STIGQter: STIG Summary: Dell OS10 Switch NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch must prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.

DISA Rule

SV-269775r1051710_rule

Vulnerability Number

V-269775

Group Title

SRG-APP-000131-NDM-000243

Rule Version

OS10-NDM-000320

Severity

CAT II

CCI(s)

• CCI-003992 - Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

10

Fix Recommendation

Install OS10 images with digital signature verification using the following command.

Enable OS10 secure-boot, if necessary, with the following command. Reload the switch after enabling secure boot.

OS10# secure-boot enable

With OS10 secure-boot enabled, install OS10 images with the following command:

OS10# image secure-install <image-filepath> {sha256 signature <signature-filepath> | gpg signature <signature-filepath> | pki signature <signature-filepath> publickey
<key-file>}

Check Contents

Determine if the OS10 Switch prevents the installation of patches, service packs, or application components without verifying the software component has been digitally signed using a certificate that is recognized and approved by the organization.

Image install commands verify signatures if OS10 secure-boot is enabled. Verify that OS10 secure-boot feature is enabled with the following command:

OS10# show secure-boot status
Last boot was via secure boot : yes
Secure boot configured : yes
Latest startup config protected: yes
BIOS secure boot:
BIOS Secure boot configured: yes

If BIOS Secure boot is not configured, this is a finding.

Vulnerability Number

V-269775

Documentable

False

Rule Version

OS10-NDM-000320

Severity Override Guidance

Determine if the OS10 Switch prevents the installation of patches, service packs, or application components without verifying the software component has been digitally signed using a certificate that is recognized and approved by the organization.

Image install commands verify signatures if OS10 secure-boot is enabled. Verify that OS10 secure-boot feature is enabled with the following command:

OS10# show secure-boot status
Last boot was via secure boot : yes
Secure boot configured : yes
Latest startup config protected: yes
BIOS secure boot:
BIOS Secure boot configured: yes

If BIOS Secure boot is not configured, this is a finding.

Check Content Reference

M

Target Key

5666