DEFENSE SWITCHED NETWORK INFORMATION ASSURANCE ...

More documents

Recommendations

Info

LEGEND: ASLAN Assured Services Local Area Network DSN Defense Switched Network Gbps Giga-bytes per second IIS Internet Information Service IP Internet Protocol Mbps Mega-bytes per second MS Microsoft Num Number RADIUS Remote Authentication Dial-in User Server/Service 7 RAE Require Ancillary Equipment SP Service Pack SQL Structured Query Language T-1 T-Carrier 1 VLAN Virtual Local Area Network Win Windows Win2k Windows 2000 Win2k3 Windows 2003 Figure 2. Sample Diagram Functionality Tests. Testing the SUT's functionality ensures that the product operates as designed in a fielded production environment. Results due to services not functioning correctly, disabled services, and applications not communicating correctly can provide a false sense of security because not all aspects of the test product were evaluated. Completing the functionality test at the beginning and end of every phase of testing ensures that any settings or changes made during testing did not affect the functionality of the product. Functionality testing will vary from test to test, depending on the SUT. The functionality test will target basic operational functions. It is not an interoperability test.
Some products, such as CPE, rely on external systems to exercise their capabilities. For example, a secure modem solution does not function unless an external switch initiates a call. In this case, the external switch is outside the scope of the IA test; however, the tester and vendor must ensure it is operational to perform testing on the secure modem solution. While conducting functionality tests, IP traffic is monitored (sniffed) and saved at the conclusion of the functionality test for further evaluation, if necessary. Security Technical Implementation Guidelines (STIG) Assessment Methodology. The DoD uses STIG’s to strengthen and assess the security posture of a system or component. Findings resulting from applying the Gold Disks and scripts are indications of weaknesses in the security posture of the system or component. Findings from the STIG’s are grouped into three Categories (CAT) based on the severity of the weakness. The findings will correspond to IA Controls that are listed in Appendix B and annotated on the DIACAP Scorecard, as shown in Appendix E. The scorecard is a summary report illustrating the certified or accredited implementation status of a DoD information system’s assigned IA Controls. It supports or conveys a certification determination and/or accreditation decision. The DIACAP Scorecard is intended to convey information about the IA posture of a DoD information system in a format that can be easily understood by managers and be easily exchanged electronically. The DIACAP is the DoD process for identifying, implementing, validating, certifying, and managing IA capabilities and services, expressed as IA Controls, and authorizing the operation of DoD information systems in accordance with statutory, federal, and DoD requirements. The following list shows the high-level procedures for Phase I testing: 1. Apply STIG/Security Readiness Reviews (SRR)/Checklists • Validate SUT is operational and conduct functionality checks before starting the assessment. • Determine the Management Interface—The management interface contains software that maintains the SUT and its underlying capabilities. This may consist of multiple software applications. Consider any additional software application(s) that manage hardware associated with the solution that are a management interface or control panel. • The DoDI 8500.2 defines Mission Assurance Category (MAC) I as “Systems categorized as ‘MAC I’ process data that is vital to the operational readiness or mission effectiveness in terms of both content and timeliness. MAC I systems require high confidentiality, integrity, and availability to accomplish their missions; therefore, they are categorized as critical network components.” The IATT always tests the SUT at the MAC I level. The confidentiality level is always Sensitive But Unclassified for the SUT. 8
Page 1 and 2: DEFENSE INFORMATION SYSTEMS AGENCY
Page 3 and 4: DEFENSE SWITCHED NETWORK INFORMATIO
Page 5 and 6: EXECUTIVE SUMMARY The Department of
Page 7 and 8: TABLE OF CONTENTS iii Page EXECUTIV
Page 9 and 10: TABLE OF CONTENTS (continued) LIST
Page 11 and 12: SUMMARY OF CHANGES Editor/Approver
Page 13 and 14: The DSN provides end-to-end command
Page 15 and 16: implementing a security baseline, p
Page 17: • Apply applicable STIGs and subm
Page 21 and 22: e. System Requirements, Maximum Tra
Page 23 and 24: 8. Conduct Service Enumeration Serv
Page 25 and 26: (The page intentionally left blank.
Page 27 and 28: IAM Information Assurance Manager I
Page 29 and 30: (The page intentionally left blank.
Page 31 and 32: Table B-1. STIG Listing STIG Descri
Page 33 and 34: Table B-1. STIG Listing (continued)
Page 35 and 36: Figure B-2. NSA Website B-4. MICROS
Page 37 and 38: compliant, non-compliant, or not ap
Page 39 and 40: Within the delivered scorecard, the
Page 41 and 42: Absinthe (SQL injection) Arpoison (
Page 43 and 44: APPENDIX C TEST PREPARATION DOCUMEN
Page 45 and 46: DSN IA Test Team Test Preparation D
Page 47 and 48: DSN IA Test Team Test Preparation D
Page 49 and 50: APPENDIX D DSN ARCHITECTURE The Def
Page 51 and 52: APPENDIX E ASSESSMENT OBJECTIVES, C
Page 53 and 54: STIG. Not all checklists have paren
Page 55 and 56: HKLM\SYSTEM\CurrentControlSet\Servi
Page 57 and 58: Figure E-3. Configure Your Computer
Page 59 and 60: Table E-1. Gold Disk Minimum System
Page 61 and 62: Table E-3. DISA Gold Disk Test Proc
Page 63 and 64: Procedures (continued) Table E-5. S
Page 65 and 66: Table E-6. Additional IA Requiremen
Page 67 and 68: Table E-6. Additional IA Requiremen
Page 69 and 70:
Table E-7. IPv6 Requirements Test C
Page 71 and 72:
Table E-7. IPv6 Requirements (conti
Page 73 and 74:
NOTE 2: There is no requirement tha
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
Page 85 and 86:
Page 87 and 88:
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
106 (continued) Table E-7. IPv6 Req
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
Page 117 and 118:
Page 119 and 120:
3. Post Test. An IA Assessment Draf
Page 121 and 122:
7. System Under Test (SUT) Test Pro
Page 123 and 124:
Table E-9. TCP Sweep Test Procedure
Page 125 and 126:
Table E-12. Service Enumeration Tes
Page 127 and 128:
types of applications they are desi
Page 129 and 130:
(SQL) injection through web interfa
Page 131 and 132:
• Use TCP fragments in reverse or
Page 133 and 134:
Locater (URL) encoding string, sess
Page 135 and 136:
Figure E-8. Function Keys (3) Captu
Page 137 and 138:
1. Level 1 - T1/E1 Signal, Sync AIS
Page 139 and 140:
(d) Add additional Information Elem
Page 141 and 142:
(10) Key - F10 - Help. See Figure E
Page 143 and 144:
Figure E-21. Configuration Level 3
Page 145 and 146:
Figure E-25. Configure Level 1 (3)
Page 147 and 148:
f. SS7 Examples (1) SS7 Network Exa
Page 149 and 150:
APPENDIX F DOD INFORMATION ASSURANC
Page 151 and 152:
The DIP should contain the followin
Page 153 and 154:
APPENDIX G REFERENCES Department of
Page 155 and 156:
Napier, Michael JITC Action Officer
show all

DEFENSE SWITCHED NETWORK INFORMATION ASSURANCE ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?