KVM or A/B switches must be approved prior to being connected to ISs of different classification levels.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6699	KVM02.005.00	SV-6876r3_rule	DCBP-1	Medium

Description
Only KVM switches that have been tested and verified to prevent the transfer of data from one IS to another will be used when the ISs connected to the switch are of differing classification levels. The switch will be operated in the approved port configuration only. When the KVM switch is attached to ISs of different classification levels, the ISSO will ensure only approved KVM or A/B switches are used.

Description

Only KVM switches that have been tested and verified to prevent the transfer of data from one IS to another will be used when the ISs connected to the switch are of differing classification levels. The switch will be operated in the approved port configuration only. When the KVM switch is attached to ISs of different classification levels, the ISSO will ensure only approved KVM or A/B switches are used.

STIG	Date
Keyboard Video and Mouse Switch STIG	2015-12-09

Details

Check Text ( C-2671r4_chk )
Verify the KVM or A/B switch attached to ISs of different classification levels has been evaluated and approved prior to connection. The National Information Assurance Partnership (NIAP) product lists can be found below: https://www.niap-ccevs.org/CCEVS_Products/ If the KVM or A/B switch is not found on the NIAP list, this is a finding.

Fix Text (F-6294r4_fix)
Immediately replace the unapproved KVM switch with an approved KVM switch. If there is no approved KVM switch available, remove all ISs from the unapproved KVM switch and attach a separate keyboard, video monitor, and mouse to each IS. Alternately the ISs can be segregated by classification level on as many individual KVM switches as needed. Verify port configuration complies with guidance for the switch used.

Fix Text (F-6294r4_fix)

Immediately replace the unapproved KVM switch with an approved KVM switch. If there is no approved KVM switch available, remove all ISs from the unapproved KVM switch and attach a separate keyboard, video monitor, and mouse to each IS. Alternately the ISs can be segregated by classification level on as many individual KVM switches as needed. Verify port configuration complies with guidance for the switch used.