Title

The SAN is not configured to use FIPS 140-1/2 validated encryption algorithm to protect management-to-fabric communications. (Cat III impact)

Discussion

The communication between the SAN management consol and the SAN fabric carries sensitive privileged configuration data. This data's confidentiality will be protected with FIPS 140-1/2 validate algorithm for encryption. Configuration data could be used to create a denial of service by disrupting the SAN fabric. The storage administrator will configure the SAN to use FIPS 140-1/2 validated encryption algorithm to protect management-to-fabric communications.

Check Content

The reviewer will, with the assistance of the storage administrator, verify that the SAN is configured to use FIPS 140-1/2 validated encryption algorithm to protect management-to-fabric communications.

Fix Text

Develop a plan to implement FIPS-140-1/2 validated encryption to protect management-to-fabric communications. Obtain CM approval of the plan and execute the plan.

Additional Identifiers

Rule ID: SV-6783r1_rule

Vulnerability ID: V-6639

Group Title: FIPS 140-1/2 for management to fabric.

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.