Communications from the management console to the SAN fabric are not protected strong two-factor authentication.

Part of Management Console to SAN Fabric Authentication

SV-6778r1_rule Communications from the management console to the SAN fabric are not protected strong two-factor authentication.

Vulnerability discussion

Using two-factor authentication between the SAN management console and the fabric enhances the security of the communications carrying privileged functions. It is harder for an unauthorized management console to take control of the SAN.The preferred solution for two-factor authentication is DoD PKI implemented on the CAC or Alternative (Alt) token.

Check content

The reviewer will, with the assistance of the IAO/NSO, verify that communications from the management console to the SAN fabric are protected using DOD PKI. If another method of two-factor authentication is used, then inspect approval documentation. If two-factor authentication is not used, this is a finding. If two-factor authentication method is not DoD PKI and no approval documentation exists, this is a finding.

Fix text

Develop a plan to migrate to the use of DoD PKI authentication between the SAN management console and the SAN fabric. Obtain CM approval of the plan and implement the plan.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.