DEFENSE SWITCHED NETWORK INFORMATION ASSURANCE ...

More documents

Recommendations

Info

Part One of the APL Certification Process is the IA certification testing. If the product does not meet the requirements for IA certification, the solution is returned to the vendor for correction and the testing cycle starts over. If the solution meets the requirements for IA certification, it then continues with Part Two of the test cycle, IO testing. LEGEND: APL Approved Products List DAA Designated Approving Authority DISN Defense Information System Network DSN Defense Switched Network 5 IA Information Assurance IO Interoperability JIC Joint Intelligence Center Figure 1. APL Certification Process Flow The following is a brief overview of the UC IA testing process and provides the vendor a starting point: • Coordinate payment of lab testing fees/ Cooperative Research And Development Agreement (CRADA) agreements with Action Officer (AO). • Download APL Test Bundle at . Review bundle and submit documentation In Accordance With the APL Documentation Guide, which is included in the APL Test Bundle.
• Apply applicable STIGs and submit to UCCO within 2 weeks before scheduled test window. • The UCCO receives and reviews the test submittal package from the applicant. A tracking number is assigned to the solution and the package is provided to the Government AO. The Action Officer will contact the vendor with further instructions. • Provide on-site engineering support for the SUT during all phases of testing. • Once the DSN-UCCO has assigned the vendor a tracking number, the DSN- UCCO in coordination with the IATT will assign testing dates. The vendor is required to submit a self-assessment report. TESTING METHODOLOGY This section describes the methodology used and the steps taken during the various phases of testing. Due to the sensitive nature of testing, all data collected is treated as sensitive and exempt from the Freedom of Information Act. All tests consist of obtaining vendor documentation, conducting an official initial contact meeting, which provides the test requirements, conducting a functionality test before and after each phase of testing, and then conducting an outbrief, which leads to the Final IA Assessment Report. Appendix E contains detailed procedures. Documentation. Reviewing vendor documentation is vital to successful testing. While testing every possible scenario within the vendor scope is not possible, understanding the product’s general use, features, and functionality assists the test team in its evaluation. The documentation and information includes the vendor’s web page, product manuals, whitepapers, newsgroups, forums, user mailing lists, and vendor selfassessments. The team reviews these, as well as other documents, to understand the products they are evaluating and to find possible weaknesses and vulnerabilities that may have been discovered by other sources. The Test Preparation document generated during the first phase of testing contains the vendor and tester contact information, IP addresses, test equipment hardware, software and version information, IP phone information, and other applicable information to the testers. Figure 2 depicts a sample vendor diagram that is used to aid the tester and reader in understanding how the system interconnects. An example of the test preparation document is located in Appendix C, Test Preparation Document. The signature page of this document clarifies that all hardware, software, and version information is correct. The testers sign and deliver the packet to the next phase of testing tester when they are finished; when all IA phases are completed, the packet is turned over to the IO tester for verification and is used to minimize duplicate efforts. The vendor and the testers will verify all hardware and software before IO Testing begins. 6
Page 1 and 2: DEFENSE INFORMATION SYSTEMS AGENCY
Page 3 and 4: DEFENSE SWITCHED NETWORK INFORMATIO
Page 5 and 6: EXECUTIVE SUMMARY The Department of
Page 7 and 8: TABLE OF CONTENTS iii Page EXECUTIV
Page 9 and 10: TABLE OF CONTENTS (continued) LIST
Page 11 and 12: SUMMARY OF CHANGES Editor/Approver
Page 13 and 14: The DSN provides end-to-end command
Page 15: implementing a security baseline, p
Page 19 and 20: Some products, such as CPE, rely on
Page 21 and 22: e. System Requirements, Maximum Tra
Page 23 and 24: 8. Conduct Service Enumeration Serv
Page 25 and 26: (The page intentionally left blank.
Page 27 and 28: IAM Information Assurance Manager I
Page 29 and 30: (The page intentionally left blank.
Page 31 and 32: Table B-1. STIG Listing STIG Descri
Page 33 and 34: Table B-1. STIG Listing (continued)
Page 35 and 36: Figure B-2. NSA Website B-4. MICROS
Page 37 and 38: compliant, non-compliant, or not ap
Page 39 and 40: Within the delivered scorecard, the
Page 41 and 42: Absinthe (SQL injection) Arpoison (
Page 43 and 44: APPENDIX C TEST PREPARATION DOCUMEN
Page 45 and 46: DSN IA Test Team Test Preparation D
Page 47 and 48: DSN IA Test Team Test Preparation D
Page 49 and 50: APPENDIX D DSN ARCHITECTURE The Def
Page 51 and 52: APPENDIX E ASSESSMENT OBJECTIVES, C
Page 53 and 54: STIG. Not all checklists have paren
Page 55 and 56: HKLM\SYSTEM\CurrentControlSet\Servi
Page 57 and 58: Figure E-3. Configure Your Computer
Page 59 and 60: Table E-1. Gold Disk Minimum System
Page 61 and 62: Table E-3. DISA Gold Disk Test Proc
Page 63 and 64: Procedures (continued) Table E-5. S
Page 65 and 66: Table E-6. Additional IA Requiremen
Page 67 and 68:
Table E-6. Additional IA Requiremen
Page 69 and 70:
Table E-7. IPv6 Requirements Test C
Page 71 and 72:
Table E-7. IPv6 Requirements (conti
Page 73 and 74:
NOTE 2: There is no requirement tha
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
Page 85 and 86:
Page 87 and 88:
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
106 (continued) Table E-7. IPv6 Req
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
Page 117 and 118:
Page 119 and 120:
3. Post Test. An IA Assessment Draf
Page 121 and 122:
7. System Under Test (SUT) Test Pro
Page 123 and 124:
Table E-9. TCP Sweep Test Procedure
Page 125 and 126:
Table E-12. Service Enumeration Tes
Page 127 and 128:
types of applications they are desi
Page 129 and 130:
(SQL) injection through web interfa
Page 131 and 132:
• Use TCP fragments in reverse or
Page 133 and 134:
Locater (URL) encoding string, sess
Page 135 and 136:
Figure E-8. Function Keys (3) Captu
Page 137 and 138:
1. Level 1 - T1/E1 Signal, Sync AIS
Page 139 and 140:
(d) Add additional Information Elem
Page 141 and 142:
(10) Key - F10 - Help. See Figure E
Page 143 and 144:
Figure E-21. Configuration Level 3
Page 145 and 146:
Figure E-25. Configure Level 1 (3)
Page 147 and 148:
f. SS7 Examples (1) SS7 Network Exa
Page 149 and 150:
APPENDIX F DOD INFORMATION ASSURANC
Page 151 and 152:
The DIP should contain the followin
Page 153 and 154:
APPENDIX G REFERENCES Department of
Page 155 and 156:
Napier, Michael JITC Action Officer
show all

DEFENSE SWITCHED NETWORK INFORMATION ASSURANCE ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?