Title

Modem phone lines are not restricted and configured to their mission required purpose (i.e. inward/outward dial only). (Cat II impact)

Discussion

Requirement: The IAO will ensure that all modem phone lines are restricted and configured to their mission required purpose (inward dial only or outward dial only). Ubiquitous phone lines open major security holes in a network. The more tightly they can be controlled, the less the exposure to vulnerabilities. Allowing special features to remain active on modem phone lines create advantageous situations for malicious attacks. An attacker may use special features to forward modem or voice calls to destinations that cause toll-fraud, or forward the number to itself causing a denial of service. Telephone lines that provide DSN modems dial tone will be provisioned only with their required functions. Some components of the DSN “dial back” option may require two modems for proper operation. If a modem is dedicated to receive calls, it should be provisioned to not allow outbound calling. If a modem is dedicated to place calls, it should be provisioned to not accept incoming calls.

Check Content

Have the IAO or SA demonstrate compliance with the requirement; minimally on a sampling of the related or effected devices. Inspect configuration files as applicable.

Fix Text

Ensure that all modem lines are restricted to single line operation and configured to their mission required purpose (inward or outward dial only), without any special features (i.e. call forwarding). DSN System Administrators will ensure that the modems phone line will be disconnected until needed. Site personnel should restrict the functions of all phone lines that provide dial tone to the DSN modems based upon the needs of the modems function.

Additional Identifiers

Rule ID: SV-8475r1_rule

Vulnerability ID: V-7989

Group Title: Modem phone lines are not restricted

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.