II - Mission Support Sensitive
Rules and Groups employed by this XCCDF Profile
-
SRG-APP-000373-NDM-000298
Group -
The Arista network device must be configured to synchronize internal system clocks using redundant authenticated time sources.
The loss of connectivity to a particular authoritative time source will result in the loss of time synchronization (free-run mode) and increasingly inaccurate time stamps on audit events and other ...Rule Medium Severity -
SRG-APP-000395-NDM-000310
Group -
The Arista network device must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Bidirectional authentication provides stronger safeguards to validate the...Rule Medium Severity -
SRG-APP-000411-NDM-000330
Group -
The Arista network devices must use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.
Unapproved mechanisms used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DOD data may be compromis...Rule High Severity -
SRG-APP-000412-NDM-000331
Group -
The Arista network device must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.
This requires the use of secure protocols instead of their unsecured counterparts, such as SSH instead of telnet, SCP instead of FTP, and HTTPS instead of HTTP. If unsecured protocols (lacking cryp...Rule High Severity -
SRG-APP-000095-NDM-000225
Group -
The Arista network device must be configured to capture all DOD auditable events.
Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack; to recognize resource utilization or capacity...Rule Medium Severity -
SRG-APP-000516-NDM-000336
Group -
The network device must be configured to use an authentication server to authenticate users prior to granting administrative access.
Centralized management of authentication settings increases the security of remote and nonlocal access methods. This control is particularly important protection against the insider threat. With ro...Rule High Severity -
SRG-APP-000516-NDM-000340
Group -
The network device must be configured to conduct backups of system level information contained in the information system when changes occur.
System-level information includes default and customized settings and security attributes, including ACLs that relate to the network device configuration, as well as software required for the execu...Rule Medium Severity -
SRG-APP-000516-NDM-000344
Group -
The Arista network device must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
For user certificates, each organization obtains certificates from an approved, shared service provider, as required by OMB policy. For federal agencies operating a legacy public key infrastructure...Rule Medium Severity -
SRG-APP-000516-NDM-000350
Group -
The Arista network Arista device must be configured to send log data to a central log server for the purpose of forwarding alerts to the administrators and the ISSO.
The aggregation of log data kept on a syslog server can be used to detect attacks and trigger an alert to the appropriate security personnel. The stored log data can used to detect weaknesses in se...Rule High Severity -
SRG-APP-000516-NDM-000351
Group -
The Arista network device must be running an operating system release that is currently supported by the vendor.
Network devices running an unsupported operating system lack current security fixes required to mitigate the risks associated with recent vulnerabilities.Rule High Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.