STIGQter STIGQter: STIG Summary: SDN Using NV Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 Feb 2017: Northbound API traffic must traverse an out-of-band path or be encrypted using a FIPS-validated cryptographic module.

DISA Rule

SV-87733r1_rule

Vulnerability Number

V-73081

Group Title

NET-SDN-005

Rule Version

NET-SDN-005

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Deploy an out-of-band network to provision paths between the SDN controllers and the SDN management/orchestration systems for providing transport for northbound API traffic.

An alternative is to encrypt all northbound API traffic using a FIPS-validated cryptographic module. Implement a cryptographic module which has a validation certification and is listed on the NIST Cryptographic Module Validation Program's (CMVP) validation list.

Check Contents

Determine if the northbound API traffic between the SDN controllers and the SDN management/orchestration systems traverses an out-of-band path.

If not, verify that the northbound API traffic is encrypted using a FIPS-validated cryptographic module.

If the northbound API traffic does not traverse an out-of-band path or is not encrypted using a FIPS-validated cryptographic module, this is a finding.

Note: An out-of-band path would be a path between two nodes that traverses one or more links on an out-of-band network; that is, a dedicated layer 2 infrastructure separate from a production network.

Vulnerability Number

V-73081

Documentable

False

Rule Version

NET-SDN-005

Severity Override Guidance

Determine if the northbound API traffic between the SDN controllers and the SDN management/orchestration systems traverses an out-of-band path.

If not, verify that the northbound API traffic is encrypted using a FIPS-validated cryptographic module.

If the northbound API traffic does not traverse an out-of-band path or is not encrypted using a FIPS-validated cryptographic module, this is a finding.

Note: An out-of-band path would be a path between two nodes that traverses one or more links on an out-of-band network; that is, a dedicated layer 2 infrastructure separate from a production network.

Check Content Reference

M

Target Key

3089

Comments