Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
VTC systems must be logically or physically segregated on the LAN from data systems, other non-integrated voice communication (VoIP) systems, and by VTC system type.
Description
Discussion Text
A common practice in traditional LAN design is the use and implementation of VLANs and IP subnets to segregate services and organizational workgroups, including their traffic as it traverses the LAN. This has the effect of providing confidentiality for the workgroup traffic by limiting the ability of users in other workgroups to see and access the traffic during normal operations. It also enhances the ability to control traffic flows for, and access to, LAN services. Another benefit of using VLANs is that they can improve network performance if they are properly pruned. Typically, when a VLAN is configured on one LAN switch, the other switches in the network will "learn" that VLAN, thus it will propagate throughout the network. This property is not what enhances network performance since it allows broadcast traffic in the VLAN to traverse the entire network. Also, if the number of allowable VLANs that a switch has configured or learns is exceeded, the LAN can become unstable. VLAN pruning eliminates this problem and is actually what can enhance network performance by limiting the traffic that devices in the LAN must process.
The use of a separate IP address space and properly pruned separate VLANs for VTC systems will have the following effects:
- Enhance the confidentiality of unencrypted VTC traffic.
- Enhance the confidentiality of the VTC device management traffic, particularly if secure protocols are not available for use.
- Limit the ability of LAN users to see the VTC devices in other VLANs, which limits the possibility of compromise from user or machine induced malicious activity.
Some VTC systems should be protected using other VLAN structures as follows:
- Primary conference room systems should have their own closely pruned VLAN and IP subnet. This could be a single conference room or several conference rooms if they are required to communicate with each other or are part of an overall managed VTC network within the enclave. This will provide the maximum protection from compromise for the conference room systems.
- Hardware-based desktop and office VTUs should be grouped into their own VLAN and IP subnet. This could be the same VLAN and subnet as the one used for conference rooms if these devices are to communicate with them or if they are part of an overall managed VTC network within the enclave.
- Hardware-based desktop and office VTUs that integrate and signal with the site’s VoIP telephone system may be grouped separately or utilize the Voice system VLAN structure and IP subnet.
- PC-based soft-VTUs are to be implemented or segregated/controlled as described in the related document covering softphones and soft-VTUs.
- Local MCUs and VTU management stations must reside in the VTC VLAN and IP subnet with the devices they manage or conference.
- If WAN access is required, the VLANs can be extended to the enclave boundary.
The use of a separate IP address space and properly pruned separate VLANs for VTC systems will have the following effects:
- Enhance the confidentiality of unencrypted VTC traffic.
- Enhance the confidentiality of the VTC device management traffic, particularly if secure protocols are not available for use.
- Limit the ability of LAN users to see the VTC devices in other VLANs, which limits the possibility of compromise from user or machine induced malicious activity.
Some VTC systems should be protected using other VLAN structures as follows:
- Primary conference room systems should have their own closely pruned VLAN and IP subnet. This could be a single conference room or several conference rooms if they are required to communicate with each other or are part of an overall managed VTC network within the enclave. This will provide the maximum protection from compromise for the conference room systems.
- Hardware-based desktop and office VTUs should be grouped into their own VLAN and IP subnet. This could be the same VLAN and subnet as the one used for conference rooms if these devices are to communicate with them or if they are part of an overall managed VTC network within the enclave.
- Hardware-based desktop and office VTUs that integrate and signal with the site’s VoIP telephone system may be grouped separately or utilize the Voice system VLAN structure and IP subnet.
- PC-based soft-VTUs are to be implemented or segregated/controlled as described in the related document covering softphones and soft-VTUs.
- Local MCUs and VTU management stations must reside in the VTC VLAN and IP subnet with the devices they manage or conference.
- If WAN access is required, the VLANs can be extended to the enclave boundary.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.