In a virtual machine remote access solution, T&D client traffic is not restricted such that all network traffic can only flow to and from the T&D zone.

From Enclave - Zone B Checklist

Part of T&D client traffic is not restricted.

Associated with IA controls: ECSC-1

SV-15081r1_rule In a virtual machine remote access solution, T&D client traffic is not restricted such that all network traffic can only flow to and from the T&D zone.

Vulnerability discussion

Virtual Machine clients provide a means for remote access into a separate enclave infrastructure using the same hardware the production client/OS resides on. As T&D environments are not always secure, this poses additional risk to the DoD desktop client or device if that device is utilizing such an architecture for remote access. Virtual machine technology permits multiple operating systems to reside on a single hardware platform, yet act as logically separate instances. In this environment, the guest operating system acts completely independent of the host operating system, however, in reality it is simulated in a contained software environment by the host system. The guest on a host system has the ability to be wholly contained and communicate independently of the host OS. Network traffic can be restricted on the guest OS and can be logically separated from any other guest or host OS on the platform.

Check content

Work with the network reviewer to determine if remote access network traffic (utilizing virtual machine systems/clients) is completely isolated and contained such that it can only flow to/from the T&D environment.

Fix text

The IAO will ensure T&D client traffic is restricted such that all network traffic can only flow to and from the T&D Zone.

Pro Tips

Powered by sagemincer