Title

The Cisco ACI must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the device. (Cat II impact)

Discussion

Display of the DOD-approved use notification before granting access to the Cisco ACI ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users.

Check Content

1. On the APIC menu bar, choose System >> System Settings. 2. In the Navigation pane, click "System Alias and Banners". 3. In the "Work" pane, click the verify the Controller CLI Banner, Switch CLI Banner, and GUI Banner (URL) are configured to display the text below. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the banner is not presented, this is a finding.

Fix Text

The CLI banner is a simple text string to be printed at the terminal before the password prompt. A banner can be defined for the APIC CLI and a separate banner for the switch CLI. The GUI banner displays at the APIC URL before user login authentication. The GUI banner is defined as a URL of a site hosting the desired HTML. 1. In the GUI menu bar, navigate to System >> System Settings >> APIC Identification Preferences. 2. In the Navigation pane, select "System Alias and Banners". 3. In the "Work" pane, copy and paste the banner below in the exact format for each banner type, then click "Submit". 4. To configure an APIC GUI banner, type the URL of a site hosting the desired HTML into the GUI Banner (URL) textbox. The URL site owner must allow the site to be placed in an iFrame to display the informational banner. If the owner of the site sets the x-frame-optiontodenyorsameorigin, the site the URL points to will not appear. Refer to the vendor guide for more details. 5. Click "Submit". The banner must read exactly as follows: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

Additional Identifiers

Rule ID: SV-271918r1114335_rule

Vulnerability ID: V-271918

Group Title: SRG-APP-000068-NDM-000215

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.