| V-206728 | | The SDN controller must be configured to authenticate southbound Application Program Interface (API) control-plane messages received from SDN-enabled network elements using a FIPS-approved message authentication code algorithm. | Southbound APIs such as OpenFlow provide the forwarding tables to network devices, such as switches and routers, both physical and virtual (hypervisor... |
| V-206729 | | The SDN controller must be configured to authenticate northbound Application Program Interface (API) messages received from business applications and management systems using a FIPS-approved message authentication code algorithm. | The SDN controller determines how traffic should flow through physical and virtual network devices based on application profiles, network infrastructu... |
| V-206730 | | The SDN controller must be configured to encrypt all southbound Application Program Interface (API) control-plane messages using a FIPS-validated cryptographic module. | Southbound APIs such as OpenFlow provide the forwarding tables to network devices, such as switches and routers, both physical and virtual (hypervisor... |
| V-206731 | | The SDN controller must be configured to encrypt all northbound Application Program Interface (API) messages using a FIPS-validated cryptographic module. | The SDN controller receives network service requests from orchestration and management systems to deploy and configure network elements via the northb... |
| V-206732 | | The SDN controller must be configured to authenticate received southbound Application Program Interface (API) management-plane messages using a FIPS-approved message authentication code algorithm. | The SDN controller can receive management-plane traffic from the SDN-enabled devices that it monitors and manages. The messages could be responses fro... |
| V-206733 | | The SDN controller must be configured to encrypt all southbound Application Program Interface (API) management-plane messages using a FIPS-validated cryptographic module. | An SDN controller can manage and configure SDN-enabled devices using protocols such as SNMP and NETCONF. If an SDN-aware router or switch received err... |
| V-206715 | | The SDN controller must be configured to enforce approved authorizations for access to system resources in accordance with applicable access control policies. | To mitigate the risk of unauthorized access to system resources within the SDN framework, authorization procedures and controls must be implemented to... |
| V-206716 | | The SDN controller must be configured to enforce approved authorizations for controlling the flow of traffic within the network based on organization-defined information flow control policies. | Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or data center. Additionally, unrestricted traffic may transit a... |
| V-206717 | | The SDN controller must be configured to produce audit records containing information to establish what type of events occurred. | Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or... |
| V-206718 | | The SDN controller must be configured to produce audit records containing information to establish when the events occurred. | Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In ... |
| V-206719 | | The SDN controller must be configured to produce audit records containing information to establish where the events occurred. | Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In... |
| V-206720 | | The SDN controller must be configured to produce audit records containing information to establish the source of the events. | Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. ... |
| V-206721 | | The SDN controller must be configured to produce audit records containing information to establish the outcome of the events. | Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if ch... |
| V-206722 | | The SDN controller must be configured to generate audit records containing information that establishes the identity of any individual or process associated with the event. | Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, sec... |
| V-206723 | | The SDN controller must be configured to disable non-essential capabilities. | It is detrimental for network elements to provide, or enable by default, functionality exceeding requirements or mission objectives. These unnecessary... |
| V-206724 | | The SDN controller must be configured to enforce a policy to manage bandwidth and to limit the effects of a packet-flooding Denial of Service (DoS) attack. | A network element experiencing a DoS attack will not be able to handle production traffic load. The high utilization and CPU caused by a DoS attack wi... |
| V-206725 | | The SDN controllers must be configured as a cluster in active/active or active/passive mode to preserve any information necessary to determine cause of a system failure and to maintain network operations with least disruption to workload processes and flows. | Failure in a known state can address safety or security in accordance with the mission needs of the organization. Failure to a known secure state help... |
| V-206726 | | The SDN controller must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by rate-limiting control-plane communications. | The SDN Controller is critical to all network operations because it is the component used to build all forwarding paths for the data plane via control... |
| V-206727 | | The SDN controller must be configured to only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations. | Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or data center. Additionally, unrestricted traffic may transit a... |
| V-206734 | | The SDN controller must be configured to be deployed as a cluster and on separate physical hosts. | SDN relies heavily on control messages between a controller and the forwarding devices for network convergence. The controller uses node and link stat... |
| V-206735 | | The SDN Controller must be configured to notify the forwarding device to either drop the packet or make an entry in the flow table for a received packet that does not match any flow table entries. | Reactive flow setup occurs when the SDN-aware switch receives a packet that does not match the flow table entries and hence the switch has to send the... |
| V-206736 | | SDN controller must be configured to forward traffic based on security requirements. | For security reasons, an organization may choose to have traffic that is inbound to a server go through a specific firewall. In order not to consume t... |
| V-206737 | | The SDN controller must be configured to enable multi-tenant virtual networks to be fully isolated from one another. | Network-as-a-Service (NaaS) is often implemented in a multi-tenant paradigm, where customers share network infrastructure and services while they are ... |
| V-206738 | | The SDN controller must be configured to separate tenant functionality from system management functionality. | Network-as-a-Service (NaaS) is frequently offered in a multi-tenant paradigm, where customers share network infrastructure. SDN provides an approach t... |
| V-206739 | | The SDN controller must be configured to isolate security functions from non-security functions. | An isolation boundary provides access control and protects the integrity of the hardware, software, and firmware that perform security functions.
Se... |
| V-206740 | | The SDN controller must be configured to generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries. | Providing too much information in error messages on the screen or printout risks compromising the data and security of the SDN controller. The structu... |
| V-206741 | | The SDN controller must be configured to notify the ISSO and ISSM of failed verification tests for organization-defined security functions. | If personnel are not notified of failed security verification tests, they will not be able to take corrective action and the unsecure condition(s) wil... |
| V-206742 | | The SDN controller must be configured to prohibit user installation of software without explicit privileged status. | Allowing regular users to install software, without explicit privileges, creates the risk that untested or potentially malicious software will be inst... |
| V-206743 | | The SDN controller must be configured to enforce access restrictions associated with changes to the configuration. | Failure to provide logical access restrictions associated with changes to application configuration may have significant effects on the overall securi... |
| V-206744 | | The SDN controller must be configured to audit the enforcement actions used to restrict access associated with changes to any application within the SDN framework. | Without auditing the enforcement of access restrictions against changes to any application within the SDN framework, it will be difficult to identify ... |
| V-216509 | | The SDN controller must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs. | Configuring the network device to implement organization-wide security implementation guides and security checklists ensures compliance with federal s... |
| V-264312 | | The SDN controller must be configured to employ organization-defined controls by type of denial of service (DoS) to achieve the DoS objective. | DoS events may occur due to a variety of internal and external causes, such as an attack by an adversary or a lack of planning to support organization... |
| V-264313 | | The SDN controller must be configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions. | Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessa... |
| V-264314 | | The SDN controller must be configured to establish organization-defined alternate communications paths for system operations organizational command and control. | An incident, whether adversarial- or nonadversarial-based, can disrupt established communications paths used for system operations and organizational ... |
