Storage Area Network STIG
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The default zone visibility is not set to "none"
Group -
The SANs are not compliant with overall network security architecture, appropriate enclave, and data center security requirements in the Network Infrastructure STIG and the Enclave STIG
Inconsistencies with the Network Infrastructure STIG, the Enclave STIG, and the SAN implementation can lead to the creation of vulnerabilities in the network or the enclave.Rule Medium Severity -
All the network level devices interconnected to the SAN are not located in a secure room with limited access.
If the network level devices are not located in a secure area they can be tampered with which could lead to a denial of service if the device is powered off or sensitive data can be compromised by ...Rule Medium Severity -
The SAN fabric zoning lists are not based on a policy of Deny-by-Default with blocks on all services and protocols not required on the given port or by the site.
By using the Deny-by-Default based policy, any service or protocol not required by a port and overlooked in the zoning list will be denied access. If Deny-by-Default based policy was not used any ...Rule High Severity -
Hard zoning is not used to protect the SAN.
Group -
Hard zoning is not used to protect the SAN.
Risk: In a SAN environment, we potentially have data with differing levels or need-to-know stored on the same "system". A high level of assurance that a valid entity (user/system/process) of one ...Rule High Severity -
Compliance with Network Infrastructure and Enclave
Group -
All security related patches are not installed.
Group -
All security related patches are not installed.
Failure to install security related patches leaves the SAN open to attack by exploiting known vulnerabilities. The IAO/NSO will ensure that all security-related patches are installed.Rule Medium Severity -
Component Compliance with applicable STIG
Group -
Prior to installing SAN components (servers, switches, and management stations) onto the DOD network infrastructure, components are not configured to meet the applicable STIG requirements.
Many SAN components (servers, switches, management stations) have security requirements from other STIGs. It will be verified that all requirement are complied with. The IAO/NSO will ensure that p...Rule Medium Severity -
Servers and hosts OS STIG Requirements
Group -
Servers and other hosts are not compliant with applicable Operating System (OS) STIG requirements.
SAN servers and other hosts are hardware software combinations that actually run under the control of a native OS found on the component. This OS may be UNIX, LNIX, Windows, etc. The underlying O...Rule Medium Severity -
Anti-virus on servers and host.
Group -
Vendor supported, DOD approved, anti-virus software is not installed and configured on all SAN servers in accordance with the applicable operating system STIG on SAN servers and management devices and kept up-to-date with the most recent virus definition tables.
The SAN servers and other hosts are subject to virus and worm attacks as are any systems running an OS. If the anti-virus software is not installed or the virus definitions are not maintained on t...Rule High Severity -
SAN Topology Drawing
Group -
SAN Fabric Zoning List Deny-By-Default
Group -
The default zone visibility setting is not set to “none”.
If the default zone visibility setting is set to "none", new clients brought into the SAN will not be allowed access to any SAN zone they are not explicitly placed into. The IAO/NSO will ensure tha...Rule Medium Severity -
A current drawing of the site’s SAN topology that includes all external and internal links, zones, and all interconnected equipment is not being maintained.
A drawing of the SAN topology gives the IAO and other interested individuals a pictorial representation of the SAN. This can be helpful in diagnosing potential security problems. The IAO/NSO will ...Rule Medium Severity -
Physical Access to SAN Network Devices
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.