The DISN NIPRNet IPVS firewall (EBC) is NOT configured to drop (and not process) all signaling packets except those whose integrity is validated.

From Voice/Video over Internet Protocol (VVoIP) STIG

Part of Deficient EBC config: Signaling integrity

SV-21809r1_rule The DISN NIPRNet IPVS firewall (EBC) is NOT configured to drop (and not process) all signaling packets except those whose integrity is validated.

Vulnerability discussion

The validation of signaling packet integrity is required to ensure the packet has not been altered in transit. Packets can be altered in a couple of ways. The first is modification by uncontrollable network events such as bit errors and packet truncation that would cause the packet to contain erroneous information. Packets containing detectable errors must not be processed since the effect of doing so is unknown and most likely not good. The second could be modification by a man-in-the-middle. NOTE: The USR mandates the packets be hashed upon transmission and receipt using HMAC-SHA1-160 with 160 bit keys and the validation of the hash of the received packet against the transmitted hash.

Check content

Interview the IAO to confirm compliance with the following requirement: Ensure the DISN NIPRNet IPVS firewall (EBC) is configured to drop (and not process) all signaling packets except those whose integrity is validated. This is a finding in the event the EBC does not validate the integrity of the received signaling packets.

Fix text

Ensure the DISN NIPRNet IPVS firewall (EBC) is configured to drop (and not process) all signaling packets except those whose integrity is validated. NOTE: HMAC-SHA1-160 with 160 bit keys is used for this purpose as directed by the UCR.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.