Free DISA STIG and SRG Library | Vaulted
  1. Security Guide Library
  2. Infrastructure L3 Switch Security Technical Implementation Guide
  3. V-18522

V-18522

Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.

Finding ID
NET-SRVFRM-003
Rule ID
SV-20061r2_rule20061r3_rule
Severity
Cat II
CCE
(None)
Group Title
ACLs must restrict access to server VLANs.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs provisioned for servers. Without proper access control of traffic entering or leaving the server VLAN, potential threats such as a denial of service, data corruption, or theft could occur, resulting in the inability to complete mission requirements by authorized users.

Fix Text

Configure an ACL to protect the server VLAN interface. The ACL must be in a deny-by-default security posture.

Check Content

Review the devicefirewall configurationprotecting the server farm to validate an ACL with a deny-by-default security posture has been implemented that secures the servers located on the VLAN. If the filter is not defined on the firewall and the architecture contains a layer 3 switch between the firewall and the server, then review the ACL configured for the VLAN interfaceon the L3 switch.

Responsibility

Information Assurance Officer

IA Controls

ECSC-1

Vaulted is more than a library.

SIGN UP FOR FREE