STIGQter STIGQter: STIG Summary: Enterprise Voice, Video, and Messaging Policy Security Requirements Guide Version: 1 Release: 4 Benchmark Date: 05 Jan 2026:

The Session Border Controller (SBC) must be configured to only process packets authenticated from an authorized source within the DISN IPVS network.

DISA Rule

SV-259929r1111077_rule

Vulnerability Number

V-259929

Group Title

SRG-VOIP-000490

Rule Version

SRG-VOIP-000490

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Ensure the DISN NIPRNet IPVS SBC is configured to only process packets authenticated from an authorized source as follows:
- Authenticate outbound SIP and AS-SIP messages as being from the primary or backup LSC (or the site's MFSS and its backup LSC) within the enclave.
- Authenticate inbound SIP and AS-SIP messages as being from the SBC at the enclave's assigned primary and secondary (backup) MFSS sites.

NOTE: The VVoIP system may allow SIP and SRTP traffic encrypted and encapsulated on port 443 from cloud service providers.

Check Contents

Verify the DISN NIPRNet IPVS SBC is configured to only process packets authenticated from an authorized source as follows:
- Authenticate outbound SIP and AS-SIP messages as being from the primary or backup Local Session Controller (LSC) (or the site's Multifunction Soft Switch [MFSS] and its backup LSC within the enclave.
- Authenticate inbound SIP and AS-SIP messages as being from the SBC at the enclave's assigned primary and secondary (backup) MFSS sites.

Inspect the configurations of the EBC to determine compliance with the requirement.

If the SBC does not use DOD-approved PKI to authenticate the source of SIP and AS-SIP packets, this is a finding.

If the SBC is not configured to validate sending the appliance's public PKI certificate against the DOD-approved PKI registry and CRLs, this is a finding.

NOTE: The VVoIP system may allow SIP and SRTP traffic encrypted and encapsulated on port 443 from cloud service providers.

Vulnerability Number

V-259929

Documentable

False

Rule Version

SRG-VOIP-000490

Severity Override Guidance

Verify the DISN NIPRNet IPVS SBC is configured to only process packets authenticated from an authorized source as follows:
- Authenticate outbound SIP and AS-SIP messages as being from the primary or backup Local Session Controller (LSC) (or the site's Multifunction Soft Switch [MFSS] and its backup LSC within the enclave.
- Authenticate inbound SIP and AS-SIP messages as being from the SBC at the enclave's assigned primary and secondary (backup) MFSS sites.

Inspect the configurations of the EBC to determine compliance with the requirement.

If the SBC does not use DOD-approved PKI to authenticate the source of SIP and AS-SIP packets, this is a finding.

If the SBC is not configured to validate sending the appliance's public PKI certificate against the DOD-approved PKI registry and CRLs, this is a finding.

NOTE: The VVoIP system may allow SIP and SRTP traffic encrypted and encapsulated on port 443 from cloud service providers.

Check Content Reference

M

Target Key

5585