The Voice Video Endpoint must prevent unauthorized and unintended information transfer via shared system resources.

From Voice Video Endpoint Security Requirements Guide

Associated with: CCI-001090

SV-81259r1_rule The Voice Video Endpoint must prevent unauthorized and unintended information transfer via shared system resources.

Vulnerability discussion

Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. Unified capability (UC) and videoconferencing (VC) vendors have included capabilities in products that must be disabled for users. Many current UC and VC products include hooks into email, IM, and local file transfer. Peer networking options allowing transfer often use holding storage locations that are accessible to all users. This would allow potentially sensitive information to be shared without central control.

Check content

Verify the Voice Video Endpoint prevents unauthorized and unintended information transfer via shared system resources. If the Voice Video Endpoint does not prevent unauthorized and unintended information transfer via shared system resources, this is a finding.

Fix text

Configure the Voice Video Endpoint to prevent unauthorized and unintended information transfer via shared system resources.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.