Title

Communications from the management console to the SAN fabric are not protected strong two-factor authentication. (Cat III impact)

Discussion

Using two-factor authentication between the SAN management console and the fabric enhances the security of the communications carrying privileged functions. It is harder for an unauthorized management console to take control of the SAN. The preferred solution for two-factor authentication is DoD PKI implemented on the CAC or Alternative (Alt) token.

Check Content

The reviewer will, with the assistance of the IAO/NSO, verify that communications from the management console to the SAN fabric are protected using DOD PKI. If another method of two-factor authentication is used, then inspect approval documentation. If two-factor authentication is not used, this is a finding. If two-factor authentication method is not DoD PKI and no approval documentation exists, this is a finding.

Fix Text

Develop a plan to migrate to the use of DoD PKI authentication between the SAN management console and the SAN fabric. Obtain CM approval of the plan and implement the plan.

Additional Identifiers

Rule ID: SV-6778r1_rule

Vulnerability ID: V-6637

Group Title: Management Console to SAN Fabric Authentication

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.