Zone B egress traffic is not restricted via source and destination filtering as well and ports, protocols and services. Zone B traffic is not restricted to facilitate system testing.

Part of Zone B network traffic is not restricted.

Associated with IA controls: ECSC-1

SV-15071r1_rule Zone B egress traffic is not restricted via source and destination filtering as well and ports, protocols and services. Zone B traffic is not restricted to facilitate system testing.

Vulnerability discussion

The systems that reside in Zone B require external access utilizing a DoD network as the transport mechanism. Logical access control mechanisms will be utilized at the network boundary such as strictly controlled ACLs with no ingress traffic origination and established sessions only. The guidance for Zone B systems is restricted to unclassified DoD networks. Test or development traffic will be isolated/separated from production traffic. Downloading software from the Internet is acceptable in Zone B, however, a DMZ with gateway must be established for such purposes.

Check content

Work with the network reviewer to determine if ACLs are in place to restrict egress traffic from a Zone B test environment. ACLs as well as PPS are restricted to only allow for system testing via a gateway.

Fix text

The IAO will ensure external (egress) outbound traffic from the test environment is restricted by source and destination ACLs as well as ports and protocols and is only permitted to facilitate system testing.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.