The organization must train users of unclassified Voice Video endpoints having speakerphone or microphone capability to prevent the pickup and transmission of sensitive or classified information.

From Voice Video Policy Security Technical Implementation Guide

Part of SRG-POL-300605

Associated with: CCI-001639

VVSP-01-000127_rule The organization must train users of unclassified Voice Video endpoints having speakerphone or microphone capability to prevent the pickup and transmission of sensitive or classified information.

Vulnerability discussion

Organizations consider rules of behavior based on individual user roles and responsibilities. Rules of behavior for both organizational and non-organizational users are essential for general unclassified communications and other specific or classified communications, which may require restrictions for those who may participate. The signed acknowledgment (user agreement) may be satisfied by the security awareness training and role-based security training programs conducted by organizations if such training includes rules of behavior.For Voice Video systems, the unclassified phone system typically also performs as an emergency contact system. Callers may need to report conditions for fire and emergency services (FES). Additionally, mission-critical decision-making users may need to initiate or receive high-priority calls for dissemination of crisis information using the DISN Voice Precedence services. Users must be trained to know and practice correct handling of these calls and must sign agreements prior to use. Other Voice Video systems, such as video conferencing and classified systems, may warrant additional user training and agreements.Voice Video endpoints have microphones that require special training, especially in areas where classified information may be present or discussed. These microphones are extremely sensitive and can pick up conversations anywhere within a conference room or office to be heard clearly and understood by others. The risk is the microphones can pick up sidebar conversations unrelated to the conference or call in progress. Similarly, in open areas, the Voice Video endpoint audio may be heard by bystanders who are not involved in the call and may not have a need to know.

Check content

Review the organizational Voice Video training plan. Verify the plan includes user training regarding Voice Video endpoints with speakerphone or microphone capability to potentially pick up and transmit sensitive or classified information. Prior to operating unclassified Voice Video endpoints with speakerphone or microphone capability, users must be trained specifically on the following: - Endpoint location must be limited to conference rooms, sole-use offices, and areas with sound attenuation. - All room occupants must be notified about the use of the endpoint. - All room occupants must be notified for awareness about the classification of conversations taking place. - All room occupants must be notified about their responsibility for taking the necessary precautions to ensure that the classified discussion is not overheard. - Secure endpoints must be configured to prevent speaker enablement in the non-secure mode. - Incidents of possible security compromise or violation must be reported immediately to the appropriate personnel. If the organizational Voice Video training plan does not include user training regarding Voice Video endpoints with speakerphone or microphone capability to potentially pick up and transmit sensitive or classified information, this is a finding. NOTE: This requirement is relevant for all session classification levels. The session classification is dependent on the classification of the network and facility. Classified communications may occur at the same level as the network and facility, but communications at a lower classification or no classification (e.g., Unclassified or For Official User Only [FOUO]) may also occur in the same environment.

Fix text

Document in the organizational Voice Video training plan training material that includes Voice Video endpoints with speakerphone or microphone capability to potentially pick up and transmit sensitive or classified information. Prior to operating unclassified Voice Video endpoints with speakerphone or microphone capability, users must be trained specifically on the following: - Endpoint location must be limited to conference rooms, sole-use offices, and areas with sound attenuation. - All room occupants must be notified about the use of the endpoint. - All room occupants must be notified for awareness of the classification of conversations taking place. - All room occupants must be notified about their responsibility for taking the necessary precautions to ensure that the classified discussion is not overheard. - Secure endpoints must be configured to prevent speaker enablement in the non-secure mode. - Incidents of possible security compromise or violation must be reported immediately to the appropriate personnel.

Pro Tips

Powered by sagemincer