STIGQter: STIG Summary: Traditional Security Checklist Version: 1 Release: 3 Benchmark Date: 15 Jun 2020: STIGQter: STIG Summary: Traditional Security Checklist Version: 1 Release: 3 Benchmark Date: 15 Jun 2020:SV-41541r3_rule
V-31274
Information Security (INFOSEC) - Secure Room Standards - IDS
IS-02.01.07
CAT I
10
1. All secure rooms (AKA: collateral classified open storage areas) that afford access to classified SIPRNet equipment (servers, routers, switches, comm equipment, work stations, DASD...) must be protected by an Intrusion Detection System (IDS) unless continuously occupied.
IMPORTANT NOTE: Random checks not exceeding 4-hours are an allowable alternative to IDS ONLY if supported by a valid risk assessment and security-in-depth.
Random checks and risk analysis are each covered as separate requirements elsewhere in this document. This particular requirement for IDS is Not Applicable (NA) if random checks are properly conducted and are supported by the risk analysis and security-in-depth approved by the senior agency (security) official in writing.
2. Prior to the installation of an IDS, the site must perform a risk analysis to determine the threat, vulnerabilities, security-in-depth countermeasures, the acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of each secure room as an alternative to IDS.
3. Security-in-Depth for each secure room must be approved *in writing* by the CC/S/A senior agency official (senior official for security)
In summary: An IDS must be used as a supplemental protective measure AND it must be supported both by a valid risk assessment AND security-in-depth as approved in writing by the senior agency official.
Background Details:
Except for storage in a GSA-approved container (AKA: safe) or a vault built to FED STD 832, one of the following supplemental controls is required for secure rooms or areas containing SIPRNet (secret) assets, provided the CC/S/A senior agency official determines in writing that security-in-depth exists:
(1) Inspection of the container or open storage area every four hours by an employee cleared at least to the Secret level; or
(2) An IDS with the personnel responding to the alarm arriving within 30 minutes of the alarm annunciation.
IMPORTANT NOTE: Random checks not exceeding 4-hours are an allowable alternative to IDS ONLY if supported by a valid risk assessment.
Prior to the installation of an IDS, the site shall perform a risk analysis to determine the threat, vulnerabilities, security-in-depth countermeasures, the acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of the secure room as an alternative to IDS.
Random checks and risk analysis are each covered as separate checks elsewhere in this checklist.
This particular check for IDS is Not Applicable (NA) if random checks are properly conducted and are supported by the risk analysis and security-in-depth approved by the senior agency official in writing.
In summary this check is to validate an IDS is being used AND that it is supported by a valid risk assessment AND security-in-depth approved by the senior agency official in writing.
Checks:
1. Check to ensure that all secure rooms/classified open storage areas that afford access to classified SIPRNet equipment (servers, routers, switches, comm equipment, work stations, DASD, etc...) are protected by an Intrusion Detection System (IDS) *unless continually occupied. (CAT I)
2. Where IDS is being used check to ensure that its use is supported by both a RISK ASSESSMENT and a SECURITY-IN-DEPTH DETERMINATION * (Security-In-Depth Determination must IN WRITING by the C/S/A senior agency (security) official) that specifically addresses the secure room or open storage space. (CAT II)
TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.
V-31274
False
IS-02.01.07
Background Details:
Except for storage in a GSA-approved container (AKA: safe) or a vault built to FED STD 832, one of the following supplemental controls is required for secure rooms or areas containing SIPRNet (secret) assets, provided the CC/S/A senior agency official determines in writing that security-in-depth exists:
(1) Inspection of the container or open storage area every four hours by an employee cleared at least to the Secret level; or
(2) An IDS with the personnel responding to the alarm arriving within 30 minutes of the alarm annunciation.
IMPORTANT NOTE: Random checks not exceeding 4-hours are an allowable alternative to IDS ONLY if supported by a valid risk assessment.
Prior to the installation of an IDS, the site shall perform a risk analysis to determine the threat, vulnerabilities, security-in-depth countermeasures, the acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of the secure room as an alternative to IDS.
Random checks and risk analysis are each covered as separate checks elsewhere in this checklist.
This particular check for IDS is Not Applicable (NA) if random checks are properly conducted and are supported by the risk analysis and security-in-depth approved by the senior agency official in writing.
In summary this check is to validate an IDS is being used AND that it is supported by a valid risk assessment AND security-in-depth approved by the senior agency official in writing.
Checks:
1. Check to ensure that all secure rooms/classified open storage areas that afford access to classified SIPRNet equipment (servers, routers, switches, comm equipment, work stations, DASD, etc...) are protected by an Intrusion Detection System (IDS) *unless continually occupied. (CAT I)
2. Where IDS is being used check to ensure that its use is supported by both a RISK ASSESSMENT and a SECURITY-IN-DEPTH DETERMINATION * (Security-In-Depth Determination must IN WRITING by the C/S/A senior agency (security) official) that specifically addresses the secure room or open storage space. (CAT II)
TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.
M
2506