Title

Access to the SDN management and orchestration systems must be authenticated using a FIPS-approved message authentication code algorithm. (Cat II impact)

Discussion

The SDN controller receives network service requests from orchestration and management systems to deploy and configure network elements via the northbound API. In turn, the Northbound API presents a network abstraction to these systems. If either the orchestration or management system were breached, a rogue user could make modifications to the business or security policy that could disrupt network operations, resulting in inefficient application and business processes as well as bypassing security controls. In addition, invalid network service requests could be processed that could exhaust compute, storage, and network resources, leaving no resources available for legitimate business requirements.

Check Content

Review all management and orchestration systems within the SDN framework and verify that access to these components requires DOD PKI certificate-based authentication. If access to the SDN management and orchestration systems does not require DOD PKI certificate-based authentication, this is a finding.

Fix Text

Configure all management and orchestration systems within the SDN framework to require DOD PKI certificate-based authentication for access.

Additional Identifiers

Rule ID: SV-87729r1_rule

Vulnerability ID: V-73077

Group Title: NET-SDN-003

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.