Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
A VTU password must be used for each VTU function.
Description
Discussion Text
Passwords are required for access control to various functions provided by a VTU. The following is a list of possible functions:
1. Local user device use/activation (not typically supported).
2. Local user call accounting code.
3. Local user access to user configurable settings.
4. Local user or machine access from the VTU to the user’s networked or otherwise attached PC running a presentation or desktop sharing application (or vice versa i.e., PC to VTU) (discussed later).
5. Local administrator access to configuration settings.
6. Remote administrator access to configuration settings.
7. Remote/centralized VTU management/control system access to the VTU (identifies the management server to the VTU, alternately restricted by IP address).
8. Remote caller access to a VTU integrated MCU conference without local user intervention.
9. Remote user access to media streamed from a VTU CODEC.
10. Local VTU access to a centralized MCU for joining conferences hosted remotely (i.e., the password sent to the remote MCU).
11. Local VTU access to gatekeeper services (automatically identifies the VTU to the gatekeeper).
The passwords or PINs used for various differing functions must be logically grouped and be unique among other passwords implemented on the system. For example, local user password/PINs such as those in items 1, 2, and 3 could be the same. These would be entered manually using the hand-held remote control. Another logical grouping might be items 10 and 11. The other functions are logically separate because they perform different functions and are used by different entities. One vendor uses a single password pre-configured in the VTU for functions 8 (bi-directionally), 9, 10 and possibly 11. This is a problem for two reasons. The first was stated above, it is used for different functions, and secondly, it is preprogrammed into the VTU. While a VTU can have an identity or password that identifies itself to another machine for passing control information, such a password cannot be used to provide user level access to information. The user must enter this password manually. A VTC related application of machine to machine authentication would be the VTU identifying itself to a gateway or a centralized VTU management or control system to a VTU.
1. Local user device use/activation (not typically supported).
2. Local user call accounting code.
3. Local user access to user configurable settings.
4. Local user or machine access from the VTU to the user’s networked or otherwise attached PC running a presentation or desktop sharing application (or vice versa i.e., PC to VTU) (discussed later).
5. Local administrator access to configuration settings.
6. Remote administrator access to configuration settings.
7. Remote/centralized VTU management/control system access to the VTU (identifies the management server to the VTU, alternately restricted by IP address).
8. Remote caller access to a VTU integrated MCU conference without local user intervention.
9. Remote user access to media streamed from a VTU CODEC.
10. Local VTU access to a centralized MCU for joining conferences hosted remotely (i.e., the password sent to the remote MCU).
11. Local VTU access to gatekeeper services (automatically identifies the VTU to the gatekeeper).
The passwords or PINs used for various differing functions must be logically grouped and be unique among other passwords implemented on the system. For example, local user password/PINs such as those in items 1, 2, and 3 could be the same. These would be entered manually using the hand-held remote control. Another logical grouping might be items 10 and 11. The other functions are logically separate because they perform different functions and are used by different entities. One vendor uses a single password pre-configured in the VTU for functions 8 (bi-directionally), 9, 10 and possibly 11. This is a problem for two reasons. The first was stated above, it is used for different functions, and secondly, it is preprogrammed into the VTU. While a VTU can have an identity or password that identifies itself to another machine for passing control information, such a password cannot be used to provide user level access to information. The user must enter this password manually. A VTC related application of machine to machine authentication would be the VTU identifying itself to a gateway or a centralized VTU management or control system to a VTU.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.