Skip to content
ATO Pathways
  Log In

III - Administrative Classified

Rules and Groups employed by this XCCDF Profile

  • SAN Switch encryption and DOD PKI

    <GroupDescription></GroupDescription>
    Group
    Show

  • The fabric switches must use DoD-approved PKI rather than proprietary or self-signed device certificates.

    &lt;VulnDiscussion&gt;DOD PKI supplies better protection from malicious attacks than userid/password authentication and should be used anytime it i...
    Rule Low Severity
    Show

  • SAN Network Management Ports Fabric Switch

    <GroupDescription></GroupDescription>
    Group
    Show

  • Network management ports on the SAN fabric switches except those needed to support the operational commitments of the sites are not disabled.

    &lt;VulnDiscussion&gt;Enabled network management ports that are not required expose the SAN fabric switch and the entire network to unnecessary vul...
    Rule Medium Severity
    Show

  • SAN management out-of-band or direct connect

    <GroupDescription></GroupDescription>
    Group
    Show

  • SAN management is not accomplished using the out-of-band or direct connection method.

    &lt;VulnDiscussion&gt;Removing the management traffic from the production network diminishes the security profile of the SAN servers by allowing al...
    Rule Medium Severity
    Show

  • Management Console to SAN Fabric Authentication

    <GroupDescription></GroupDescription>
    Group
    Show

  • Communications from the management console to the SAN fabric are not protected strong two-factor authentication.

    &lt;VulnDiscussion&gt;Using two-factor authentication between the SAN management console and the fabric enhances the security of the communications...
    Rule Low Severity
    Show

  • Default PKI keys

    <GroupDescription></GroupDescription>
    Group
    Show

  • The manufacturer’s default PKI keys have not been changed prior to attaching the switch to the SAN Fabric.

    &lt;VulnDiscussion&gt;If the manufacturer's default PKI keys are allowed to remain active on the device, it can be accessed by a malicious individu...
    Rule Low Severity
    Show

  • FIPS 140-1/2 for management to fabric.

    <GroupDescription></GroupDescription>
    Group
    Show

  • The SAN is not configured to use FIPS 140-1/2 validated encryption algorithm to protect management-to-fabric communications.

    &lt;VulnDiscussion&gt;The communication between the SAN management consol and the SAN fabric carries sensitive privileged configuration data. This...
    Rule Low Severity
    Show

  • Password SAN Management Console and Ports

    <GroupDescription></GroupDescription>
    Group
    Show

  • All SAN management consoles and ports are not password protected.

    &lt;VulnDiscussion&gt;Without password protection malicious users can create a denial of service by disrupting the SAN or allow the compromise of s...
    Rule High Severity
    Show

  • Default SAN Management Software Password

    <GroupDescription></GroupDescription>
    Group
    Show

  • The manufacturer’s default passwords have not been changed for all SAN management software.

    &lt;VulnDiscussion&gt;The changing of passwords from the default value blocks malicious users with knowledge of the default passwords for the manuf...
    Rule High Severity
    Show

  • SAN Fabric Zoning List Deny-By-Default

    <GroupDescription></GroupDescription>
    Group
    Show

  • The SAN fabric zoning lists are not based on a policy of Deny-by-Default with blocks on all services and protocols not required on the given port or by the site.

    &lt;VulnDiscussion&gt;By using the Deny-by-Default based policy, any service or protocol not required by a port and overlooked in the zoning list w...
    Rule High Severity
    Show

  • Logging Failed Access to Port, Protocols, Services

    <GroupDescription></GroupDescription>
    Group
    Show

  • Attempts to access ports, protocols, or services that are denied are not logged..

    &lt;VulnDiscussion&gt;Logging or auditing of failed access attempts is a necessary component for the forensic investigation of security incidents. ...
    Rule Low Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules