Skip to content
ATO Pathways
  Log In

Enterprise Voice, Video, and Messaging Session Management Security Requirements Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • The Enterprise Voice, Video, and Messaging Session Manager must protect session (call) records from unauthorized modification.

    <VulnDiscussion>If session records were to become compromised, then forensic analysis and discovery of the true source of potentially malicio...
    Rule Medium Severity
    Show

  • SRG-NET-000100

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-NET-000334

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Enterprise Voice, Video, and Messaging Session Manager must protect session (call) records from unauthorized deletion.

    &lt;VulnDiscussion&gt;If session records were to become compromised, then forensic analysis and discovery of the true source of potentially malicio...
    Rule Medium Severity
    Show

  • SRG-NET-000113

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Enterprise Voice, Video, and Messaging Session Manager must produce session (call) records for events determined to be significant and relevant by local policy.

    &lt;VulnDiscussion&gt;Without the capability to generate session records, it is difficult to establish, correlate, and investigate the events relat...
    Rule Medium Severity
    Show

  • SRG-NET-000131

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Enterprise Voice, Video, and Messaging Session Manager must be configured to disable nonessential capabilities.

    &lt;VulnDiscussion&gt;It is detrimental for Enterprise Voice, Video, and Messaging Session Managers to provide, or enable by default, functionality...
    Rule Medium Severity
    Show

  • SRG-NET-000132

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Enterprise Voice, Video, and Messaging Session Manager must only use ports, protocols, and services allowed per the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and Vulnerability Assessments (VAs).

    &lt;VulnDiscussion&gt;In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e....
    Rule High Severity
    Show

  • SRG-NET-000138

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Enterprise Voice, Video, and Messaging Session Manager must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

    &lt;VulnDiscussion&gt;To ensure accountability and prevent unauthenticated access, organizational users must be uniquely identified and authenticat...
    Rule High Severity
    Show

  • The Enterprise Voice, Video, and Messaging Session Manager must be configured to implement attack-resistant mechanisms for Voice Video Endpoint registration.

    &lt;VulnDiscussion&gt;Attacks against an Enterprise Voice, Video, and Messaging Session Manager may include denial of service (DoS), replay attacks...
    Rule Medium Severity
    Show

  • SRG-NET-000148

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Enterprise Voice, Video, and Messaging Session Manager must be configured to uniquely identify each Voice Video Endpoint device before registration.

    &lt;VulnDiscussion&gt;Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Typi...
    Rule Medium Severity
    Show

  • SRG-NET-000213

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Enterprise Voice, Video, and Messaging Session Manager must be configured to terminate all network connections associated with a communications session at the end of the session.

    &lt;VulnDiscussion&gt;Terminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/I...
    Rule Medium Severity
    Show

  • SRG-NET-000225

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Enterprise Voice, Video, and Messaging Session Manager supporting Command and Control (C2) communications must associate multilevel precedence and preemption (MLPP) attributes when exchanged between unified capabilities (UC) systems.

    &lt;VulnDiscussion&gt;If MLPP attributes are not associated with the information being transmitted between systems, then access control policies an...
    Rule Medium Severity
    Show

  • SRG-NET-000226

    <GroupDescription></GroupDescription>
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules