Inadequate “operator/facilitator/administrator” access control for remote monitoring of a VTU connected to an IP network.

Associated with IA controls: ECSC-1, IAIA-2, DCBP-1, IAIA-1

SV-18727r1_rule Inadequate “operator/facilitator/administrator” access control for remote monitoring of a VTU connected to an IP network.

Vulnerability discussion

Activation and use of remote monitoring and control features such as those discussed here and in RTS-VTC 1160.00 must be protected by access control. Minimally this must be the administrator password; however, access to this feature should not give full administrator access.

Check content

[IP]; Interview the IAO to validate compliance with the following requirement: In the event the VTU is connected to an IP network ensure access to IP remote monitoring and associated control functions of the VTU is minimally protected by a password. Note: During APL testing, this is a finding in the event this requirement is not supported by the VTU. i.e., remote monitoring must be able to have a password set in order to access remote monitoring features. Verify that an administrator password is required to access remotely accessible VTU. Have the IAO or SA demonstrate compliance with the requirement.

Fix text

[IP]; Perform the following tasks: If IP remote monitoring is activated, configure the VTU to require a password before permitting access to the remote monitoring and associated control functions.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.