Free DISA STIG and SRG Library | Vaulted

V-7011

The network element’s auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.

Finding ID
NET1629
Rule ID
SV-15446r2_rule
Severity
Cat III
CCE
(None)
Group Title
The auxiliary port is not disabled.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network. Secured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.

Fix Text

Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.

Check Content

Review the configuration and verify that the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected to it. The following configuration disables the Cisco IOS auxiliary port: line aux 0 no exec Note: The command transport input none must be configured under the line aux 0. However, this is the default and will not be shown in the running configuration.

Responsibility

Information Assurance Officer