Title

A SMU component is not installed in a controlled space with visitor access controls applied. (Cat I impact)

Discussion

Requirement: The IAO at the SMU site will ensure that the SMU has adequate physical security protection. The system design and architecture of the SMU provides for no security configuration capability (i.e., user account, password, privileged user, or auditing capability). Trunk and subscriber provisioning is accomplished via an administrator’s terminal, which is a dumb terminal, connected to the system via serial connection. From this terminal, at power up, the user has direct access to provisioning features of the system. Therefore, security protection to the SMU is provided through the physical security of the unit.

Check Content

> Perform a walk through of the facility to confirm that all DSN core and transmission devices that are part of the system are located in a secure room or locked cabinet.

Fix Text

> Take measures to apply or install or upgrade physical security for system core assets (Switches, Servers,) and transmission devices (network switches, routers, muxes, devices). Limit, control, and document the distribution of keys to access the equipment.

Additional Identifiers

Rule ID: SV-9010r1_rule

Vulnerability ID: V-8515

Group Title: A SMU is NOT installed in a secure location

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.