DEFENSE SWITCHED NETWORK INFORMATION ASSURANCE ...

2. Collect Data
• Document findings
o Note any findings deemed not applicable
o Note any fixes performed by the vendor
o Note any findings deemed as false positives
• Document test limitations
• Validate SUT is operational and conduct functionality checks after completion
of assessment
3. Perform Data Analysis and Report Results
Data collected from the STIG, their respective Checklists, and any SRR scripts
will be analyzed to accomplish the following assessment objectives:
• Identify and attempt to eliminate “false positive” results.
• Highlight and categorize findings according to their level of importance,
whether vulnerabilities are CAT I (high), CAT II (medium), or CAT III (low).
• Provide recommendations to remediate or mitigate the risks.
Additional IA Testing Methodology. The design of IA Generic Requirement (GR)-815
CORE testing focuses on the proper protection of the SUT’s control panel, security log,
and transferred data through encryption, as well as conformance to acceptable security
standards. The test team incorporated GR-815 requirements to STIG requirements,
and developed additional test procedures in the DIACAP Scorecard to address GR-815
requirements that are not validated via the STIGs. There are 19 test procedures
included in Appendix E, to support GR-815 requirements testing not supported by STIG.
Unified Capabilities Requirements (UCR) IA Internet Protocol version 6 (IPv6)
Methodology. The UCR IA IPv6 Requirements section is used to verify that the tested
system can create or receive, process, and send or forward (as appropriate) IPv6
packets in mixed IPv4/v6 environments. The UCR IA IPv6 requirements have been
implemented relating to voice telecommunications equipment specific to IPv6 Profile
Categories. Networks that can receive, process, and forward IPv6 packets from/to
devices within the same network and from/to other networks and systems, where those
networks and systems may be operating with only IPv4, only IPv6, or both IPv4 and
IPv6. An IPv6 capable network shall be ready to have IPv6 enabled for operational use,
when mission need or business case dictates. Specifically, an IPv6 capable network
must meet the following:
a. Use IPv6 Capable Products.
b. Accommodate IPv6 in network infrastructures, services, and management tools and
applications.
c. Conform to DoD and NSA-developed IPv6 network security implementation guidance.
d. Manage, administer, and resolve IPv6 addresses in compliance with the DoD IPv6
Address Plan when enabled.
9