Title

The Voice Video Session Manager must prohibit remote activation of collaborative computing devices (excluding centrally managed, dedicated videoconference suites located in approved videoconference locations). (Cat II impact)

Discussion

An adversary may be able to gain access to information on whiteboards, listen to conversations on a microphone, or view areas with a camera since collaboration equipment is typically not designed with security access controls and protection measures of more sophisticated networked clients. Collaborative computing devices include, for example, networked whiteboards, cameras, and microphones. This requirement applies to collaboration applications that control collaborative computing devices. Exceptions to this would require acceptance of the risk by a cognizant AO. This requirement is not intended to prohibit remote activation of centrally managed, dedicated videoconferencing Suites for the purpose of remote testing of the equipment.

Check Content

Verify the Voice Video Session Manager prohibits remote activation of collaborative computing devices. For centrally managed, dedicated videoconference suites located in approved videoconference locations with full documentation, this requirement is not applicable. If the Voice Video Session Manager does not prohibit remote activation of collaborative computing devices, this is a finding.

Fix Text

Configure the Voice Video Session Manager, except for centrally managed, dedicated videoconference suites located in approved videoconference locations, to prohibit remote activation of collaborative computing devices.

Additional Identifiers

Rule ID: SV-206854r508661_rule

Vulnerability ID: V-206854

Group Title: SRG-NET-000512

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.