Title

The Voice Video Endpoint must prevent unauthorized and unintended information transfer via shared system resources. (Cat II impact)

Discussion

Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. Unified capability (UC) and videoconferencing (VC) vendors have included capabilities in products that must be disabled for users. Many current UC and VC products include hooks into email, IM, and local file transfer. Peer networking options allowing transfer often use holding storage locations that are accessible to all users. This would allow potentially sensitive information to be shared without central control.

Check Content

Verify the Voice Video Endpoint prevents unauthorized and unintended information transfer via shared system resources. If the Voice Video Endpoint does not prevent unauthorized and unintended information transfer via shared system resources, this is a finding.

Fix Text

Configure the Voice Video Endpoint to prevent unauthorized and unintended information transfer via shared system resources.

Additional Identifiers

Rule ID: SV-206767r604140_rule

Vulnerability ID: V-206767

Group Title: SRG-NET-000190

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.