Skip to content
ATO Pathways
  Log In

III - Administrative Classified

Rules and Groups employed by this XCCDF Profile

  • Hard zoning is not used to protect the SAN.

    <GroupDescription></GroupDescription>
    Group
    Show

  • Hard zoning is not used to protect the SAN.

    &lt;VulnDiscussion&gt;Risk: In a SAN environment, we potentially have data with differing levels or need-to-know stored on the same "system". A h...
    Rule High Severity
    Show

  • Compliance with Network Infrastructure and Enclave

    <GroupDescription></GroupDescription>
    Group
    Show

  • The SANs are not compliant with overall network security architecture, appropriate enclave, and data center security requirements in the Network Infrastructure STIG and the Enclave STIG

    &lt;VulnDiscussion&gt;Inconsistencies with the Network Infrastructure STIG, the Enclave STIG, and the SAN implementation can lead to the creation o...
    Rule Medium Severity
    Show

  • All security related patches are not installed.

    <GroupDescription></GroupDescription>
    Group
    Show

  • All security related patches are not installed.

    &lt;VulnDiscussion&gt;Failure to install security related patches leaves the SAN open to attack by exploiting known vulnerabilities. The IAO/NSO wi...
    Rule Medium Severity
    Show

  • Component Compliance with applicable STIG

    <GroupDescription></GroupDescription>
    Group
    Show

  • Prior to installing SAN components (servers, switches, and management stations) onto the DOD network infrastructure, components are not configured to meet the applicable STIG requirements.

    &lt;VulnDiscussion&gt;Many SAN components (servers, switches, management stations) have security requirements from other STIGs. It will be verifie...
    Rule Medium Severity
    Show

  • Servers and hosts OS STIG Requirements

    <GroupDescription></GroupDescription>
    Group
    Show

  • Servers and other hosts are not compliant with applicable Operating System (OS) STIG requirements.

    &lt;VulnDiscussion&gt;SAN servers and other hosts are hardware software combinations that actually run under the control of a native OS found on th...
    Rule Medium Severity
    Show

  • Anti-virus on servers and host.

    <GroupDescription></GroupDescription>
    Group
    Show

  • Vendor supported, DOD approved, anti-virus software is not installed and configured on all SAN servers in accordance with the applicable operating system STIG on SAN servers and management devices and kept up-to-date with the most recent virus definition tables.

    &lt;VulnDiscussion&gt;The SAN servers and other hosts are subject to virus and worm attacks as are any systems running an OS. If the anti-virus so...
    Rule High Severity
    Show

  • SAN Topology Drawing

    <GroupDescription></GroupDescription>
    Group
    Show

  • A current drawing of the site’s SAN topology that includes all external and internal links, zones, and all interconnected equipment is not being maintained.

    &lt;VulnDiscussion&gt;A drawing of the SAN topology gives the IAO and other interested individuals a pictorial representation of the SAN. This can...
    Rule Medium Severity
    Show

  • Physical Access to SAN Network Devices

    <GroupDescription></GroupDescription>
    Group
    Show

  • All the network level devices interconnected to the SAN are not located in a secure room with limited access.

    &lt;VulnDiscussion&gt;If the network level devices are not located in a secure area they can be tampered with which could lead to a denial of servi...
    Rule Medium Severity
    Show

  • SAN Fabric Switch User Accounts with Passwords

    <GroupDescription></GroupDescription>
    Group
    Show

  • Individual user accounts with passwords are not set up and maintained for the SAN fabric switch.

    &lt;VulnDiscussion&gt;Without identification and authentication unauthorized users could reconfigure the SAN or disrupt its operation by logging in...
    Rule Medium Severity
    Show

  • Fabric Switches do not have bidirectional authentication

    <GroupDescription></GroupDescription>
    Group
    Show

  • The SAN must be configured to use bidirectional authentication.

    &lt;VulnDiscussion&gt;Switch-to-switch management traffic does not have to be encrypted. Bidirectional authentication ensures that a rogue switch c...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules