Skip to content
ATO Pathways
  Log In

Storage Area Network STIG

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Hard zoning is not used to protect the SAN.

    <GroupDescription></GroupDescription>
    Group
    Show

  • Hard zoning is not used to protect the SAN.

    &lt;VulnDiscussion&gt;Risk: In a SAN environment, we potentially have data with differing levels or need-to-know stored on the same "system". A h...
    Rule High Severity
    Show

  • Compliance with Network Infrastructure and Enclave

    <GroupDescription></GroupDescription>
    Group
    Show

  • The SANs are not compliant with overall network security architecture, appropriate enclave, and data center security requirements in the Network Infrastructure STIG and the Enclave STIG

    &lt;VulnDiscussion&gt;Inconsistencies with the Network Infrastructure STIG, the Enclave STIG, and the SAN implementation can lead to the creation o...
    Rule Medium Severity
    Show

  • All security related patches are not installed.

    <GroupDescription></GroupDescription>
    Group
    Show

  • All security related patches are not installed.

    &lt;VulnDiscussion&gt;Failure to install security related patches leaves the SAN open to attack by exploiting known vulnerabilities. The IAO/NSO wi...
    Rule Medium Severity
    Show

  • Component Compliance with applicable STIG

    <GroupDescription></GroupDescription>
    Group
    Show

  • Prior to installing SAN components (servers, switches, and management stations) onto the DOD network infrastructure, components are not configured to meet the applicable STIG requirements.

    &lt;VulnDiscussion&gt;Many SAN components (servers, switches, management stations) have security requirements from other STIGs. It will be verifie...
    Rule Medium Severity
    Show

  • Servers and hosts OS STIG Requirements

    <GroupDescription></GroupDescription>
    Group
    Show

  • Servers and other hosts are not compliant with applicable Operating System (OS) STIG requirements.

    &lt;VulnDiscussion&gt;SAN servers and other hosts are hardware software combinations that actually run under the control of a native OS found on th...
    Rule Medium Severity
    Show

  • Anti-virus on servers and host.

    <GroupDescription></GroupDescription>
    Group
    Show

  • Vendor supported, DOD approved, anti-virus software is not installed and configured on all SAN servers in accordance with the applicable operating system STIG on SAN servers and management devices and kept up-to-date with the most recent virus definition tables.

    &lt;VulnDiscussion&gt;The SAN servers and other hosts are subject to virus and worm attacks as are any systems running an OS. If the anti-virus so...
    Rule High Severity
    Show

  • SAN Topology Drawing

    <GroupDescription></GroupDescription>
    Group
    Show

  • SAN Fabric Zoning List Deny-By-Default

    <GroupDescription></GroupDescription>
    Group
    Show

  • Physical Access to SAN Network Devices

    <GroupDescription></GroupDescription>
    Group
    Show

  • All the network level devices interconnected to the SAN are not located in a secure room with limited access.

    &lt;VulnDiscussion&gt;If the network level devices are not located in a secure area they can be tampered with which could lead to a denial of servi...
    Rule Medium Severity
    Show

  • SAN Fabric Switch User Accounts with Passwords

    <GroupDescription></GroupDescription>
    Group
    Show

  • Individual user accounts with passwords are not set up and maintained for the SAN fabric switch.

    &lt;VulnDiscussion&gt;Without identification and authentication unauthorized users could reconfigure the SAN or disrupt its operation by logging in...
    Rule Medium Severity
    Show

  • Fabric Switches do not have bidirectional authentication

    <GroupDescription></GroupDescription>
    Group
    Show

  • The SAN must be configured to use bidirectional authentication.

    &lt;VulnDiscussion&gt;Switch-to-switch management traffic does not have to be encrypted. Bidirectional authentication ensures that a rogue switch c...
    Rule Medium Severity
    Show

  • SAN Switch encryption and DOD PKI

    <GroupDescription></GroupDescription>
    Group
    Show

  • The fabric switches must use DoD-approved PKI rather than proprietary or self-signed device certificates.

    &lt;VulnDiscussion&gt;DOD PKI supplies better protection from malicious attacks than userid/password authentication and should be used anytime it i...
    Rule Low Severity
    Show

  • SAN Network Management Ports Fabric Switch

    <GroupDescription></GroupDescription>
    Group
    Show

  • Network management ports on the SAN fabric switches except those needed to support the operational commitments of the sites are not disabled.

    &lt;VulnDiscussion&gt;Enabled network management ports that are not required expose the SAN fabric switch and the entire network to unnecessary vul...
    Rule Medium Severity
    Show

  • SAN management out-of-band or direct connect

    <GroupDescription></GroupDescription>
    Group
    Show

  • SAN management is not accomplished using the out-of-band or direct connection method.

    &lt;VulnDiscussion&gt;Removing the management traffic from the production network diminishes the security profile of the SAN servers by allowing al...
    Rule Medium Severity
    Show

  • Management Console to SAN Fabric Authentication

    <GroupDescription></GroupDescription>
    Group
    Show

  • Communications from the management console to the SAN fabric are not protected strong two-factor authentication.

    &lt;VulnDiscussion&gt;Using two-factor authentication between the SAN management console and the fabric enhances the security of the communications...
    Rule Low Severity
    Show

  • Default PKI keys

    <GroupDescription></GroupDescription>
    Group
    Show

  • FIPS 140-1/2 for management to fabric.

    <GroupDescription></GroupDescription>
    Group
    Show

  • The SAN is not configured to use FIPS 140-1/2 validated encryption algorithm to protect management-to-fabric communications.

    &lt;VulnDiscussion&gt;The communication between the SAN management consol and the SAN fabric carries sensitive privileged configuration data. This...
    Rule Low Severity
    Show

  • Password SAN Management Console and Ports

    <GroupDescription></GroupDescription>
    Group
    Show

  • All SAN management consoles and ports are not password protected.

    &lt;VulnDiscussion&gt;Without password protection malicious users can create a denial of service by disrupting the SAN or allow the compromise of s...
    Rule High Severity
    Show

  • Default SAN Management Software Password

    <GroupDescription></GroupDescription>
    Group
    Show

  • The SAN fabric zoning lists are not based on a policy of Deny-by-Default with blocks on all services and protocols not required on the given port or by the site.

    &lt;VulnDiscussion&gt;By using the Deny-by-Default based policy, any service or protocol not required by a port and overlooked in the zoning list w...
    Rule High Severity
    Show

  • Logging Failed Access to Port, Protocols, Services

    <GroupDescription></GroupDescription>
    Group
    Show

  • Attempts to access ports, protocols, or services that are denied are not logged..

    &lt;VulnDiscussion&gt;Logging or auditing of failed access attempts is a necessary component for the forensic investigation of security incidents. ...
    Rule Low Severity
    Show

  • SNMP usage and configuration.

    <GroupDescription></GroupDescription>
    Group
    Show

  • Simple Network Management Protocol (SNMP) is used and it is not configured in accordance with the guidance contained in the Network Infrastructure STIG.

    &lt;VulnDiscussion&gt;There are vulnerabilities in some implementations and some configurations of SNMP. Therefore if SNMP is used the guidelines ...
    Rule Medium Severity
    Show

  • Authorized IP Addresses allowed for SNMP

    <GroupDescription></GroupDescription>
    Group
    Show

  • Unauthorized IP addresses are allowed Simple Network Management Protocol (SNMP) access to the SAN devices.

    &lt;VulnDiscussion&gt;SNMP, by virtue of what it is designed to do, can be a large security risk. Because SNMP can obtain device information and se...
    Rule High Severity
    Show

  • Only Internal Network SNMP Access to SAN

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IP addresses of the hosts permitted SNMP access to the SAN management devices do not belong to the internal network.

    &lt;VulnDiscussion&gt;SNMP, by virtue of what it is designed to do, can be a large security risk. Because SNMP can obtain device information and se...
    Rule Medium Severity
    Show

  • Fibre Channel network End-User Platform Restricted

    <GroupDescription></GroupDescription>
    Group
    Show

  • End-user platforms are directly attached to the Fibre Channel network or access storage devices directly.

    &lt;VulnDiscussion&gt;End-user platforms should only be connected to servers that run applications that access the data found on the SAN devices. ...
    Rule Low Severity
    Show

  • Backup of critical SAN Software and configurations

    <GroupDescription></GroupDescription>
    Group
    Show

  • Fabric switch configurations and management station configuration are not archived and/or copies of the operating system and other critical software for all SAN components are not stored in a fire rated container or are not collocated with the operational software.

    &lt;VulnDiscussion&gt;.Backup and recovery procedures are critical to the security and availability of the SAN system. If a system is compromised,...
    Rule Medium Severity
    Show

  • SAN Fixed IP Required.

    <GroupDescription></GroupDescription>
    Group
    Show

  • SAN components are not configured with fixed IP addresses.

    &lt;VulnDiscussion&gt;Without fixed IP address filtering or restricting of access based on IP addressing will not function correctly allowing unaut...
    Rule Medium Severity
    Show

  • A current drawing of the site’s SAN topology that includes all external and internal links, zones, and all interconnected equipment is not being maintained.

    &lt;VulnDiscussion&gt;A drawing of the SAN topology gives the IAO and other interested individuals a pictorial representation of the SAN. This can...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules