The organization must document remote access to the Voice Video system.

From Voice Video Policy Security Technical Implementation Guide

Part of SRG-POL-400005

Associated with: CCI-000063

VVSP-01-000023_rule The organization must document remote access to the Voice Video system.

Vulnerability discussion

Remote access is connection to organizational information systems by users communicating through external networks (e.g., the Internet). Organizations often employ encrypted virtual private networks (VPNs) to enhance confidentiality and integrity over remote connections. The use of encrypted VPNs does not make the access non-remote; however, the use of VPNs, when adequately provisioned with appropriate security controls (e.g., employing appropriate encryption techniques for confidentiality and integrity protection) may provide sufficient assurance to the organization that it can effectively treat such connections as internal networks.Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. Also, VPNs with encrypted tunnels can affect the organizational capability to adequately monitor network communications traffic for malicious code.

Check content

Review the Voice Video system design documents. All remote access to the Voice Video system must be fully documented. Ensure traffic from a Unified Capabilities (UC) soft client, operated in a remote-access scenario and using an encrypted VPN as required, is routed to the VoIP VLAN so the separation of the voice and data zones is not degraded while all other traffic is routed to the data zone. Ensure traffic from a video conferencing (VC) soft client, operated in a remote-access scenario and using an encrypted VPN as required, is routed to the Video VLAN without degrading other traffic routed to the voice and data zones. Inspect network diagrams to determine if the boundary and remote access VLAN architecture properly routes Voice Video traffic from the VPN to the voice and video VLANs while maintaining proper flow control and access between the data VLANs and the Voice Video VLANs. If the Voice Video system design does not fully document all remote access to the Voice Video system, this is a finding. If the boundary and remote access VLAN architecture does not properly route Voice Video traffic from the VPN to the Voice Video VLANs while maintaining proper flow control and access between the data VLANs and the Voice Video VLANs, this is a finding.

Fix text

The organization must document all remote access to the Voice Video system. Design the traffic from a UC soft client, operated in a remote-access scenario and using an encrypted VPN as required, to be routed to the VoIP VLAN such that the separation of the voice and data zones is not degraded while all other traffic is routed to the data zone. Design the traffic from a VC soft client, operated in a remote-access scenario and using an encrypted VPN as required, to be routed to the Video VLAN without degrading other traffic routed to the voice and data zones. Design and configure the enclave boundary and remote access VLAN architecture to properly route VoIP traffic from the VPN to the voice VLANs and maintain proper flow control and access between the data VLANs and the voice VLANs.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer