Verify if the switch configuration has 802.1x authentication implemented for all access switch ports connecting to LAN outlets (i.e. RJ-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms. If 802.1x authentication is not configured on these host-facing access switch ports, this is a CAT 1 finding. If MAC address filtering is implemented in lieu of 802.1x authentication, this finding will be downgraded to a CAT 3.
NOTE: The section below is intended for classified networks. If it’s determined that 802.1x is not implemented on a classified network, the Traditional review team must be notified to determine if the physical requirements are implemented. For a site to be downgraded to a CAT III open finding, the physical security requirements must be implemented in addition to static MAC or sticky secure MAC port security. If both physical and logical downgrades are not implemented, a CAT I open finding will be issued.
If classified LAN drops are not authenticated by an 802.1x implementation, they must be located within spaces properly established as Secret vaults, Secret Secure Rooms (AKA: Collateral Classified Open Storage Areas), TS secure room, or SCIF. Otherwise, one of the following supplemental physical security controls must be implemented.
1. Wall jacks must be secured when unattended by persons with Secret or higher clearance with a properly constructed lock box (Hoffman or similar commercial product or locally fabricated). The lock box must have no exposed or removable hinges. The hasp hardware must be riveted to the box or otherwise installed so that removal will require physical breaking of the box; thereby leaving evidence of actual or attempted entry. The lock box must be secured with a 3-position high security combination padlock (IAW the NSTISSI 7003). The S&G 8077 combination padlock is the only existing padlock meeting this standard. 2. If lock boxes are not used, the alternative is to physically disconnect the SIPRNet link at the SIPRNet point of presence (PoP) after normal duty hours. The PoP must be located within a proper Secret or higher secure room. |