Storage Area Network STIG

Version: 2

Updated: 26 Jul 2019

Findings: 27

Findings

V-6605 - The default zone visibility setting is not set to “none”. (medium)
V-6608 - Hard zoning is not used to protect the SAN. (high)
V-6610 - The SANs are not compliant with overall network security architecture, appropriate enclave, and data center security requirements in the Network Infrastructure STIG and the Enclave STIG (medium)
V-6613 - All security related patches are not installed. (medium)
V-6619 - Prior to installing SAN components (servers, switches, and management stations) onto the DOD network infrastructure, components are not configured to meet the applicable STIG requirements. (medium)
V-6622 - Servers and other hosts are not compliant with applicable Operating System (OS) STIG requirements. (medium)
V-6623 - Vendor supported, DOD approved, anti-virus software is not installed and configured on all SAN servers in accordance with the applicable operating system STIG on SAN servers and management devices and kept up-to-date with the most recent virus definition tables. (high)
V-6628 - A current drawing of the site’s SAN topology that includes all external and internal links, zones, and all interconnected equipment is not being maintained. (medium)
V-6631 - All the network level devices interconnected to the SAN are not located in a secure room with limited access. (medium)
V-6632 - Individual user accounts with passwords are not set up and maintained for the SAN fabric switch. (medium)
V-6633 - The SAN must be configured to use bidirectional authentication. (medium)
V-6634 - The fabric switches must use DoD-approved PKI rather than proprietary or self-signed device certificates. (low)
V-6635 - Network management ports on the SAN fabric switches except those needed to support the operational commitments of the sites are not disabled. (medium)
V-6636 - SAN management is not accomplished using the out-of-band or direct connection method. (medium)
V-6637 - Communications from the management console to the SAN fabric are not protected strong two-factor authentication. (low)
V-6638 - The manufacturer’s default PKI keys have not been changed prior to attaching the switch to the SAN Fabric. (low)
V-6639 - The SAN is not configured to use FIPS 140-1/2 validated encryption algorithm to protect management-to-fabric communications. (low)
V-6645 - All SAN management consoles and ports are not password protected. (high)
V-6646 - The manufacturer’s default passwords have not been changed for all SAN management software. (high)
V-6647 - The SAN fabric zoning lists are not based on a policy of Deny-by-Default with blocks on all services and protocols not required on the given port or by the site. (high)
V-6648 - Attempts to access ports, protocols, or services that are denied are not logged.. (low)
V-6652 - Simple Network Management Protocol (SNMP) is used and it is not configured in accordance with the guidance contained in the Network Infrastructure STIG. (medium)
V-6656 - Unauthorized IP addresses are allowed Simple Network Management Protocol (SNMP) access to the SAN devices. (high)
V-6657 - The IP addresses of the hosts permitted SNMP access to the SAN management devices do not belong to the internal network. (medium)
V-6660 - End-user platforms are directly attached to the Fibre Channel network or access storage devices directly. (low)
V-6661 - Fabric switch configurations and management station configuration are not archived and/or copies of the operating system and other critical software for all SAN components are not stored in a fire rated container or are not collocated with the operational software. (medium)
V-7081 - SAN components are not configured with fixed IP addresses. (medium)