I - Mission Critical Classified
Rules and Groups employed by this XCCDF Profile
-
MFD/Printer Security Policy
<GroupDescription></GroupDescription>Group -
Implementation of an MFD and printer security policy for the protection of classified information.
<VulnDiscussion>Department of Defense Manual 5200.01, "Protection of Classified Information" provides policy, assigns responsibilities, and p...Rule Low Severity -
MFD Level of Audit and Reviewing
<GroupDescription></GroupDescription>Group -
The level of audit has not been established or the audit logs being collected for the devices and print spoolers are not being reviewed.
<VulnDiscussion>If inadequate information is captured in the audit, the identification and prosecution of malicious user will be very difficu...Rule Low Severity -
MFD Classified Network
<GroupDescription></GroupDescription>Group -
MFDs with print, copy, scan, or fax capabilities must be prohibited on classified networks without the approval of the DAA.
<VulnDiscussion>MFDs with print, copy, scan, or fax capabilities, if compromised, could lead to the compromise of classified data or the comp...Rule High Severity -
MFD Clearing Disk Space Scan to Disk
<GroupDescription></GroupDescription>Group -
A MFD device, with scan to hard disk functionality used, is not configured to clear the hard disk between jobs.
<VulnDiscussion>If the MFD is compromised the un-cleared, previously used, space on the hard disk drive can be read which can lead to a compr...Rule Medium Severity -
MFD Scan Discretionary Access Control
<GroupDescription></GroupDescription>Group -
Scan to a file share is enabled but the file shares do not have the appropriate discretionary access control list in place.
<VulnDiscussion>Without appropriate discretionary access controls unauthorized individuals may read the scanned data. This can lead to a com...Rule Low Severity -
MFD fax from network auditing
<GroupDescription></GroupDescription>Group -
Auditing of user access and fax logs must be enabled when fax from the network is enabled.
<VulnDiscussion>Without auditing the originator and destination of a fax cannot be determined. Prosecuting of an individual who maliciously c...Rule Low Severity -
MFD scan to SMTP (email)
<GroupDescription></GroupDescription>Group -
MFDs must not allow scan to SMTP (email).
<VulnDiscussion>The SMTP engines found on the MFDs reviewed when writing the MFD STIG did not have robust enough security features supporting...Rule Medium Severity -
MFD Hard Drive Lock
<GroupDescription></GroupDescription>Group -
A MFD device does not have a mechanism to lock and prevent access to the hard drive.
<VulnDiscussion>If the hard disk drive of a MFD can be removed from the MFD the data on the drive can be recovered and read. This can lead t...Rule Medium Severity -
MFD/Printer Global Configuration Settings
<GroupDescription></GroupDescription>Group -
The device is not configured to prevent non-printer administrators from altering the global configuration of the device.
<VulnDiscussion>If unauthorized users can alter the global configuration of the MFD they can remove all security. This can lead to the compr...Rule High Severity -
MFD03.002
<GroupDescription></GroupDescription>Group -
The MFD must be configured to prohibit the use of all unnecessary and/or nonsecure functions, physical and logical ports, protocols, and/or services.
<VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e....Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.