Skip to content
ATO Pathways
  Log In

I - Mission Critical Classified

Rules and Groups employed by this XCCDF Profile

  • SRG-NET-000132

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IPsec VPN Gateway must use IKEv2 for IPsec VPN security associations.

    &lt;VulnDiscussion&gt;In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e....
    Rule Medium Severity
    Show

  • SRG-NET-000132

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and L2F.

    &lt;VulnDiscussion&gt;The PPTP and L2F are obsolete method for implementing virtual private networks. Both protocols may be easy to use and readily...
    Rule Medium Severity
    Show

  • SRG-NET-000132

    <GroupDescription></GroupDescription>
    Group
    Show

  • For site-to-site VPN implementations, the L2TP protocol must be blocked or denied at the security boundary with the private network so unencrypted L2TP packets cannot traverse into the private network of the enclave.

    &lt;VulnDiscussion&gt;Unlike GRE (a simple encapsulating header) L2TP is a full-fledged communications protocol with control channel, data channels...
    Rule Medium Severity
    Show

  • SRG-NET-000138

    <GroupDescription></GroupDescription>
    Group
    Show

  • The VPN Gateway must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

    &lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to pre...
    Rule Medium Severity
    Show

  • SRG-NET-000140

    <GroupDescription></GroupDescription>
    Group
    Show

  • The VPN Gateway must use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.

    &lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to ...
    Rule High Severity
    Show

  • SRG-NET-000145

    <GroupDescription></GroupDescription>
    Group
    Show

  • The VPN Client must implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

    &lt;VulnDiscussion&gt;Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the...
    Rule Medium Severity
    Show

  • SRG-NET-000147

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TLS VPN must be configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.

    &lt;VulnDiscussion&gt;A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authen...
    Rule Medium Severity
    Show

  • SRG-NET-000147

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IPsec VPN Gateway must use anti-replay mechanisms for security associations.

    &lt;VulnDiscussion&gt;Anti-replay is an IPsec security mechanism at a packet level, which helps to avoid unwanted users from intercepting and modif...
    Rule Medium Severity
    Show

  • SRG-NET-000148

    <GroupDescription></GroupDescription>
    Group
    Show

  • The VPN Gateway must uniquely identify all network-connected endpoint devices before establishing a connection.

    &lt;VulnDiscussion&gt;Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. For...
    Rule Medium Severity
    Show

  • SRG-NET-000164

    <GroupDescription></GroupDescription>
    Group
    Show

  • The VPN Gateway, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

    &lt;VulnDiscussion&gt;Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate n...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules