114
|
+
"title": "Protected Distribution System (PDS) Monitoring - Daily (Visual) Checks\n",
|
|
115
|
+
"description": "A PDS that is not inspected, monitored and maintained as required could result in undetected access, sabotage or tampering of the unencrypted transmission lines. This could directly lead to the loss or compromise of classified.",
|
|
116
|
+
"severity": "medium"
|
|
117
|
+
},
|
|
118
|
+
{
|
|
119
|
+
"id": "V-30977",
|
|
120
|
+
"title": "Protected Distribution System (PDS) Monitoring - Technical Inspections\n",
|
|
121
|
+
"description": "A PDS that is not inspected, monitored and maintained as required could result in undetected access, sabotage or tampering of the unencrypted transmission lines. This could directly lead to the loss or compromise of classified.",
|
|
122
|
+
"severity": "low"
|
|
123
|
+
},
|
|
124
|
+
{
|
|
125
|
+
"id": "V-30978",
|
|
126
|
+
"title": "Protected Distribution System (PDS) Monitoring - Initial Inspection\n",
|
|
127
|
+
"description": "A PDS that is not inspected, monitored and maintained as required could result in undetected access, sabotage or tampering of the unencrypted transmission lines. This could directly lead to the loss or compromise of classified.",
|
|
128
|
+
"severity": "low"
|
|
129
|
+
},
|
|
130
|
+
{
|
|
131
|
+
"id": "V-30979",
|
|
132
|
+
"title": "Protected Distribution System (PDS) Monitoring - Reporting Incidents\n",
|
|
133
|
+
"description": "A PDS that is not inspected, monitored and maintained as required could result in undetected access, sabotage or tampering of the unencrypted transmission lines. This could directly lead to the loss or compromise of classified.",
|
|
134
|
+
"severity": "medium"
|
|
135
|
+
},
|
|
136
|
+
{
|
|
137
|
+
"id": "V-30980",
|
|
138
|
+
"title": "TEMPEST Countermeasures\n",
|
|
139
|
+
"description": "Failure to implement required TEMPEST countermeasures could leave the system(s)\nvulnerable to a TEMPEST attack.",
|
|
140
|
+
"severity": "medium"
|
|
141
|
+
},
|
|
142
|
+
{
|
|
143
|
+
"id": "V-30981",
|
|
144
|
+
"title": "TEMPEST - Red/Black separation (Processors)\n",
|
|
145
|
+
"description": "Failure to maintain proper separation could result in detectable emanations of classified information.",
|
|
146
|
+
"severity": "medium"
|
|
147
|
+
},
|
|
148
|
+
{
|
|
149
|
+
"id": "V-30982",
|
|
150
|
+
"title": "TEMPEST - Red/Black Separation (Cables)\n",
|
|
151
|
+
"description": "Failure to maintain proper separation could result in detectable emanations of classified information.",
|
|
152
|
+
"severity": "medium"
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
"id": "V-30983",
|
|
156
|
+
"title": "Environmental IA Controls - Emergency Power Shut-Off (EPO)\n\n",
|
|
157
|
+
"description": "A lack of an emergency shut-off switch or a master power switch for electricity to IT equipment\ncould cause damage to the equipment or injury to personnel during an emergency.",
|
|
158
|
+
"severity": "medium"
|
|
159
|
+
},
|
|
160
|
+
{
|
|
161
|
+
"id": "V-30984",
|
|
162
|
+
"title": "Environmental IA Controls - Emergency Lighting and Exits - Properly Installed\n",
|
|
163
|
+
"description": "Lack of automatic emergency lighting and exits can cause injury and/or death to employees and\nemergency responders. Lack of automatic emergency lighting can also cause a disruption in\nservice.",
|
|
164
|
+
"severity": "medium"
|
|
165
|
+
},
|
|
166
|
+
{
|
|
167
|
+
"id": "V-30985",
|
|
168
|
+
"title": "Environmental IA Controls - Emergency Lighting and Exits - Documentation and Testing\n",
|
|
169
|
+
"description": "Lack of automatic emergency lighting can cause injury and/or death to employees and\nemergency responders. Lack of automatic emergency lighting can cause a disruption in\nservice.",
|
|
170
|
+
"severity": "low"
|
|
171
|
+
},
|
|
172
|
+
{
|
|
173
|
+
"id": "V-30987",
|
|
174
|
+
"title": "Environmental IA Controls - Voltage Control (power)\n",
|
|
175
|
+
"description": "Failure to use automatic voltage control can result in damage to the IT equipment creating a\nservice outage.",
|
|
176
|
+
"severity": "low"
|
|
177
|
+
},
|
|
178
|
+
{
|
|
179
|
+
"id": "V-30988",
|
|
180
|
+
"title": "Environmental IA Controls - Training\n",
|
|
181
|
+
"description": "If employees have not received training on the environmental controls they will not be able to\nrespond to a fluctuation of environmental conditions, which could damage equipment and ultimately disrupt operations.",
|
|
182
|
+
"severity": "low"
|
|
183
|
+
},
|
|
184
|
+
{
|
|
185
|
+
"id": "V-30989",
|
|
186
|
+
"title": "Environmental IA Controls - Temperature \n\n\n",
|
|
187
|
+
"description": "Lack of temperature controls can lead to fluctuations in temperature which could be potentially\nharmful to personnel or equipment operation.",
|
|
188
|
+
"severity": "low"
|
|
189
|
+
},
|
|
190
|
+
{
|
|
191
|
+
"id": "V-30990",
|
|
192
|
+
"title": "Environmental IA Controls - Humidity \n\n\n\n",
|
|
193
|
+
"description": "Fluctuations in humidity can be potentially harmful to personnel or equipment causing the loss of\nservices or productivity.",
|
|
194
|
+
"severity": "low"
|
|
195
|
+
},
|
|
196
|
+
{
|
|
197
|
+
"id": "V-30991",
|
|
198
|
+
"title": "Environmental IA Controls - Fire Inspections/ Discrepancies\n",
|
|
199
|
+
"description": "Failure to conduct fire inspections and correct any discrepancies could result in hazardous\nsituations leading to a possible fire and loss of service.",
|
|
200
|
+
"severity": "low"
|
|
201
|
+
},
|
|
202
|
+
{
|
|
203
|
+
"id": "V-30992",
|
|
204
|
+
"title": "Environmental IA Controls - Fire Detection and Suppression\n",
|
|
205
|
+
"description": "Failure to provide adequate fire detection and suppression could result in the loss of or damage to\ndata, equipment, facilities, or personnel.",
|
|
206
|
+
"severity": "low"
|
|
207
|
+
},
|
|
208
|
+
{
|
|
209
|
+
"id": "V-30993",
|
|
210
|
+
"title": "Industrial Security - DD Form 254\n",
|
|
211
|
+
"description": "Failure to complete a DD Form 254 (Contract Security Classification Specification) or to specify security clearance and/or IT requirements for all contracts that require access to classified material can result in unauthorized personnel having access to classified material or mission failure if personnel are not authorized the proper access.",
|
|
212
|
+
"severity": "medium"
|
|
213
|
+
},
|
|
214
|
+
{
|
|
215
|
+
"id": "V-30994",
|
|
216
|
+
"title": "Industrial Security - Contractor Visit Authorization Letters (VALs)\n",
|
|
217
|
+
"description": "Failure to require Visit Authorization Letters (VALs) for contractor visits could result in sensitive or classified materials being released to unauthorized personnel.",
|
|
218
|
+
"severity": "low"
|
|
219
|
+
},
|
|
220
|
+
{
|
|
221
|
+
"id": "V-30995",
|
|
222
|
+
"title": "Industrial Security - Contract Guard Vetting\n",
|
|
223
|
+
"description": "Failure to screen guards could result in employment of unsuitable personnel who are responsible\nfor the safety and security of DOD personnel and facilities.",
|
|
224
|
+
"severity": "medium"
|
|
225
|
+
},
|
|
226
|
+
{
|
|
227
|
+
"id": "V-30996",
|
|
228
|
+
"title": "Information Assurance - System Security Operating Procedures (SOPs)\n",
|
|
229
|
+
"description": "Failure to have documented procedures in an SOP could result in a security incident due to lack of\nknowledge by personnel assigned to the organization.",
|
|
230
|
+
"severity": "low"
|
|
231
|
+
},
|
|
232
|
+
{
|
|
233
|
+
"id": "V-30997",
|
|
234
|
+
"title": "Information Assurance - COOP Plan Testing (Not in Place for MAC I II Systems or Not Considered for MAC III Systems)\n\n",
|
|
235
|
+
"description": "Failure to develop a COOP and test it periodically can result in the partial or total loss of operations\nand INFOSEC. A contingency plan is necessary to reduce mission impact in the event of system\ncompromise or disaster.",
|
|
236
|
+
"severity": "medium"
|
|
237
|
+
},
|
|
238
|
+
{
|
|
239
|
+
"id": "V-31004",
|
|
240
|
+
"title": "Information Assurance - COOP Plan Testing (Incomplete)\n",
|
|
241
|
+
"description": "Failure to develop a COOP and test it periodically can result in the partial or total loss of operations\nand INFOSEC. A contingency plan is necessary to reduce mission impact in the event of system\ncompromise or disaster",
|
|
242
|
+
"severity": "low"
|
|
243
|
+
},
|
|
244
|
+
{
|
|
245
|
+
"id": "V-31008",
|
|
246
|
+
"title": "Information Assurance - System Security Incidents (Identifying, Reporting, and Handling)\n",
|
|
247
|
+
"description": "Failure to recognize, investigate and report information systems security incidents could result in\nthe loss of confidentiality, integrity, and availability of the systems and its data.",
|
|
248
|
+
"severity": "medium"
|
|
249
|
+
},
|
|
250
|
+
{
|
|
251
|
+
"id": "V-31011",
|
|
252
|
+
"title": "Information Assurance - System Access Control Records (DD Form 2875 or equivalent)\n\n",
|
|
253
|
+
"description": "If accurate records of authorized users are not maintained, then unauthorized personnel could have\naccess to the system. Failure to have user sign an agreement may preclude disciplinary actions if\nuser does not comply with security procedures",
|
|
254
|
+
"severity": "medium"
|
|
255
|
+
},
|
|
256
|
+
{
|
|
257
|
+
"id": "V-31013",
|
|
258
|
+
"title": "Information Assurance - System Training and Certification/ IA Personnel\n\n\n",
|
|
259
|
+
"description": "Improperly trained personnel can cause serious system-wide/network-wide problems that render\na system/network unstable.",
|
|
260
|
+
"severity": "medium"
|
|
261
|
+
},
|
|
262
|
+
{
|
|
263
|
+
"id": "V-31082",
|
|
264
|
+
"title": "Information Assurance - System Training /Users\n",
|
|
265
|
+
"description": "Improperly trained personnel can cause serious system-wide/network-wide problems that render\na system/network unstable.",
|
|
266
|
+
"severity": "medium"
|
|
267
|
+
},
|
|
268
|
+
{
|
|
269
|
+
"id": "V-31084",
|
|
270
|
+
"title": "Information Assurance - Accreditation Documentation\n",
|
|
271
|
+
"description": "Failure to provide the proper documentation can lead to a system connecting without all proper\nsafeguards in place, creating a threat to the networks.",
|
|
272
|
+
"severity": "medium"
|
|
273
|
+
},
|
|
274
|
+
{
|
|
275
|
+
"id": "V-31090",
|
|
276
|
+
"title": "Information Assurance - NIPRNET Connection Approval (CAP)\n",
|
|
277
|
+
"description": "Failure to meet security standards and have approval before connecting to the NIPRNET can result\nin a vulnerability to the DISN.",
|
|
278
|
+
"severity": "medium"
|
|
279
|
+
},
|
|
280
|
+
{
|
|
281
|
+
"id": "V-31091",
|
|
282
|
+
"title": "Information Assurance - SIPRNET Connection Approval Process (CAP)\n",
|
|
283
|
+
"description": "Failure to provide current connection documentation to the Classified Connection Approval Office (CCAO) and allowing a system to connect and operate without a current CCAO approval can result in a vulnerability to all SIPRNet connected systems on the DISN.",
|
|
284
|
+
"severity": "medium"
|
|
285
|
+
},
|
|
286
|
+
{
|
|
287
|
+
"id": "V-31115",
|
|
288
|
+
"title": "Information Assurance - KVM Switch not Approved by the Defense Security Accreditation Working Group (DSAWG)\n",
|
|
289
|
+
"description": "Failure to use approved switch boxes can result in the loss or compromise of classified information.\n",
|
|
290
|
+
"severity": "medium"
|
|
291
|
+
},
|
|
292
|
+
{
|
|
293
|
+
"id": "V-31124",
|
|
294
|
+
"title": "Information Assurance - KVM Switch (Port Separation) on CYBEX/Avocent 4 or 8 port \n",
|
|
295
|
+
"description": "The back plate of some 4 or 8 port CYBEX/AVOCENT KVM devices provides a physical connection between adjacent ports. Therefore failure to provide for physical port separation between SIPRNet (classified devices) and NIPRNet (unclassified devices) when using CYBEX/AVOCENT KVM devices can result in the loss or compromise of classified information.\n",
|
|
296
|
+
"severity": "medium"
|
|
297
|
+
},
|
|
298
|
+
{
|
|
299
|
+
"id": "V-31125",
|
|
300
|
+
"title": "Information Assurance - KVM Switch Use of Hot-Keys on SIPRNet Connected Devices\n",
|
|
301
|
+
"description": "Use of \"Hot Keys\" for switching between devices relies on use of software to separate and switch between the devices. Unless software use involves an approved Cross Domain Solution (CDS) it can result in the loss or compromise of classified information from low side devices to those devices on the high side. Only physical switching between devices can assure that information will not be exchanged.\n",
|
|
302
|
+
"severity": "medium"
|
|
303
|
+
},
|
|
304
|
+
{
|
|
305
|
+
"id": "V-31126",
|
|
306
|
+
"title": "Information Assurance - KVM Switch (Request for Approval ) Documentation is not Available\n\n\n",
|
|
307
|
+
"description": "Failure to request approval for connection of new or additional KVM devices (switch boxes) for use in switching betwee SIPRNet devices and unclassified devices (NIPRNet) from the Classified Connection Approval Office (CCAO) could result in unapproved devices being used or approved devices being used or configured in an unapproved manner; therby increasing the risk for the DISN.",
|
|
308
|
+
"severity": "low"
|
|
309
|
+
},
|
|
310
|
+
{
|
|
311
|
+
"id": "V-31127",
|
|
312
|
+
"title": "Information Assurance - Unauthorized Wireless Devices - Connected to the SIPRNet\n\n",
|
|
313
|
+
"description": "Finding unauthorized wireless devices connected and/or operating on the SIPRNet is a security incident and could directly result in the loss or compromise of classified or sensitive information either intentionally or accidentally. ",
|
|
314
|
+
"severity": "high"
|
|
315
|
+
},
|
|
316
|
+
{
|
|
317
|
+
"id": "V-31128",
|
|
318
|
+
"title": "Information Assurance - Unauthorized Wireless Devices - Portable Electronic Devices (PEDs) Used in Classified Processing Areas without Certified TEMPEST Technical Authority (CTTA) Review and Designated Accrediting Authority (DAA) Approval\n",
|
|
319
|
+
"description": "Allowing wireless devices in the vicinity of classified processing or discussion could directly result in\nthe loss or compromise of classified or sensitive information either intentionally or accidentally.",
|
|
320
|
+
"severity": "medium"
|
|
321
|
+
},
|
|
322
|
+
{
|
|
323
|
+
"id": "V-31129",
|
|
324
|
+
"title": "Information Assurance - Unauthorized Wireless Devices - No Formal Policy and/or Warning Signs\n",
|
|
325
|
+
"description": "Not having a wireless policy and/or warning signs at entrances could result in the unauthorized introduction of wireless devices into classified processing areas.",
|
|
326
|
+
"severity": "low"
|
|
327
|
+
},
|
|
328
|
+
{
|
|
329
|
+
"id": "V-31132",
|
|
330
|
+
"title": "Information Assurance - Network Connections - Physical Protection of Classified Network Devices such as Routers, Switches and Hubs (SIPRNet or Other Classified Networks or Systems Being Inspected)\n",
|
|
331
|
+
"description": "SIPRNet or other classified network connections that are not properly protected in their physical environment are highly vulnerable to unauthorized access, resulting in the probable loss or compromise of classified or sensitive information.\n",
|
|
332
|
+
"severity": "high"
|
|
333
|
+
},
|
|
334
|
+
{
|
|
335
|
+
"id": "V-31171",
|
|
336
|
+
"title": "Information Assurance - Network Connections - Wall Jack Security on Classified Networks (SIPRNet or other Inspected Classified Network or System) Where Port Authentication Using IEEE 802.1X IS NOT Implemented\n",
|
|
337
|
+
"description": "Network connections that are not properly protected are highly vulnerable to unauthorized access,\nresulting in the loss or compromise of classified or sensitive information.\n",
|
|
338
|
+
"severity": "high"
|
|
339
|
+
},
|
|
340
|
+
{
|
|
341
|
+
"id": "V-31190",
|
|
342
|
+
"title": "Information Assurance - Network Connections - Physical Protection of Unclassified (NIPRNet) Network Devices such as Routers, Switches and Hubs \n\n",
|
|
343
|
+
"description": "Unclassified (NIPRNet) network connections that are not properly protected in their physical environment are highly vulnerable to unauthorized access, resulting in the probable loss or compromise of sensitive information such as personally identifiable information (PII) or For Official Use Only (FOUO).\n\n\n\n",
|
|
344
|
+
"severity": "medium"
|
|
345
|
+
},
|
|
346
|
+
{
|
|
347
|
+
"id": "V-31199",
|
|
348
|
+
"title": "Foreign National System Access - Local Access Control Procedures\n",
|
|
349
|
+
"description": "Unauthorized access by foreign nationals to Information Systems can result in, among other things, security incidents, compromise of the system, or the introduction of a virus.\n",
|
|
350
|
+
"severity": "low"
|
|
351
|
+
},
|
|
352
|
+
{
|
|
353
|
+
"id": "V-31210",
|
|
354
|
+
"title": "Foreign National System Access - Identification as FN in E-mail Address\n",
|
|
355
|
+
"description": "Unauthorized access by foreign nationals to Information Systems can result in, among other things,\nsecurity incidents, compromise of the system, or the introduction of a virus.",
|
|
356
|
+
"severity": "medium"
|
|
357
|
+
},
|
|
358
|
+
{
|
|
359
|
+
"id": "V-31211",
|
|
360
|
+
"title": "Foreign National (FN) Systems Access - Local Nationals Overseas System Access - (NIPRNet User)\n",
|
|
361
|
+
"description": "Failure to subject foreign nationals to background checks could result in the loss or compromise of\nclassified or sensitive information by foreign sources.\n",
|
|
362
|
+
"severity": "medium"
|
|
363
|
+
},
|
|
364
|
+
{
|
|
365
|
+
"id": "V-31215",
|
|
366
|
+
"title": "Foreign National (FN) Systems Access - Local Nationals Overseas System Access - (SIPRNet or Other Classified System or Classified Network being Reviewed)\n\n",
|
|
367
|
+
"description": "Failure to subject foreign nationals to background checks could result in the loss or compromise of\nclassified or sensitive information by foreign sources.",
|
|
368
|
+
"severity": "high"
|
|
369
|
+
},
|
|
370
|
+
{
|
|
371
|
+
"id": "V-31221",
|
|
372
|
+
"title": "Foreign National (FN) Systems Access - Local Nationals (LN) Overseas System Access - Vetting for Privileged Access\n\n",
|
|
373
|
+
"description": "Failure to subject foreign nationals to background checks could result in the loss or compromise of\nclassified or sensitive information by foreign sources.",
|
|
374
|
+
"severity": "high"
|
|
375
|
+
},
|
|
376
|
+
{
|
|
377
|
+
"id": "V-31223",
|
|
378
|
+
"title": "Foreign National (FN) Systems Access - Delegation of Disclosure Authority Letter (DDL)\n",
|
|
379
|
+
"description": "Unauthorized access by foreign nationals to Information Systems can result in, among other things, security incidents, compromise of the system, or the introduction of a virus.\n",
|
|
380
|
+
"severity": "medium"
|
|
381
|
+
},
|
|
382
|
+
{
|
|
383
|
+
"id": "V-31225",
|
|
384
|
+
"title": "Foreign National System Access - FN or Immigrant Aliens (not representing a foreign government or entity) System Access - Limited Access Authorization (LAA)\n",
|
|
385
|
+
"description": "Failure to verify citizenship and proper authorization for access to either sensitive or classified information could enable personnel to have access to classified or sensitive information to which they are not entitled.",
|
|
386
|
+
"severity": "high"
|
|
387
|
+
},
|
|
388
|
+
{
|
|
389
|
+
"id": "V-31227",
|
|
390
|
+
"title": "Foreign National (FN) System Access - FN or Immigrant Aliens (not representing a foreign government or entity) with LAA Granted Uncontrolled Access\n",
|
|
391
|
+
"description": "Failure to verify citizenship and proper authorization for access to either sensitive or classified information could enable personnel to have access to classified or sensitive information to which they are not entitled. Further uncontrolled/unsupervised access to physical facilities can lead directly to unauthorized access to classified or sensitive information.",
|
|
392
|
+
"severity": "high"
|
|
393
|
+
},
|
|
394
|
+
{
|
|
395
|
+
"id": "V-31242",
|
|
396
|
+
"title": "Foreign National (FN) Physical Access Control - Areas Containing US Only Information Systems Workstations/Monitor Screens, Equipment, Media or Documents",
|
|
397
|
+
