Title

A KVM switch must not be cascaded while being attached to ISs of different classification levels. (Cat III impact)

Discussion

Cascading KVM switches, connecting one switch to another switch, can make it difficult to determine which system is currently connected to the keyboard, video monitor, and mouse by simple observation. In situations where the ISs are of differing classification levels this could lead to the compromise of sensitive or classified data or a denial of service caused by a privileged command being given to the wrong system. When the KVM switch is attached to ISs of different classification levels, the ISSO or SA will ensure no KVM switches are cascaded.

Check Content

The reviewer will check the connections for the KVM switch to verify it is not connected to another KVM switch when ISs of different classification levels are attached. If KVM switches are cascaded, this is a finding.

Fix Text

Develop a plan to remove all cascaded KVM switches as soon as possible without disrupting production. Connect each IS to an open port on a KVM switch that is in turn only connected to a keyboard, video monitor, and mouse, not to another KVM switch. Obtain CM approval for the plan and execute the plan at the earliest opportunity.

Additional Identifiers

Rule ID: SV-6878r2_rule

Vulnerability ID: V-6700

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.