STIGQter: STIG Summary: Voice Video Services Policy Security Technical Implementation Guide Version: 3 Release: 17 Benchmark Date: 25 Oct 2019:

An inventory of authorized instruments is NOT documented or maintained in support of the detection of unauthorized instruments connected to the VoIP system.

DISA Rule

SV-8785r1_rule

Vulnerability Number

V-8290

Group Title

Deficient doc’n: Inventory of authorized endpoints

Rule Version

VVoIP 1505 (GENERAL)

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Ensure that an inventory of authorized instruments is documented and maintained.
NOTE: This inventory will be separate from the inventory created within the Local Session Controller (LSC) from the listing of registered instruments. Authorized instruments must be added to this inventory before configuration in the LSC and instrument registration. The inventory may be offline or online on a separate server or workstation from the LSC (for example, the LSC management workstation).

Prepare and maintain an inventory / database of authorized VoIP instruments. Generate and store the inventory on a separate workstation or server from the LSC (for example, the LSC management workstation).

Recommendation: Create the inventory in a format that can easily be compared through automation to the report of registered instruments from the LSC (if available). This will facilitate regular review of the inventory to detect unauthorized instruments and will make the IA review easier.

Check Contents

Interview the IAO and review site documentation to confirm compliance with the following requirement: Ensure that an inventory of authorized instruments is documented and maintained.

Inspect the authorized instrument inventory.

NOTE: This inventory will be separate from the inventory created within the Local Session Controller (LSC) from the listing of registered instruments. Authorized instruments must be added to this inventory before configuration in the LSC and instrument registration. The inventory may be offline or online on a separate server or workstation from the LSC (for example, the LSC management workstation).

This is a finding if the inventory does not exist, does not appear to be up to date.

Ask how this inventory is generated and where it is stored. This is a finding in the event it is located on the LSC.

Vulnerability Number

V-8290

Documentable

False

Rule Version

VVoIP 1505 (GENERAL)

Severity Override Guidance

Interview the IAO and review site documentation to confirm compliance with the following requirement: Ensure that an inventory of authorized instruments is documented and maintained.

Inspect the authorized instrument inventory.

NOTE: This inventory will be separate from the inventory created within the Local Session Controller (LSC) from the listing of registered instruments. Authorized instruments must be added to this inventory before configuration in the LSC and instrument registration. The inventory may be offline or online on a separate server or workstation from the LSC (for example, the LSC management workstation).

This is a finding if the inventory does not exist, does not appear to be up to date.

Ask how this inventory is generated and where it is stored. This is a finding in the event it is located on the LSC.

Check Content Reference

I

Potential Impact

Unauthorized use or abuse of the system

Responsibility

Information Assurance Officer

Target Key

594

Comments