STIGQter: STIG Summary: Traditional Security Checklist Version: 1 Release: 3 Benchmark Date: 15 Jun 2020: STIGQter: STIG Summary: Traditional Security Checklist Version: 1 Release: 3 Benchmark Date: 15 Jun 2020:SV-41372r3_rule
V-31190
Information Assurance - Network Connections -Unclassified Network Devices
IA-12.02.01
CAT II
10
1. All network connections (on NIPRNet or other Unclassified Network under review) such as routers, switches, and hubs must be secured within a locked communications closet/room OR secured within a cabinet if the equipment is located in a room that is accessed by personnel other than designated network system administrators (e.g., SAs specifically designated to administer the network devices) and/or those with security management oversight (e.g., ISSM, ISSO, SM).
2. If other (authorized) personnel (e.g., other than assigned system/network administrators or security management) are permitted to have unimpeded access to network devices, this authorization must be approved in writing by the site commander/director or perhaps other significant staff officer with security oversight of information systems (e.g., J6, ISSM). The documentation must include a justification indicating why the unimpeded/unescorted access is mission essential. This access allowance must be limited to very few personnel and not provided for mere convenience.
3. The locked room or cabinet must be adequately secured so that it cannot be easily accessed without forcible entry.
4. Proper key control procedures must be in place for associated keys used to secure doors to communications rooms AND equipment cabinets.
NOTE: Because locks and keys to equipment cabinets are often inferior and do not provide for adequate physical protection it is recommended that a metal hasp be attached (using rivets or other means that cannot be removed without evidence of forcible entry) to equipment cabinets securing network equipment. General Services Administration (GSA) Medium Security Keyed Padlocks or (preferably) the S&G 8077 Changeable Combination Padlock should then be used to secure the cabinet using the hasp.
1. Check that ALL network connections (on NIPRNet or other Unclassified Network under review) such as routers, switches, and hubs are secured in a locked communications closet/room OR secured in a locked equipment cabinet if the equipment is located in a room that is accessed by personnel other than designated network system administrators (e.g., SAs specifically designated to administer the network devices) and/or those with security management oversight (e.g., ISSM, ISSO, SM). The intent is to ensure that only Network Administrators and other (authorized) personnel are the only persons with unimpeded access to the Network Connections.
2. If other (authorized) personnel (e.g., other than assigned system/network administrators or security management) are permitted to have unimpeded access to network devices, this authorization must be approved in writing by the site commander/director or perhaps other significant staff officer with security oversight of information systems (e.g., J6, ISSM). The documentation must include a justification indicating why the unimpeded/unescorted access is mission essential. This access allowance must be limited to very few personnel and not provided for mere convenience.
3. Ensure the locked room or cabinet cannot be easily accessed without forcible entry. Also ensure that proper key control procedures are used for ALL keys associated with both communication room doors and/or equipment cabinet doors.
4. ANY discrepancies with the above guidelines will result in a finding.
TACTICAL ENVIRONMENT: The check is applicable for fixed tactical processing environments. It is assumed the type of equipment referenced will be in a fixed environment. Not applicable to a field/mobile environment.
V-31190
False
IA-12.02.01
1. Check that ALL network connections (on NIPRNet or other Unclassified Network under review) such as routers, switches, and hubs are secured in a locked communications closet/room OR secured in a locked equipment cabinet if the equipment is located in a room that is accessed by personnel other than designated network system administrators (e.g., SAs specifically designated to administer the network devices) and/or those with security management oversight (e.g., ISSM, ISSO, SM). The intent is to ensure that only Network Administrators and other (authorized) personnel are the only persons with unimpeded access to the Network Connections.
2. If other (authorized) personnel (e.g., other than assigned system/network administrators or security management) are permitted to have unimpeded access to network devices, this authorization must be approved in writing by the site commander/director or perhaps other significant staff officer with security oversight of information systems (e.g., J6, ISSM). The documentation must include a justification indicating why the unimpeded/unescorted access is mission essential. This access allowance must be limited to very few personnel and not provided for mere convenience.
3. Ensure the locked room or cabinet cannot be easily accessed without forcible entry. Also ensure that proper key control procedures are used for ALL keys associated with both communication room doors and/or equipment cabinet doors.
4. ANY discrepancies with the above guidelines will result in a finding.
TACTICAL ENVIRONMENT: The check is applicable for fixed tactical processing environments. It is assumed the type of equipment referenced will be in a fixed environment. Not applicable to a field/mobile environment.
M
2506