Storage Area Network Security Technical Implementation Guide

The Storage Area Network Security Technical Implementation Guide (V2 R5) has 28 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

28STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R5

CurrentPublished Thu Jan 30 2025

The fabric switches must use DoD-approved PKI rather than proprietary or self-signed device certificates.

Storage Area Network Security Technical Implementation Guide

Assessment Title

Rule Text

The fabric switches must use DoD-approved PKI rather than proprietary or self-signed device certificates.

Description

Discussion Text

DOD PKI supplies better protection from malicious attacks than userid/password authentication and should be used anytime it is feasible.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-6634

Rule

SV-6768r2_rule

Severity

low

Rule Version

SAN04.011.00

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

The reviewer will, with the assistance of the IAO/NSO, verify fabric switches are protected by DOD PKI. 

View the installed device certificates.

Verify a DoD -approved certificate is loaded. 

If any of the certificates have the name or identifier of a non-DoD- approved source in the Issuer field, this is a finding.

Implementation Procedure

Fix Text

Generate a new key-pair from a DoD-approved certificate issuer. Sites must consult the PKI/PKI pages on the http://iase.disa.mil/ website for procedures for NIPRNet and SIPRNet.

STIG check 12 of 28 in the Storage Area Network STIG checklist

← Previous · V-6633The SAN must be configured to use bidirectional authentication.Next · V-6635 →Network management ports on the SAN fabric switches except those needed to support the operational commitments of the sites are not disabled.