STIGQter: STIG Summary: Traditional Security Checklist Version: 1 Release: 3 Benchmark Date: 15 Jun 2020:

Physical Penetration Testing - of Facilities or Buildings Containing Information Systems (IS) Connected to the DISN

DISA Rule

SV-42941r3_rule

Vulnerability Number

V-32604

Group Title

Physical Penetration Testing

Rule Version

PH-09.03.01

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Ensure that procedures for a facility penetration testing process are developed that includes periodic, unannounced attempts to penetrate key computing facilities. Results of these tests should be provided to the site or organization commander/director and if applicable, the supporting base physical security specialist. Any discrepancies should be addressed and corrective action taken (i.e. update procedures or provide additional training).

Ensure the test is completed at least annually.

Note: It is often a good idea for the site conducting physical penetration tests to coordinate support or this testing from supporting host installation security or an outside source. That enables the test to be conducted by someone that most site personnel might not be familiar with and will facilitate a good test using social engineering or other methodology to gain unauthorized access.

Check Contents

Check to ensure that procedures for a facility penetration testing process are developed that includes periodic, unannounced attempts to penetrate key computing facilities. Results of these tests should be provided to the site or organization commander/director and if applicable, the supporting base physical security specialist. Any discrepancies should be addressed and corrective action taken (i.e. update procedures or provide additional training).

If a test has not been completed within the last 12-months this should be a finding.

Note: It is often a good idea for the site conducting physical penetration tests to coordinate support or this testing from supporting host installation security or an outside source. That enables the test to be conducted by someone that most site personnel might not be familiar with and will facilitate a good test using social engineering or other methodology to gain unauthorized access.

TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.

Vulnerability Number

V-32604

Documentable

False

Rule Version

PH-09.03.01

Severity Override Guidance

Check to ensure that procedures for a facility penetration testing process are developed that includes periodic, unannounced attempts to penetrate key computing facilities. Results of these tests should be provided to the site or organization commander/director and if applicable, the supporting base physical security specialist. Any discrepancies should be addressed and corrective action taken (i.e. update procedures or provide additional training).

If a test has not been completed within the last 12-months this should be a finding.

Note: It is often a good idea for the site conducting physical penetration tests to coordinate support or this testing from supporting host installation security or an outside source. That enables the test to be conducted by someone that most site personnel might not be familiar with and will facilitate a good test using social engineering or other methodology to gain unauthorized access.

TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.

Check Content Reference

M

Target Key

2506

Comments