A KVM switch with configurable features must have the configuration protected from modification with a DoD compliant password.

From Keyboard Video and Mouse Switch STIG

Part of KVM switch configuration password.

Associated with IA controls: IAIA-2, IAIA-1

SV-6843r2_rule A KVM switch with configurable features must have the configuration protected from modification with a DoD compliant password.

Vulnerability discussion

If the KVM switch is configurable, some features that are available such as auto toggling between attached ISs are not permitted. If the configuration is not protected by a password it can be modified by any user allowing features that are not permitted. This can lead to the compromise of sensitive data.If the KVM switch has configurable features, the ISSO or SA will ensure the configuration is protected from modification with a DoD compliant password.

Check content

If the KVM switch is configurable, the reviewer will, with the assistance of the SA, try to change the configuration with a random password and with no password. If the reviewer is able to change the configuration with a random password or no password, then this is a finding. Note: The emphasis here is the protection of the configuration not the technique, if the configuration is protected as a function of a privileged user id/password sign in or by a DoD PKI (for network attached KVM switches) this fulfills this requirement.

Fix text

If the KVM switch’s configuration can be protected by a password, including user id/password combinations or PKI for network attached switches, create a DOD compliant password to protect the configuration. If the KVM switch’s configuration cannot be protected by a password, including user id/password combinations or PKI for network attached switches, replace it with a KVM switch that either has no configuration or the configuration can be protected by a password.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.