← Back to Storage Area Network Security Technical Implementation Guide

V-6656

CAT I (High)

Unauthorized IP addresses are allowed Simple Network Management Protocol (SNMP) access to the SAN devices.

Rule ID

SV-6802r1_rule

STIG

Storage Area Network Security Technical Implementation Guide

Version

V2R5

CCIs

None

Discussion

SNMP, by virtue of what it is designed to do, can be a large security risk. Because SNMP can obtain device information and set device parameters, unauthorized users can cause damage. Restricting IP address that can access SNMP on the SAN devices will further limit the possibility of malicious access being made. The IAO/NSO will ensure that only authorized IP addresses are allowed Simple Network Management Protocol (SNMP) access to the SAN devices.

Check Content

The reviewer will, with the assistance of the IAO/NSO, verify that only authorized IP addresses are allowed Simple Network Management Protocol (SNMP) access to the SAN devices.  This can be done with by checking the ACLs for the SAN device ports.

Fix Text

Develop a plan to restrict SNMP access to SAN devices to authorized IP addresses.  Obtain CM approval for the plan and implement the plan.