Written user agreements for all users authorized to use the KVM or A/B switch are not being maintained..

From Keyboard, Video, Mouse Switch Security STIG

Part of KVM Users Agreement

Associated with IA controls: PRRB-1

SV-6823r1_rule Written user agreements for all users authorized to use the KVM or A/B switch are not being maintained..

Vulnerability discussion

A written users agreement allows the IAO to be certain the end user that will be using the equipment has been presented with the documentation that explains their duties and responsibilities in relation to the equipment and that they have acknowledged that they have read the documentation and understand it. Though there is no guarantee that user will perform as required, it will lessen the problems caused by uninformed users.The IAO will maintain written user agreements for all users authorized to use the KVM or A/B switch.

Check content

The reviewer will interview the IAO and view the written agreements. The agreement will require the user to perform the following. 1. Logging onto an IS. a. Identify the classification of the IS currently selected. b. Use the login and passwords appropriate for that IS. c. Verify the classification of the present IS by checking the classification label/banner. d. Begin processing. 2. Switching between ISs. a. Screen lock the IS you are currently working on if the IS supports this capability. b. Select the desired IS with the switch. c. Enter your user identifier and password to deactivate the screen lock on the newly selected IS. d. Verify the classification of the present IS by checking the classification label/banner. e. Begin processing. The agreement may state that the user has read and understands the SFUG sections dealing with the KVM switch usage if the SFUG or similar documentation exists.

Fix text

Develop a user agreement, have each user of KVM or A/B switches sign a the user agreement, and keep the signed agreement on file.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer