III - Administrative Public
Rules and Groups employed by this XCCDF Profile
-
Anti-virus on servers and host.
Group -
Vendor supported, DOD approved, anti-virus software is not installed and configured on all SAN servers in accordance with the applicable operating system STIG on SAN servers and management devices and kept up-to-date with the most recent virus definition tables.
The SAN servers and other hosts are subject to virus and worm attacks as are any systems running an OS. If the anti-virus software is not installed or the virus definitions are not maintained on t...Rule High Severity -
SAN Topology Drawing
Group -
A current drawing of the site’s SAN topology that includes all external and internal links, zones, and all interconnected equipment is not being maintained.
A drawing of the SAN topology gives the IAO and other interested individuals a pictorial representation of the SAN. This can be helpful in diagnosing potential security problems. The IAO/NSO will ...Rule Medium Severity -
Physical Access to SAN Network Devices
Group -
All the network level devices interconnected to the SAN are not located in a secure room with limited access.
If the network level devices are not located in a secure area they can be tampered with which could lead to a denial of service if the device is powered off or sensitive data can be compromised by ...Rule Medium Severity -
SAN Fabric Switch User Accounts with Passwords
Group -
Individual user accounts with passwords are not set up and maintained for the SAN fabric switch.
Without identification and authentication unauthorized users could reconfigure the SAN or disrupt its operation by logging in to the fabric switch and executing unauthorized commands. The IAO/NSO w...Rule Medium Severity -
Fabric Switches do not have bidirectional authentication
Group -
The SAN must be configured to use bidirectional authentication.
Switch-to-switch management traffic does not have to be encrypted. Bidirectional authentication ensures that a rogue switch cannot be inserted and be auto configured to join the fabric.Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.