STIGQter STIGQter: STIG Summary: Voice Video Services Policy Security Technical Implementation Guide Version: 3 Release: 17 Benchmark Date: 25 Oct 2019:

The confidentiality of VVoIP endpoint configuration files downloaded during endpoint registration must be protected by encryption.

DISA Rule

SV-21552r2_rule

Vulnerability Number

V-19493

Group Title

VVoIP 1936

Rule Version

VVoIP 1936

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Implement and document the confidentiality of VVoIP endpoint configuration files downloaded during endpoint registration is protected by encryption. This requirement does not apply to hardware endpoints or UC soft clients that do not download configuration files from the session manager.

Check Contents

Review site documentation to confirm the confidentiality of endpoint configuration files downloaded during endpoint registration is protected. This is not applicable to hardware endpoints with a preinstalled configuration file and do not download a configuration file through the network. This is not applicable to UC soft clients that do not download a configuration file through the network. If configuration files are in a vendor specific binary format only interpretable by the vendor’s endpoints, this is not a finding. If the confidentiality of endpoint configuration files downloaded during endpoint registration is not encrypted, this is a finding.

Vulnerability Number

V-19493

Documentable

False

Rule Version

VVoIP 1936

Severity Override Guidance

Review site documentation to confirm the confidentiality of endpoint configuration files downloaded during endpoint registration is protected. This is not applicable to hardware endpoints with a preinstalled configuration file and do not download a configuration file through the network. This is not applicable to UC soft clients that do not download a configuration file through the network. If configuration files are in a vendor specific binary format only interpretable by the vendor’s endpoints, this is not a finding. If the confidentiality of endpoint configuration files downloaded during endpoint registration is not encrypted, this is a finding.

Check Content Reference

M

Target Key

594

Comments