The fabric switches are not protected by encryption and DOD PKI and/or that the manufacturer’s default keys have not been changed prior to attaching to the SAN Fabric for SANs processing sensitive information..

Part of SAN Switch encryption and DOD PKI

Associated with IA controls: ECNK-1, IAIA-2, IAIA-1

SV-6768r2_rule The fabric switches are not protected by encryption and DOD PKI and/or that the manufacturer’s default keys have not been changed prior to attaching to the SAN Fabric for SANs processing sensitive information..

Vulnerability discussion

Failure to provide encryption for SAN switches that handle sensitive data can lead to the compromise of sensitive data. DOD PKI will supplies better protection from malicious attacks than userid/password authentication and should be used anytime it is feasible. If manufactures default keys are not changed prior to connection to the network the switch will be vulnerable to malicious attacks by individuals who know these keys.The IAO/NSO will ensure that fabric switches are protected by encryption and DOD PKI and that the manufacturer’s default keys are changed prior to attaching to the SAN Fabric for SANs processing sensitive information.

Check content

The reviewer will, with the assistance of the IAO/NSO, verify that fabric switches are protected by encryption and DOD PKI and that the manufacturer’s default keys are changed prior to attaching to the SAN Fabric for SANs processing sensitive information.

Fix text

Develop a plan to implement encryption, DOD PKI and change the manufacturers default keys. Obtain CM approval for the plan and then execute the plan.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.