"description": "Physically co-locating REL Partners or other FN - who have limited or no access to the SIPRNet or other US Classified systems - near US personnel in a collateral classified (Secret or higher) open storage area or in a Secret or higher Controlled Access Area (CAA) that processes classified material is permissible for operational efficiency and coordination.\n\nFailure to limit and control physical access to information visible on system monitor screens, information processing equipment containing classified data, removable storage media and printed documents is especially important in mixed US/FN environments. Inadequate access and procedural controls can result in FN personnel having unauthorized access to classified materials and data, which can result in the loss or compromise of classified information, including NOFORN information. \n \nAppropriate but simple physical and procedural security measures must be put in place to ensure the FN partners do not have unauthorized access to information not approved for release to them. \n\nThe primary control measure is to either keep US Only classified documents, information systems equipment and/ or associated removable storage media under continuous observation and control of a cleared US employee or place such items in an approved safe when unattended.\n\nAdditionally, escorting visitors AND all FN employees/personnel into any area where there is US Only classified processing, documents, media, equipment or materials is not only a prudent security measure but an absolute requirement to prevent both intentional (insider threat) or unintentional (inadvertent) unauthorized exposure to classified materials and information.\n \nFollowing are applicable excerpts from CJCSI 6510.01F pertaining to control of US Only workstation spaces (in particular SCIFs and secure rooms):\n\n7. Information and Information System Access. Access to DOD ISs is a revocable privilege and shall be granted to individuals based on need-to-know and IAW DODI 8500.2, NSTISSP No. 200, “National Policy on Controlled Access Protection” , Status of Forces Agreements for host national access, and DOD 5200.2-R, “Personnel Security System”.\nb. Individual foreign nationals may be granted access to specific classified U.S. networks and systems as specifically authorized under Information Sharing guidance outlined in changes to National Disclosure Policy (NDP-1). \n(1) Classified ISs shall be sanitized or configured to guarantee that foreign nationals have access only to classified information that has been authorized for disclosure to the foreign national’s government or coalition, and is necessary to fulfill the terms of their assignments.\n(2) U.S.-only classified workstations shall be under strict U.S. control at all times.\n27. Foreign Access.\nf. Foreign National Access to U.S.-Only Workstations and Network Equipment. CC/S/As shall:\n(1) Maintain strict U.S. control of U.S.-only workstations and network equipment at all times.\n(4) Announce presence. If a foreign national is permitted access to U.S.-controlled workstation space, the individual must be announced, must wear a badge clearly identifying him or her as a foreign national, and must be escorted at all times. In addition, a warning light must be activated if available and screens must be covered or blanked.\n",
|
|
398
|
+
"severity": "high"
|
|
399
|
+
},
|
|
400
|
+
{
|
|
401
|
+
"id": "V-31243",
|
|
402
|
+
"title": "Foreign National (FN) Physical Access Control - (Identification Badges)\n\n",
|
|
403
|
+
"description": "Failure to limit access to information visible on system monitor screens in mixed US/FN environments can result in FN personnel having unauthorized access to classified information, which can result in the loss or compromise of classified information, including NOFORN information. Physically co-locating REL Partners or other FN - who have limited access to the SIPRNet or other US Classified systems - near US personnel in a collateral classified (Secret) open storage area or in a Secret Controlled Access Area (CAA) that processes classified material is permissible for operational efficiency and coordination. Appropriate but simple physical and procedural security measures must be put in place to ensure the FN partners do not have unauthorized access to information not approved for release to them. Ensuring that US employees can clearly identify FN workers is an important control measure and can be accomplished by requiring the FN employees or partners to wear picture identification badges that clearly identify their affiliated / represented Country. Wearing of Country specific military uniforms also can be used.",
|
|
404
|
+
"severity": "low"
|
|
405
|
+
},
|
|
406
|
+
{
|
|
407
|
+
"id": "V-31262",
|
|
408
|
+
"title": "Foreign National (FN) Administrative Controls - Contact Officer Appointment\n",
|
|
409
|
+
"description": "Failure to provide proper oversight of Foreign National partners or employees and limit access to classified and sensitive information can result in the loss or compromise of NOFORN information.\n",
|
|
410
|
+
"severity": "low"
|
|
411
|
+
},
|
|
412
|
+
{
|
|
413
|
+
"id": "V-31263",
|
|
414
|
+
"title": "Foreign National (FN) Administrative Controls - Written Procedures and Employee Training\n\n",
|
|
415
|
+
"description": "Failure to limit access for Foreign Nationals to classified information can result in the loss or compromise of NOFORN information. Documented local policies and procedures concerning what information FN employees or partners have access to and what they are excluded from having, what physical access limitations and allowances are in place, how to recognize a FN (badges, uniforms, etc.), steps to take to sanitize a work area before a FN can access the area, etc. are an essential part of controlling FN access. Just as important as development of policy and procedure is the training/familiarization of both employees and assigned FNs with the rules of interaction.\n",
|
|
416
|
+
"severity": "medium"
|
|
417
|
+
},
|
|
418
|
+
{
|
|
419
|
+
"id": "V-31264",
|
|
420
|
+
"title": "Foreign National (FN) Administrative Controls - Proper Investigation and Clearance for Access to Classified Systems and/or Information Assurance (IA) Positions of Trust\n\n",
|
|
421
|
+
"description": "Failure to validate that FN partners or employees have the required security clearance levels for access to classified systems and/or the proper level of background investigation for IA Positions of Trust could result in untrustworthy Foreign Nationals having access to classified or sensitive US systems. In situations where they have been assigned to IA positions of trust this consideration becomes even more critical as they could adversely impact the CIA of the systems, possibly without being easily discovered. ",
|
|
422
|
+
"severity": "high"
|
|
423
|
+
},
|
|
424
|
+
{
|
|
425
|
+
"id": "V-31265",
|
|
426
|
+
"title": "Foreign National (FN) Administrative Controls - Procedures for Requests to Provide Foreign Nationals System Access\n\n",
|
|
427
|
+
"description": "Unauthorized access by foreign nationals to Information Systems can result in, among other things,\nsecurity incidents, compromise of the system, or the introduction of a virus.\n",
|
|
428
|
+
"severity": "medium"
|
|
429
|
+
},
|
|
430
|
+
{
|
|
431
|
+
"id": "V-31266",
|
|
432
|
+
"title": "Information Security (INFOSEC) - Safe/Vault/Secure Room Management\n\n",
|
|
433
|
+
"description": "Lack of adequate or Improper procedures for management of safes/vaults and secure rooms could result in the loss or compromise of classified material.",
|
|
434
|
+
"severity": "medium"
|
|
435
|
+
},
|
|
436
|
+
{
|
|
437
|
+
"id": "V-31267",
|
|
438
|
+
"title": "Information Security (INFOSEC) - Vault/Secure Room Storage Standards - Door Combination Lock Meeting Federal Specification FF-L-2740",
|
|
439
|
+
"description": "Failure to meet Physical Security storage standards could result in the undetected loss or compromise of classified material.",
|
|
440
|
+
"severity": "high"
|
|
441
|
+
},
|
|
442
|
+
{
|
|
443
|
+
"id": "V-31268",
|
|
444
|
+
"title": "Information Security (INFOSEC) - Secure Room Storage Standards - Door Construction \n\n",
|
|
445
|
+
"description": "Failure to meet construction standards could result in the undetected loss or compromise of classified material.",
|
|
446
|
+
"severity": "high"
|
|
447
|
+
},
|
|
448
|
+
{
|
|
449
|
+
"id": "V-31269",
|
|
450
|
+
"title": "Information Security (INFOSEC) - Secure Room Storage Standards - Perimeter Construction using Proper Permanent Construction Materials for True Ceiling, Walls and Floors. \n\n",
|
|
451
|
+
"description": "Failure to meet standards for ensuring that there is structural integrity of the physical Perimeter surrounding a secure room (AKA: collateral classified open storage area) could result in a lack of structural integrity and the undetected loss or compromise of classified material. Permanent construction materials; while not impenetrable, provide physical evidence of an attempted or actual intrusion into a secure room space. Construction materials and application techniques that are not permanent in nature can potentially be removed to allow for access to secure room space and then replaced by an intruder upon egress from the area. This effectively negates the detection capability afforded by permanent construction techniques and materials. Examples of non-permanent material would be modular walls that can be removed and replaced with ease or plywood board (or other materials) applied with screws or nails that can be removed from outside the secure room space and then replaced with standard tools.",
|
|
452
|
+
"severity": "medium"
|
|
453
|
+
},
|
|
454
|
+
{
|
|
455
|
+
"id": "V-31270",
|
|
456
|
+
"title": "Information Security (INFOSEC) - Secure Room Storage Standards Wall and Ceiling Structural Integrity (AKA: True Floor to True Ceiling Connection)\n\n",
|
|
457
|
+
"description": "Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DoD Manual 5200.01, Volume 3, Enclosure 3 could result in the undetected loss or compromise of classified material.",
|
|
458
|
+
"severity": "high"
|
|
459
|
+
},
|
|
460
|
+
{
|
|
461
|
+
"id": "V-31271",
|
|
462
|
+
"title": "Information Security (INFOSEC) - Vault/Secure Room Storage Standards - Openings in Perimeter Exceeding 96 Square Inches\n",
|
|
463
|
+
"description": "Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a vault or secure room (AKA: collateral classified open storage area) IAW DoD Manual 5200.01, Volume 3, Enclosure 3 could result in the undetected loss or compromise of classified material.",
|
|
464
|
+
"severity": "high"
|
|
465
|
+
},
|
|
466
|
+
{
|
|
467
|
+
"id": "V-31272",
|
|
468
|
+
"title": "Information Security (INFOSEC) - Secure Room Storage Standards Windows - Accessible from the Ground Hardened Against Forced Entry and Shielded from Exterior Viewing of Classified Materials Contained within the Area.\n\n",
|
|
469
|
+
"description": "Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DoD Manual 5200.01, Volume 3 could result in the undetected loss or compromise of classified material.\n",
|
|
470
|
+
"severity": "high"
|
|
471
|
+
},
|
|
472
|
+
{
|
|
473
|
+
"id": "V-31273",
|
|
474
|
+
"title": "Information Security (INFOSEC) - Vault Storage/Construction Standards \n\n",
|
|
475
|
+
"description": "Failure to meet standards IAW the DoD Manual 5200.01, Volume 3, Appendix to Enclosure 3, for ensuring that there is required structural integrity of the physical perimeter surrounding a classified storage vault could result in the undetected loss or compromise of classified material.\n",
|
|
476
|
+
"severity": "high"
|
|
477
|
+
},
|
|
478
|
+
{
|
|
479
|
+
"id": "V-31274",
|
|
480
|
+
"title": "Information Security (INFOSEC) - Secure Room Storage Standards - Intrusion Detection System (IDS)\n",
|
|
481
|
+
"description": "Failure to meet standards for maintenance and validation of structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DoD Manual 5200.01, Volume 3, could result in the undetected loss or compromise of classified material. Using a physical intrusion detection system enables immediate detection of attempted and/or actual intrusion into a secure room space. This is often the best supplemental protective measure (vice using 4-hour random checks) due to providing capability for immediate detection, and for immediate response to assess and counter the threat to the secure room space. Use of 4-hour checks may be adequate if supported by a risk assessment, but will not provide the immediate detection and response capability of a properly installed IDS. It is required that a risk assessment be conducted to determine which of these two intrusion detection methods (use of IDS OR 4-hour random checks) is appropriate for any particular location.",
|
|
482
|
+
"severity": "high"
|
|
483
|
+
},
|
|
484
|
+
{
|
|
485
|
+
"id": "V-31275",
|
|
486
|
+
"title": "Information Security (INFOSEC) - Secure Room Storage Standards - Balanced Magnetic Switch (BMS) on Perimeter Doors\n\n",
|
|
487
|
+
"description": "Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DoD Manual 5200.01, Volume 3 could result in the undetected loss or compromise of classified material. When a physical Intrusion Detection System (IDS) is used as the supplemental protection measure (in lieu of 4-hour random checks) for secure rooms there is a requirement to place a Balanced Magnetic Switch (BMS) alarm contact on the primary ingress/egress door and any secondary/emergency exit doors. This alarm sensor is an essential part of any properly installed IDS and ensures that doors opened by force or that are left open are immediately detected. A BMS (AKA: triple biased alarm contact) is the most difficult door alarm contact to defeat and must be used in lieu of dual biased or simple alarm contacts.",
|
|
488
|
+
"severity": "high"
|
|
489
|
+
},
|
|
490
|
+
{
|
|
491
|
+
"id": "V-31276",
|
|
492
|
+
"title": "Information Security (INFOSEC) - Secure Room Storage Standards - Interior Motion Detection\n",
|
|
493
|
+
"description": "Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DoD Manual 5200.01, Volume 3 could result in the undetected loss or compromise of classified material. Motion detection located interior to secure rooms provides the most complete/overarching coverage of any Intrusion Detection System (IDS) alarm sensor. While most sensors like BMS alarm contacts, glass break detectors, etc. are only able to detect potential intrusion at specific locations, use of motion detection provides a capability to protect large areas with \"blanket coverage\" generally using fewer sensors. This capability need not cover the entire secure room space (although that would be best) but can be used effectively by placement directly over the protected assets or in hallways or other restricted passage ways leading to classified/sensitive assets. Consolidating classified information system assets in specific spaces within secure rooms enables a more efficient use of motion detectors and ensures the most critical assets are properly protected.\n\n",
|
|
494
|
+
"severity": "high"
|
|
495
|
+
},
|
|
496
|
+
{
|
|
497
|
+
"id": "V-31277",
|
|
498
|
+
"title": "Information Security (INFOSEC) - Secure Room Storage Standards - Structural Integrity Checks\n",
|
|
499
|
+
"description": "Failure to ensure that there is structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DoD Manual 5200.01, Volume 3 could result in the undetected loss or compromise of classified material.\n",
|
|
500
|
+
"severity": "medium"
|
|
501
|
+
},
|
|
502
|
+
{
|
|
503
|
+
"id": "V-31278",
|
|
504
|
+
"title": "Information Security (INFOSEC) - Secure Room Storage Standards - Four (4) Hour Random Checks in Lieu of Using Intrusion Detection System (IDS)\n\n",
|
|
505
|
+
"description": "Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DoD Manual 5200.01, Volume 3 could result in the undetected loss or compromise of classified material.\n\nUsing a physical intrusion detection system enables immediate detection of attempted and/or actual intrusion into a secure room space. This is often the best supplemental protective measure (vice using 4-hour random checks) due to providing capability for immediate detection, and for immediate response to assess and counter the threat to the secure room space. Use of 4-hour checks may be adequate if supported by a risk assessment, but will not provide the immediate detection and response capability of a properly installed IDS. It is required that a risk assessment be conducted to determine which of these two intrusion detection methods (use of IDS OR 4-hour random checks) is appropriate for any particular location. If the risk assessment results in a determination that use of 4-hour random checks is the most cost efficient supplemental control (vice IDS) to protect SIPRNet assets contained in secure rooms, the manner in which the checks are conducted can greatly impact the effectiveness of the checks. Thorough physical checks conducted on a frequent basis can reduce the time between an attempted or actual intrusion and time of discovery - during random checks. \n",
|
|
506
|
+
"severity": "high"
|
|
507
|
+
},
|
|
508
|
+
{
|
|
509
|
+
"id": "V-31279",
|
|
510
|
+
"title": "Vault/Secure Room Storage Standards - IDS Performance Verification\n\n",
|
|
511
|
+
"description": "Failure to test IDS functionality on a periodic basis could result in undetected alarm sensor or other system failure. This in-turn could result in an undetected intrusion into a secure room (AKA: collateral classified open storage area) and the undetected loss or compromise of classified material.\n\n\n\nmeet standards for ensuring that there is structural integrity of the physical perimeter surrounding a secure room",
|
|
512
|
+
"severity": "medium"
|
|
513
|
+
},
|
|
514
|
+
{
|
|
515
|
+
"id": "V-31284",
|
|
516
|
+
"title": "Vault/Secure Room Storage Standards - IDS Transmission Line Security\n\n",
|
|
517
|
+
"description": "Failure to meet standards for ensuring integrity of the intrusion detection system signal transmission supporting a secure room (AKA: collateral classified open storage area) containing SIPRNet assets could result in the undetected loss or compromise of classified material.\n",
|
|
518
|
+
"severity": "high"
|
|
519
|
+
},
|
|
520
|
+
{
|
|
521
|
+
"id": "V-31286",
|
|
522
|
+
"title": "Vault/Secure Room Storage Standards - Masking of IDS Sensors Displayed at the Intrusion Detection System (IDS) Monitoirng Station\n\n",
|
|
523
|
+
"description": "Failure to meet standards for the display of masked alarm sensors at the IDS monitoring station could result in the location with masked or inactive sensors not being properly supervised. This could result in an undetected breach of a secure room perimeter and the undetected loss or compromise of classified material.\n",
|
|
524
|
+
"severity": "medium"
|
|
525
|
+
},
|
|
526
|
+
{
|
|
527
|
+
"id": "V-31289",
|
|
528
|
+
"title": "Vault/Secure Room Storage Standards - IDS Alarm Monitoring Indicators, both audible and visual (Alarm Status) must be displayed for each sensor or alarmed zone at the monitoring station.\n\n",
|
|
529
|
+
"description": "Failure to meet standards for the display of audible and visual alarm indicators at the IDS monitoring station could result in an a sensor going into alarm state and not being immediately detected. This could result in an undetected or delayed discovery of a secure room perimeter breach and the loss or compromise of classified material.\n",
|
|
530
|
+
"severity": "medium"
|
|
531
|
+
},
|
|
532
|
+
{
|
|
533
|
+
"id": "V-31290",
|
|
534
|
+
"title": "Vault/Secure Room Storage Standards - Intrusion Detection System (IDS) / Access Control System (ACS) Primary and Emergency Power Supply\n\n",
|
|
535
|
+
"description": "Failure to meet standards for ensuring that there is an adequate commercial and back-up power sources for IDS/ACS with uninterrupted failover to emergency power could result in a malfunctionof the physical alarm and access control system. This could result in the undetected breach of classified open storage / secure rooms or vaults containing SIPRNet assets and undetected loss or compromise of classified material.\n",
|
|
536
|
+
"severity": "medium"
|
|
537
|
+
},
|
|
538
|
+
{
|
|
539
|
+
"id": "V-31291",
|
|
540
|
+
"title": "Vault/Secure Room Storage Standards - Intrusion Detection System and Access Control System (IDS/ACS) Component Tamper Protection\n\n",
|
|
541
|
+
"description": "Failure to tamper protect IDS/ACS component enclosures and access points external to protected vaults/secure rooms space could result in the undetected modification or disabling of IDS/ACS system components. This could lead to the undetected breach of secure space containing SIPRNet assets and result in the undetected loss or compromise of classified information or materials.\n\n",
|
|
542
|
+
"severity": "medium"
|
|
543
|
+
},
|
|
544
|
+
{
|
|
545
|
+
"id": "V-31292",
|
|
546
|
+
"title": "Vault/Secure Room Storage Standards - IDS Access/Secure Control Units Must be Located within the Secure Room Space\n\n",
|
|
547
|
+
"description": "Failure to ensure that IDS Access and Secure Control Units used to activate and deactivate alarms (primarily motion detectors) within vaults or secure rooms protecting SIPRNet assets are not located within the confines of the vault or secure room near the primary ingress/egress door could result in the observation of the access/secure code by an unauthorized person. Further the control units would be more exposed with a greater possibility of tampering outside the more highly protected space of a secure room/collateral classified open storage area. This could result in the undetected breach of secure room space and the loss or compromise of classified information or materials.\n\n",
|
|
548
|
+
"severity": "high"
|
|
549
|
+
},
|
|
550
|
+
{
|
|
551
|
+
"id": "V-31293",
|
|
552
|
+
"title": "Vault/Secure Room Storage Standards - Primary IDS Monitoring Location Outside the \"Monitored\" Space\n\n",
|
|
553
|
+
"description": "Failure to locate the alarm monitoring station at an external location; at a safe distance from the space being monitored to not be involved in any surprise attack of the alarmed space could result in a perimeter breach and the loss or compromise of classified material with limited or no capability to immediately notify response forces.",
|
|
554
|
+
"severity": "medium"
|
|
555
|
+
},
|
|
556
|
+
{
|
|
557
|
+
"id": "V-31294",
|
|
558
|
+
"title": "Information Security (IS) - Continuous Operations Facility: Access Control Monitoring Methods\n",
|
|
559
|
+
"description": "Failure to control door access to a Continuous Operations Facility containing classified SIPRNET assets may result in immediate and potentially undetected access to classified information, with no capability to immediately alert response forces. Ultimately this could result in the undetected loss or compromise of classified material.\n\nUSE CASE EXPLANATION:\n\nA Continuous Operations Facility functions 24/7 and contains classified SIPRNet equipment and/or media that does not meet all the physical and procedural requirements of a vault or secure room (AKA: collateral classified open storage area) and the classified equipment and/or media may not be stored in an approved safe when not in use. Examples of such facilities are Emergency Operations Centers (EOC), Information System Monitoring Centers, Trouble Desk Centers, etc. All standards for Continuous Operations Facilities are found in the DoD Manual 5200.01, V3 and this STIG Requirement provides additional clarification and implementation standards for all Continuous Operations Facilities containing SIPRNet assets.\n\nContinuous Operations Facilities are not routinely closed and secured after normal business hours and reopened at the beginning of normal workdays. A Continuous Operations Facility is either continuously occupied or receives frequent access (several times during an 8 hour shift). A “facility” can be a single room or a larger contiguous area, usually (but not always) without Federal Specification FF-L-2740 combination locks on the primary access door. Continuous Operations area access must meet the requirements herein even where the surrounding area is continuously occupied. Continuous Operations minimizes or eliminates the need for certain other security measures such as door locks, IDS, etc.\n\nWhere there is a Continuous Operations Facility there should be demonstrated need for continuous occupation or frequent access to the “specific” room or area containing the classified SIPRNet assets. A justification that the surrounding building or facility is continuously occupied is not acceptable. If this is observed, reviewers should consider the possibility that the stated requirement for a Continuous Operations Facility is being used to cover deficiencies with what should legitimately be established as a secure room or vault. In such cases the use of Traditional Security STIG Requirements and applicable standards for vaults and/or secure rooms may be more appropriate, resulting in findings under those Requirements.\n\nA Continuous Operations Facility containing classified materials is most appropriate when it is continuously occupied by properly cleared employees (or others with security clearance and a need-to-know) who are capable of controlling or monitoring ingress and egress from within the area. This provides the most legitimate justification for using a Continuous Operations Facility vice using a properly constructed and access controlled vault or secure room (AKA: collateral classified open storage area).\n\nAlternatively (and less desirable from a security perspective) the area may not be continuously occupied but access is required on a very frequent basis by cleared employees. The frequency of access makes opening and closing of the area impractical. So while there is not an absolute rule, if such a room or area is not routinely accessed for operational reasons several times during a standard 8-hour shift the justification for not constructing and securing it in accordance with requirements for a secure room or vault is unacceptable. Convenience and ease of access is not proper justification for a Continuous Operations Facility.\n\nContinuous Operations area door control may be accomplished multiple ways. The five main types of access control methods are listed below. One or more of the five methods may apply to any site. Each access point must comply with one or more of the methods of access control for 24 hours of each day. Any deficiency for any area access point or for a portion of the day for an access point will result in a finding under this item. All Continuous Operations Facilities access points should be checked for proper access control according to the type of access control methods implemented.\nDirect access control monitoring for both occupied and unoccupied Continuous Operations Facilities is conducted by: cleared employees, guards or receptionists located inside the area or directly outside the area. A properly configured Automated Entry Control System (AECS) or continuously monitored Closed Circuit Television (CCTV) are the only options for indirect monitoring of Continuous Operations Facilities.\n\nThe five basic methods for controlling access to Continuous Operations Facilities are:\n\n1. Method #1: Use of an Automated Entry Control System (AECS) Card Reader with Biometrics or Personal Identification Number (PIN)\n\n2. Method #2: Access Continually Monitored by Occupants (Cleared Employees) of the Continuous Operations Facility - all doors NOT visible\n\n3. Method #3: Access Monitored by Occupants (Cleared Employees) of the Continuous Operations Facility - all doors are visible\n\n4. Method #4: Access Monitored by Employees Directly Outside the Open Storage Space - all doors MUST BE visible\n\n5. Method #5: Access Monitored by Closed Circuit Television (CCTV) reporting to a Central Monitoring Station Staffed 24/7 by cleared Guards or Other cleared Security Professionals - all doors MUST HAVE CCTV cameras\n\nNormally only one method of access control will be applicable to a specific Continuous Operations Facility; however, there may be situations where more than one approved method is being used at a single facility. For instance an Automated Entry Control System (AECS) with card reader and PIN may be used to secure the access door while there are also employees located inside the room who can monitor and control access. In situations where multiple methods are found, reviewers should choose only one of the five to evaluate compliance and the effectiveness of access control to the Continuous Operations Facility. If one of the methods is found to be totally compliant while others in use contain deficiencies, the method that is 100% compliant should be selected for use during the review. In the example just provided, if the room is only occupied by one employee who during breaks or for other reasons must exit the room for periods of time this would cause a significant deficient condition since the room is not continuously occupied by an employee. Therefore using the AECS as the method to evaluate access control for the Continuous Operations Facility would likely be selected since it appears to be (and for this example we will assume) 100% compliant.\n\nThere is also a possibility that multiple Continuous Operations Facilities could be found at a particular site location (even in the same building) that are using different methods to control access. Once again, multiple methods of access control from the list of five could be selected for the evaluation, based on the access control methods actually being used for the various 24/7Continuous Operations Facilities.\n\nOnce the applicable Continuous Operations Facility access control methods that apply to each of the Continuous Operations Facilities at the site are selected, the site must comply with all of the individual checks for the selected method(s). Specific checks for requirements associated with a method of access control are found in the Check Content information field.\n\nIf there is no Continuous Operations Facility at a particular site this Requirement is Not Applicable (NA) for a review.\n\n",
|
|
560
|
+
"severity": "high"
|
|
561
|
+
},
|
|
562
|
+
{
|
|
563
|
+
"id": "V-31529",
|
|
564
|
+
"title": "Vault/Secure Room Storage Standards - Access Control During Working Hours Using Visual Control OR Automated ACS with PIN / Biometrics: \n\n",
|
|
565
|
+
"description": "Failure to properly monitor and control collateral classified open storage area access doors during working hours (while the FF-L-2740 combination lock is not secured) could result in an undetected perimeter breach and limited or no capability to immediately notify response forces. Ultimately this could result in the undetected loss or compromise of classified material.\n\nEntrances to secure rooms or areas (and/or vaults that are opened for access) must be under visual control at all times during duty hours to prevent entry by unauthorized personnel . This may be accomplished by several methods (e.g., employee work station, guard, continuously monitored CCTV). \n\nAn automated entry control system (AECS) may be used to control admittance during working hours instead of visual control, if it meets certain criteria. ",
|
|
566
|
+
"severity": "high"
|
|
567
|
+
},
|
|
568
|
+
{
|
|
569
|
+
"id": "V-31548",
|
|
570
|
+
"title": "Vault/Secure Room Storage Standards - Access Control System Records Maintenance, which includes documented procedures for removal of access. ",
|
|
571
|
+
"description": "Failure to document procedures for removal of access and inadequate maintenance of access records for both active and removed persons could result in unauthorized persons having unescorted access to vaults, secure rooms or collateral classified open storage areas where classified information is processed and stored. \n\n",
|
|
572
|
+
"severity": "medium"
|
|
573
|
+
},
|
|
574
|
+
{
|
|
575
|
+
"id": "V-31549",
|
|
576
|
+
"title": "Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) and Intrusion Detection System (IDS) Head-End Equipment Protection: \n \nThe physical location (room or area) containing AECS and IDS head-end equipment (server and/or work station/monitoring equipment) where authorization, personal identification or verification data is input, stored, or recorded and/or where system status/alarms are monitored must be physically protected.",
|
|
577
|
+
"description": "Inadequate physical protection of Intrusion Detection System or Automated Entry Control System servers, data base storage drives, or monitoring work stations could result in unauthorized access to core system devices providing protection for classified vaults, secure rooms and collaterial classified open storage areas. This could result in the loss of confidentiality, integrity or availability of system functionality or data. The impact of this would be possible undetected and unauthorized access to classified processing spaces; resulting in the loss or compromise of classified information or sensitive information such as personal data (PII) of persons issued access control cards or badges.",
|
|
578
|
+
"severity": "high"
|
|
579
|
+
},
|
|
580
|
+
{
|
|
581
|
+
"id": "V-31657",
|
|
582
|
+
"title": "Vault/Secure Room Storage Standards - Access Control System Keypad Device Protection:\nKeypad devices designed or installed in a manner that an unauthorized person in the immediate vicinity cannot observe the selection of input numbers. ",
|
|
583
|
+
"description": "If someone were to sucessfully observe an authorized user's selection of numbers for their PIN at an entrance to a classified storage area or unclassified but sensitive computer room it could result in an unauthorized person being able touse that same PIN to gain access. Where purely electronic (cipher type) locks are used without an access card or badge this could lead to direct access by anunauthorized person. Where coded Access Control System cards and badges are used the risk is deminished significantly as the coded badge associated with the PIN would need to be lost/stolen and subsequently recovered by someone with unauthorized knowledge of the PIN for them to be able to successfully gain access to the secured area.",
|
|
584
|
+
"severity": "low"
|
|
585
|
+
},
|
|
586
|
+
{
|
|
587
|
+
"id": "V-31897",
|
|
588
|
+
"title": "Vault/Secure Room Storage Standards - Access Control System (ACS) Transmission Line Security: \nACS Transmission lines traversing an uncontrolled area (not within at least a Secret Controlled Access Area (CAA) ) shall use line supervision and be physically protected within conduit.\n\n",
|
|
589
|
+
"description": "Persons not vetted to at least the same level of classification residing on the information systems being protected by the ACS could gain access to the ACS transmission line and tamper with it to facilitate surreptitious access to the secure space. Proper line supervision and physical protection within conduit will enable detection of line tampering. Such failure to meet standards for line supervision and physical protection could result in the loss or compromise of classified material.",
|
|
590
|
+
"severity": "medium"
|
|
591
|
+
},
|
|
592
|
+
{
|
|
593
|
+
"id": "V-31908",
|
|
594
|
+
"title": "\nVault/Secure Room Storage Standards - Access Control System (ACS) Door Locks: Electric Strikes and/or Magnetic Locking devices used in access control systems shall be heavy duty, industrial grade and be configured to fail secure in the event of a total loss of power (primary and backup) . \n\n",
|
|
595
|
+
"description": "There are a variety of locking mechanisms that may be used to secure both primary and secondary doors for vaults and classified open storage areas (secure rooms). While the primary access door is to be secured with an appropriate combination lock when closed; during working hours Automated Access Control Systems (ACS) using electric strikes or magnetic locks, electrical, mechanical, or electromechanical access control devices, or standard keyed locks may be used to facilitate frequent access to the secured space by employees vetted for unescorted access. Where electrically actuated locks are used, locking mechanisms must be properly configured and controlled to ensure they fail in a secure state during partial or total loss of power (primary and backup). Failure to provide for these considerations could result in the loss or compromise of classified material.",
|
|
596
|
+
"severity": "medium"
|
|
597
|
+
},
|
|
598
|
+
{
|
|
599
|
+
"id": "V-31909",
|
|
600
|
+
"title": "Marking Classified - Local or Enclave Classified Marking Procedures must be developed to ensure employees are familiar with appropriate organization Security Classification Guides (SCG), how to obtain guidance for marking classified documents, media and equipment, and where associated forms, classified cover sheets, labels, stamps, wrapping material for classified shipment, etc. can be obtained.\n",
|
|
601
|
+
"description": "Failure to properly mark classified material could result in the loss or compromise of classified\ninformation.\n",
|
|
602
|
+
"severity": "low"
|
|
603
|
+
},
|
|
604
|
+
{
|
|
605
|
+
"id": "V-31910",
|
|
606
|
+
"title": "Marking Classified - Equipment, Documents or Media: In a classified operating environment, all unclassified items must be marked in addition to all classified items. \n\n\n",
|
|
607
|
+
"description": "Failure to properly mark classified material could result in the loss or compromise of classified\ninformation.",
|
|
608
|
+
"severity": "medium"
|
|
609
|
+
},
|
|
610
|
+
{
|
|
611
|
+
"id": "V-31976",
|
|
612
|
+
"title": "Classified Working Papers are properly marked, destroyed when no longer needed, or treated as a finished document after 180 days\n\n",
|
|
613
|
+
"description": "Failure to properly mark or handle classified documents can lead to the loss or compromise of\nclassified or sensitive information.\n",
|
|
614
|
+
"severity": "low"
|
|
615
|
+
},
|
|
616
|
+
{
|
|
617
|
+
"id": "V-31986",
|
|
618
|
+
"title": "Storage/Handling of Classified Documents, Media, Equipment - must be under continuous personal protection and control of an authorized (cleared) individual OR guarded or stored in an approved locked security container (safe), vault, secure room, collateral classified open storage area or SCIF.\n",
|
|
619
|
+
"description": "Failure to store classified in an approved container OR to properly protect classified when removed from storage can lead to the loss or compromise of classified or sensitive information.\n\n",
|
|
620
|
+
"severity": "high"
|
|
621
|
+
},
|
|
622
|
+
{
|
|
623
|
+
"id": "V-31987",
|
|
624
|
+
"title": "Non-Disclosure Agreement - Standard Form 312: no person may have access to classified information unless that person has a security clearance in accordance with DoD 5200.2-R and has signed a Standard Form (SF) 312, Classified Information Non-Disclosure Agreement (NDA), and access is essential to the accomplishment of a lawful and authorized Government function (i.e., has a need to know).\n\n\n\n",
|
|
625
|
+
"description": "Failure to verify clearance, need-to-know, and execute a non-disclosure agreement before granting\naccess to classified can result in unauthorized personnel having access to classified.\n",
|
|
626
|
+
"severity": "low"
|
|
627
|
+
},
|
|
628
|
+
{
|
|
629
|
+
"id": "V-31988",
|
|
630
|
+
"title": "Handling of Classified Documents, Media, Equipment - Written Procedures for when classified material/equipment is removed from a security container and/or secure room. \n",
|
|
631
|
+
"description": "Failure to develop procedures and to train employees on protection of classified when removed from storage could lead to the loss or compromise of classified or sensitive information due to a lack of employee knowledge of requirements.\n",
|
|
632
|
+
"severity": "low"
|
|
633
|
+
},
|
|
634
|
+
{
|
|
635
|
+
"id": "V-31989",
|
|
636
|
+
"title": "Handling of Classified - Use of Cover Sheets on Documents Removed from Secure Storage\n\n \n",
|
|
637
|
+
"description": "Failure to protect readable classified information printed from classified systems such as SIPRNet when removed from secure storage can lead to the loss or compromise of classified or sensitive information.",
|
|
638
|
+
"severity": "low"
|
|
639
|
+
},
|
|
640
|
+
{
|
|
641
|
+
"id": "V-31991",
|
|
642
|
+
"title": "Classified Monitors/Displays (Physical Control of Classified Monitors From Unauthorized Viewing) \n\n \n\n",
|
|
643
|
+
"description": "Failure to limit access to unauthorized personnel to information displayed on classified monitors/displays can result in the loss or compromise of classified information, including NOFORN information.\n",
|
|
644
|
+
"severity": "high"
|
|
645
|
+
},
|
|
646
|
+
{
|
|
647
|
+
"id": "V-31992",
|
|
648
|
+
"title": "Classified Monitors/Displays (Procedures for Obscuration of Classified Monitors) - protection from uncleared persons or those without a need-to-know.\n\n",
|
|
649
|
+
"description": "Failure to develop procedures and training for employees to cover responsibilities and methods for limiting the access of unauthorized personnel to classified information reflected on information system monitors and displays can result in the loss or compromise of classified information.",
|
|
650
|
+
"severity": "low"
|
|
651
|
+
},
|
|
652
|
+
{
|
|
653
|
+
"id": "V-31993",
|
|
654
|
+
"title": "Monitor Screens - Disable Access by CAC or Token Removal, or Lock Computer via Ctrl/Alt/Del\n\n\n\n\n",
|
|
655
|
+
"description": "The DoD Common Access Cards (CAC) a \"smart\" card, is the standard identification for active-duty military personnel, Selected Reserve, DoD civilian employees, and eligible contractor personnel. It is also the principal card used to enable physical access to buildings and controlled spaces, and it provides access to defense computer networks and systems. \n \nThe card, which is the property of the U.S. Government, is required to be in the personal custody of the member at all times.\n\nSystem Access Tokens are also used on the SIPRNet and the cards along with a Personal identity Number (PIN) can be used to access classified information on the SIPRNet in lieu of a logon ID and password.\n\nCAC and SIPRNet tokens are very important components for providing both physical and logical access control to DISN assets and must therefore be strictly controlled.\n\nPhysically co-locating REL Partners or other FN - who have limited access to the SIPRNet or other US Classified systems - near US personnel in a collateral classified (Secret or higher) open storage area or in a Secret or higher Controlled Access Area (CAA) that processes classified material is permissible for operational efficiency and coordination.\n \nFailure to limit access to information systems is especially important in mixed US/FN environments. This is particularly important on US Only classified terminals when not personally and physically attended by US personnel. The failure to properly disable information workstations and monitor screens when unattended can result in FN personnel having unauthorized access to classified information, which can result in the loss or compromise of classified information, including NOFORN information. \n\nAppropriate but simple physical and procedural security measures must be put in place to ensure that unauthorized persons to include FN partners do not have unauthorized access to information not approved for release to them. Control of CACs, SIPRNet tokens and locking of computer work stations when unattended is an important aspect of proper procedural security measure implementation.\n",
|
|
656
|
+
"severity": "high"
|
|
657
|
+
},
|
|
658
|
+
{
|
|
659
|
+
"id": "V-31994",
|
|
660
|
+
"title": "End-of-Day Checks - Organizations that process or store classified information must establish a system of security checks at the close of each duty and/or business day to ensure that any area where classified information is used or stored is secure. SF 701, Activity Security Checklist, shall be used to record such checks. \n\n",
|
|
661
|
+
"description": "Failure to have written guidance to provide guidance for end-of-day (EOD) checks could lead to such checks not being properly conducted. If EOD checks are not properly conducted the loss or improper storage of classified material might not be promptly discovered. This could result in a longer duration of the security deficiency before corrective action is taken and make discovery of factual information concerning what caused the security incident and assigning responsibility and remedail actions more difficult. Ultimately the failure to perform consistent EOD checks can lead to the loss or compromise of classified or sensitive information.",
|
|
662
|
+
"severity": "medium"
|
|
663
|
+
},
|
|
664
|
+
{
|
|
665
|
+
"id": "V-31995",
|
|
666
|
+
"title": "Classified Reproduction - Document Copying Procedures: This STIG Check (AKA: Vulnerability (Vul)) concerns ONLY PROCEDURES for the reproduction (copying) of classified DOCUMENTS on Multi-Functional Devices (MDF) connected to the DISN.\n \n\n",
|
|
667
|
+
"description": "Lack of or improper reproduction procedures for classified material could result in the loss or compromise of classified information.\n",
|
|
668
|
+
"severity": "low"
|
|
669
|
+
},
|
|
670
|
+
{
|
|
671
|
+
"id": "V-31996",
|
|
672
|
+
"title": "Classified Reproduction - Following guidance for System to Media Transfer of Data from systems connected specifically to the SIPRNet In-Accordance-With (IAW) US Cybercom CTO 10-133 .\n\n ",
|
|
673
|
+
"description": "Failure to follow guidance for disabling removable media drives on devices connected to the SIPRNet or if approved by the local DAA failure to follow US CYBERCOM procedures for using removable media on SIPRNet could result in the loss or compromise of classified information.\n",
|
|
674
|
+
"severity": "medium"
|
|
675
|
+
},
|
|
676
|
+
{
|
|
677
|
+
"id": "V-32008",
|
|
678
|
+
"title": "Classified Reproduction - SIPRNet Connected Classified Multi-Functional Devices (MFD) located in Space Not Approved for Collateral Classified Open Storage.\n \n",
|
|
679
|
+
"description": "Classified Multi-Functional Devices (MFD) include copiers and contain hard drives that maintain classified data or images. Failure to locate these devices in spaces approved for classified open storage could enable uncleared persons to access classified information, either from unsanitized hard drives or from printed/copied material that is left unattended on the machine for any period of time.",
|
|
680
|
+
"severity": "high"
|
|
681
|
+
},
|
|
682
|
+
{
|
|
683
|
+
"id": "V-32009",
|
|
684
|
+
"title": "Destruction of Classified Documents Printed from the SIPRNet Using Approved Devices on NSA Evaluated Products Lists (EPL).\n\n",
|
|
685
|
+
"description": "Failure to properly destroy classified material can lead to the loss or compromise of classified or NSA\nsensitive information.\n",
|
|
686
|
+
"severity": "high"
|
|
687
|
+
},
|
|
688
|
+
{
|
|
689
|
+
"id": "V-32090",
|
|
690
|
+
"title": "Classified Destruction - Availability of Local Policy and Procedures\n",
|
|
691
|
+
"description": "Failure to properly destroy classified material can lead to the loss or compromise of classified or\nsensitive information.\n",
|
|
692
|
+
"severity": "low"
|
|
693
|
+
},
|
|
694
|
+
{
|
|
695
|
+
"id": "V-32102",
|
|
696
|
+
"title": "Classified Destruction - Hard Drive and Storage Media Sanitization Devices and Plans are not Available for Automated Information System (AIS) Equipment On-Hand\n\n",
|
|
697
|
+
"description": "Failure to properly destroy classified material can lead to the loss or compromise of classified or\nsensitive information.\n",
|
|
698
|
+
"severity": "medium"
|
|
699
|
+
},
|
|
700
|
+
{
|
|
701
|
+
"id": "V-32111",
|
|
702
|
+
"title": "Classified Destruction - Improper Disposal of Automated Information System (AIS) Hard Drives and Storage Media\n\n",
|
|
703
|
+
"description": "Failure to properly destroy classified or sensitive material can lead to the loss or compromise of classified or sensitive information.\n",
|
|
704
|
+
"severity": "high"
|
|
705
|
+
},
|
|
706
|
+
{
|
|
707
|
+
"id": "V-32132",
|
|
708
|
+
"title": "Classified Emergency Destruction Plans - Develop and Make Available\n\n",
|
|
709
|
+
"description": "Failure to develop emergency procedures can lead to the loss or compromise of classified or\nsensitive information.\n\n\n",
|
|
710
|
+
"severity": "medium"
|
|
711
|
+
},
|
|
712
|
+
{
|
|
713
|
+
"id": "V-32138",
|
|
714
|
+
"title": "Security Incident/Spillage - Lack of Procedures or Training for Handling and Reporting\n\n",
|
|
715
|
+
"description": "Failure to report possible security compromise can result in the impact of the loss or compromise\nof classified information not to be evaluated, responsibility affixed, or a plan of action developed to prevent recurrence of future incidents.\n\n",
|
|
716
|
+
"severity": "medium"
|
|
717
|
+
},
|
|
718
|
+
{
|
|
719
|
+
"id": "V-32150",
|
|
720
|
+
"title": "Classification Guides Must be Available for Programs and Systems for an Organization or Site \n\n",
|
|
721
|
+
"description": "Failure to have proper classification guidance available for can result in the misclassification of information and ultimatley lead to the loss or compromise of classified or sensitive information.\n",
|
|
722
|
+
"severity": "medium"
|
|
723
|
+
},
|
|
724
|
+
{
|
|
725
|
+
"id": "V-32156",
|
|
726
|
+
"title": " Controlled Unclassified Information (CUI) - Local Policy Procedure\n \n \n\n \n",
|
|
727
|
+
"description": "Failure to handle CUI in an approved manner can result in the loss or compromise of sensitive\ninformation.\n",
|
|
728
|
+
"severity": "low"
|
|
729
|
+
},
|
|
730
|
+
{
|
|
731
|
+
"id": "V-32159",
|
|
732
|
+
"title": "Controlled Unclassified Information (CUI) - Employee Education and Training\n\n",
|
|
733
|
+
"description": "Failure to handle CUI in an approved manner can result in the loss or compromise of sensitive\ninformation.",
|
|
734
|
+
"severity": "medium"
|
|
735
|
+
},
|
|
736
|
+
{
|
|
737
|
+
"id": "V-32180",
|
|
738
|
+
"title": "Controlled Unclassified Information - Document, Hard Drive and Media Disposal\n\n",
|
|
739
|
+
"description": "Failure to handle CUI in an approved manner can result in the loss or compromise of sensitive\ninformation.\n",
|
|
740
|
+
"severity": "medium"
|
|
741
|
+
},
|
|
742
|
+
{
|
|
743
|
+
"id": "V-32261",
|
|
744
|
+
"title": "Controlled Unclassified Information - Handling, Storage and Controlling Access to Areas where CUI is Processed or Maintained \n\n",
|
|
745
|
+
"description": "Failure to handle CUI in an approved manner can result in the loss or compromise of sensitive\ninformation.\n",
|
|
746
|
+
"severity": "medium"
|
|
747
|
+
},
|
|
748
|
+
{
|
|
749
|
+
"id": "V-32262",
|
|
750
|
+
"title": "Controlled Unclassified Information - Marking/Labeling Media within Unclassified Environments (Not Mixed with Classified)\n\n",
|
|
751
|
+
"description": "Failure to mark CUI in an approved manner can result in the loss or compromise of sensitive\ninformation.\n",
|
|
752
|
+
"severity": "low"
|
|
753
|
+
},
|
|
754
|
+
{
|
|
755
|
+
"id": "V-32263",
|
|
756
|
+
"title": "Controlled Unclassified Information - Encryption of Data at Rest\n\n",
|
|
757
|
+
"description": "Failure to handle CUI in an approved manner can result in the loss or compromise of sensitive\ninformation.",
|
|
758
|
+
"severity": "medium"
|
|
759
|
+
},
|
|
760
|
+
{
|
|
761
|
+
"id": "V-32264",
|
|
762
|
+
"title": "Controlled Unclassified Information - Transmission by either Physical or Electronic Means\n\n",
|
|
763
|
+
"description": "Failure to handle/transmit CUI in an approved manner can result in the loss or compromise of sensitive\ninformation.\n",
|
|
764
|
+
"severity": "medium"
|
|
765
|
+
},
|
|
766
|
+
{
|
|
767
|
+
"id": "V-32265",
|
|
768
|
+
"title": "Controlled Unclassified Information - Posting Only on Web-Sites with Appropriate Encryption; not on Publicly Accessible Web-Sites.\n\n",
|
|
769
|
+
"description": "Failure to handle CUI in an approved manner can result in the loss or compromise of sensitive\ninformation.\n",
|
|
770
|
+
"severity": "medium"
|
|
771
|
+
},
|
|
772
|
+
{
|
|
773
|
+
"id": "V-32321",
|
|
774
|
+
"title": "Classified Annual Review\n\n",
|
|
775
|
+
"description": "Failure to conduct the annual review and clean out day can result in an excessive amount of\nclassified (including IS storage media) being on hand and therefore being harder to account for, resulting in the possibility of loss or compromise of classified or sensitive information.\n",
|
|
776
|
+
"severity": "low"
|
|
777
|
+
},
|
|
778
|
+
{
|
|
779
|
+
"id": "V-32336",
|
|
780
|
+
"title": "Position of Trust - Knowledge of Responsibility to Self Report Derogatory Information\n\n",
|
|
781
|
+
"description": "Failure to inform personnel of the expected standards of conduct while holding a position of trust and their responsibility to self-report derogatory information to the organization security manager\ncan result in conduct by the individual that will require them being removed from that position.\n",
|
|
782
|
+
"severity": "low"
|
|
783
|
+
},
|
|
784
|
+
{
|
|
785
|
+
"id": "V-32340",
|
|
786
|
+
"title": "Position of Trust - Local Policy Covering Employee Personal Standards of Conduct and Responsibilities\n\n",
|
|
787
|
+
"description": "Failure to inform personnel of the expected standards of conduct while holding a position of trust\ncan result in conduct by the individual that will require them being removed from that position and/or result in an untrustworthy person continuing in a postion of trust without proper vetting of new derogatory information.\n",
|
|
788
|
+
"severity": "low"
|
|
789
|
+
},
|
|
790
|
+
{
|
|
791
|
+
"id": "V-32341",
|
|
792
|
+
"title": "Position of Trust - Training Covering Employee Standards of Conduct and Personal Responsibilities\n\n",
|
|
793
|
+
"description": "Failure to inform personnel of the expected standards of conduct while holding a position of trust\ncan result in conduct by the individual that will require them being removed from that position or result in a person no longer meeting standards criteria continuing to hold a position of trust without proper vetting for suitability.\n",
|
|
794
|
+
"severity": "low"
|
|
795
|
+
},
|
|
796
|
+
{
|
|
797
|
+
"id": "V-32342",
|
|
798
|
+
"title": "Position Sensitivity - Assignment based on Security Clearance and/or Information Technology (IT) Level on Assigned Information Systems (IS)\n\n",
|
|
799
|
+
"description": "Failure to designate position sensitivity could result in personnel having access to classified\ninformation or other sensitive duties (such as privileged access to DoD Information Systems) without the required investigative and adjudicative prerequisites\n",
|
|
800
|
+
"severity": "medium"
|
|
801
|
+
},
|
|
802
|
+
{
|
|
803
|
+
"id": "V-32343",
|
|
804
|
+
"title": "Validation Procedures for Security Clearance Issuance and (Classified Systems and/or Physical) Access Granted\n\n",
|
|
805
|
+
"description": "Failure to verify security clearance status could result in an unauthorized person having access to a\nclassified information system or an authorized person being unable to perform assigned duties.\n",
|
|
806
|
+
"severity": "medium"
|
|
807
|
+
},
|
|
808
|
+
{
|
|
809
|
+
"id": "V-32372",
|
|
810
|
+
"title": "IT Position Designation\n",
|
|
811
|
+
"description": "Failure to designate an appropriate IT level could result in an individual having access to an\ninformation system without the required investigative and adjudicative prerequisites.\n",
|
|
812
|
+
"severity": "medium"
|
|
813
|
+
},
|
|
814
|
+
{
|
|
815
|
+
"id": "V-32396",
|
|
816
|
+
"title": "Background Investigations - Completed based Upon IT/Position Sensitivity Levels\n\n",
|
|
817
|
+
"description": "Failure to investigate personnel based upon their position sensitivity could result in unauthorized\npersonnel having access to classified or sensitive information.\n\n",
|
|
818
|
+
"severity": "medium"
|
|
819
|
+
},
|
|
820
|
+
{
|
|
821
|
+
"id": "V-32408",
|
|
822
|
+
"title": "Periodic Reinvestigations - Submitted in a Timely Manner based Upon Position Sensitivity and Type of Investigation Required\n\n",
|
|
823
|
+
"description": "Failure to subject personnel to periodic reinvestigation can result in derogatory information not\nbeing discovered on personnel having access to sensitive or classified information.\n",
|
|
824
|
+
"severity": "low"
|
|
825
|
+
},
|
|
826
|
+
{
|
|
827
|
+
"id": "V-32425",
|
|
828
|
+
"title": "Outprocessing Procedures for Departing or Terminated Employees (Military, Government Civilian and Contractor)\n\n",
|
|
829
|
+
"description": "Failure to properly out process through the security section allows the possibility of (unauthorized) continued access to the facility and/or the systems.",
|
|
830
|
+
"severity": "low"
|
|
831
|
+
},
|
|
832
|
+
{
|
|
833
|
+
"id": "V-32457",
|
|
834
|
+
"title": "Intrusion Detection System (IDS) Monitoring Station Personnel - Suitability Checks\n\n",
|
|
835
|
+
"description": "Failure to subject personnel who monitor the IDS alarms to a trustworthiness determination can\nresult in the inadvertent or deliberate unauthorized access to, or release of classified material.\n",
|
|
836
|
+
"severity": "medium"
|
|
837
|
+
},
|
|
838
|
+
{
|
|
839
|
+
"id": "V-32477",
|
|
840
|
+
"title": "Intrusion Detection System (IDS) Installation and Maintenance Personnel - Suitability Checks\n\n",
|
|
841
|
+
"description": "Failure to subject personnel who install and maintain the IDS alarms to a trustworthiness determination can result in the inadvertent or deliberate unauthorized release of classified material.\n",
|
|
842
|
+
"severity": "medium"
|
|
843
|
+
},
|
|
844
|
+
{
|
|
845
|
+
"id": "V-32482",
|
|
846
|
+
"title": "Physical Security Program - Physical Security Plan Development and Implementation with Consideration of Information Systems Assets\n\n",
|
|
847
|
+
"description": "Failure to have a physical security program will result in an increased risk to DoD Information Systems; including personnel, equipment, material and documents.\n",
|
|
848
|
+
"severity": "low"
|
|
849
|
+
},
|
|
850
|
+
{
|
|
851
|
+
"id": "V-32541",
|
|
852
|
+
"title": "Risk Assessment -Holistic Review (site/environment/information systems)\n\n",
|
|
853
|
+
"description": "Failure to conduct a risk analysis could result in not implementing an effective countermeasure to a\nvulnerability or wasting resources on ineffective measures leading to a possible loss of classified,\nequipment, facilities, or personnel.\n",
|
|
854
|
+
"severity": "medium"
|
|
855
|
+
},
|
|
856
|
+
{
|
|
857
|
+
"id": "V-32580",
|
|
858
|
+
"title": "Physical Protection of Unclassified Key System Devices/Computer Rooms in Large Processing Facilities\n\n",
|
|
859
|
+
"description": "Allowing access to systems processing sensitive information by personnel without the need-to-know\ncould permit loss, destruction of data or equipment or a denial of service. Loss could be accidental\ndamage or intentional theft or sabotage.",
|
|
860
|
+
"severity": "medium"
|
|
861
|
+
},
|
|
862
|
+
{
|
|
863
|
+
"id": "V-32600",
|
|
864
|
+
"title": "Restricted Area and Controlled Area Designation of Areas Housing Critical Information System Components or Classified /Sensitive Technology or Data\n\n",
|
|
865
|
+
"description": "Failure to designate the areas housing the critical information technology systems as a restricted or controlled access area may result in inadequate protection being assigned during emergency actions or the site having insufficient physical security protection measures in place. Further, warning signs may not be in place to advise visitors or other unauthorized persons that such areas are off-limits, resulting in inadvertent access by unauthorized persons.\n",
|
|
866
|
+
"severity": "medium"
|
|
867
|
+
},
|
|
868
|
+
{
|
|
869
|
+
"id": "V-32601",
|
|
870
|
+
"title": "Security-in-Depth (AKA: Defense-in-Depth) - Minimum Physical Barriers and Access Control Measures for Facilities or Buildings Containing DISN (SIPRNet/NIPRNet) Connected Assets.\n\n",
|
|
871
|
+
"description": "Failure to use security in-depth can result in a facility being vulnerable to an undetected intrusion or an intrusion that cannot be responded to in a timely manner - or both.\n",
|
|
872
|
+
"severity": "medium"
|
|
873
|
+
},
|
|
874
|
+
{
|
|
875
|
+
"id": "V-32602",
|
|
876
|
+
"title": "Visitor Control - To Facility or Organization with Information System Assets Connected to the DISN\n\n",
|
|
877
|
+
"description": "Failure to identify and control visitors could result in unauthorized personnel gaining access to the\nfacility with the intent to compromise classified information, steal equipment, or damage equipment\nor the facility.\n",
|
|
878
|
+
"severity": "medium"
|
|
879
|
+
},
|
|
880
|
+
{
|
|
881
|
+
"id": "V-32603",
|
|
882
|
+
"title": "Sensitive Item Control - Keys, Locks and Access Cards Controlling Access to Information Systems (IS) or IS Assets Connected to the DISN\n\n",
|
|
883
|
+
"description": "Lack of an adequate key/credential/access device control could result in unauthorized personnel gaining\naccess to the facility or systems with the intent to compromise classified information, steal\nequipment, or damage equipment or the facility.",
|
|
884
|
+
"severity": "medium"
|
|
885
|
+
},
|
|
886
|
+
{
|
|
887
|
+
"id": "V-32604",
|
|
888
|
+
"title": "Physical Penetration Testing - of Facilities or Buildings Containing Information Systems (IS) Connected to the DISN ",
|
|
889
|
+
"description": "Failure to periodically test facility/building security where Information Systems (IS) connected to the DISN are present could lead to the unauthorized access of an individual into the facility with nefarious intentions to affect the Confidentiality, Integrity or Assurance of data or hardware on the IS.",
|
|
890
|
+
"severity": "low"
|
|
891
|
+
},
|
|
892
|
+
{
|
|
893
|
+
"id": "V-32605",
|
|
894
|
+
"title": "Security and Information Assurance (IA) Staff Appointment, Training/Certification and Suitability\n\n",
|
|
895
|
+
"description": "Failure to formally appoint security personnel and detail responsibilities, training and other requirements in the appointment notices could result in a weaken security program due to critical security and information assurance personnel not being fully aware of the scope of their duties and responsibilities or not being properly trained or meeting standards for appointment to assigned positions.\n",
|
|
896
|
+
"severity": "medium"
|
|
897
|
+
},
|
|
898
|
+
{
|
|
899
|
+
"id": "V-32606",
|
|
900
|
+
"title": "Security Training - Information Security (INFOSEC) and Information Assurance (IA) for ALL Employees; Military, Government Civilian and Contractor\n\n",
|
|
901
|
+
"description": "Failure to provide security training to ALL employees results in a weak security program and could lead to the loss or compromise of classified or sensitive information.\n",
|
|
902
|
+
"severity": "medium"
|
|
903
|
+
},
|
|
904
|
+
{
|
|
905
|
+
"id": "V-32607",
|
|
906
|
+
"title": "Counter-Intelligence Program - Training, Procedures and Incident Reporting\n\n",
|
|
907
|
+
"description": "Failure to establish a good working relationship with the supporting/local CI agency and lack of proper CI training for site/organization employees could result in not being informed of local threats and warnings leaving the organization vulnerable to the threat and/or a delay in reporting a possible incident involving reportable FIE-Associated Cyberspace Contacts, Activities, Indicators, and Behaviors, which could adversely impact the Confidnetiality, Intergity or Availability (CIA) of the DISN.\n.\n",
|
|
908
|
+
"severity": "low"
|
|
909
|
+
},
|
|
910
|
+
{
|
|
911
|
+
"id": "V-33456",
|
|
912
|
+
"title": "Protected Distribution System (PDS) Construction - Alarmed Carrier",
|
|
913
|
+
"description": "A PDS that is not constructed and configured as required could result in the covert or undetected interception of classified information.",
|
|
914
|
+
"severity": "high"
|
|
915
|
+
}
|
|
916
|
+
]
|
|
917
|
+
}
|