Title

The organization must comply with DoD ports and protocol guidance within the information system deemed to be non-secure for remote access into DoD networks. (Cat III impact)

Discussion

Some networking protocols are considered less secure than others (e.g., Bluetooth, peer-to-peer, etc.). In its access control policy and security procedures addressing remote access to the information system, the organization, in order to protect and secure its network, must define those network protocols considered to be non-secure. Failure to define the non-secure network protocols could result in the organization's network being open to access by these non-secure protocols, which could result in unauthorized access to, modification of, or destruction of sensitive or classified data. For mobile systems, several non-secure protocols are used routinely in the commercial world. Many of these must not be allowed on DoD networks and specified.

Check Content

Review the organization's policies related to network protocols. The organization must document those networking protocols within the information system deemed to be non-secure for remote access into DoD networks. If the policies do not specifically list non-secure protocols, this is a finding.

Fix Text

Create and document a list of networking protocols within the information system deemed to be non-secure for remote access into DoD networks.

Additional Identifiers

Rule ID:

Vulnerability ID: V-35911

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.