Title

The KVM switch must be configured to encapsulate and send USB connections other than KVM connections. (Cat I impact)

Discussion

Some network attached KVM switched can encapsulate USB connections other than the keyboard, video monitor, and mouse connections. This connection could be a disk drive connection and could allow the transfer of data between the ISs attached to the KVM switch and the client system attached via IP to the KVM switch leading to a compromise of sensitive data. The ISSO or SA will ensure the KVM switch is not configured to encapsulate and send USB connections other than KVM connections.

Check Content

The reviewer will, with the assistance of the ISSO or SA, verify the KVM switch is not configured to encapsulate and send USB connections other than KVM connections. If the KVM switch is configured to encapsulate and send USB connections other than Keyboard, Video, and Mouse connections, this is a finding.

Fix Text

Reconfigure the network KVM switch so that it will not encapsulate USB connections other than the keyboard, video monitor, or mouse, over IP.

Additional Identifiers

Rule ID: SV-6911r2_rule

Vulnerability ID: V-6714

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.