Checklist Summary:

This Sharing Peripherals Across the Network (SPAN) Security Technical Implementation Guide (STIG) provides the technical security policies, requirements, and implementation details for applying security concepts to Commercial-Off-The-Shelf (COTS) hardware peripheral devices. For this STIG, peripheral will mean, "any device that allows communication between a system and itself, but is not directly operated by the system". However, this document does not deal with devices found wholly contained within the main cabinet of the computer or, with the exception of A/B switches, those devices connected via legacy parallel and serial interfaces. This section will address Keyboard, Video, and Mouse (KVM) and A/B switches. KVM switches are used to connect a single keyboard, video monitor, and mouse to multiple ISs, saving space and equipment. They are commonly found within testing laboratories, server rooms, and with the advent of small inexpensive switches, on desktops to reduce clutter. A/B switches are used to switch a single peripheral between multiple ISs or multiple peripheral devices on a single interface for a single IS. Switch(es) will refer to both KVM and A/B switches unless otherwise noted. The KVM switches are considered to be one of three categories demarked by their physical characteristics and intended use. These categories are single user KVM switch, multi-user analog KVM switch, and a multi-user network attached KVM switch. Each switch will be defined within its own section. The order of presentation will be from the switch category requiring the least controls to the switch category requiring the most controls. Each section will build upon the requirements from the previous sections. Network attached KVM switches may have analog components attached but also have the ability to be accessed via client software either over a network or via dialup remote access. The client software may be either a proprietary software client supplied by the switch manufacturer or a web browser. The network protocol may be a standard protocol like Transmission Control Protocol/Internet Protocol (TCP/IP) or may be a proprietary method of data transmission. The switch may allow any combination of connections: single user to any single IS, multiple users to a single IS, or multiple users to multiple but different ISs. A single user KVM switch is a simple analog KVM switch attached to ISs of the same security classification level located within a single user's work area for the purpose of consolidating multiple sets of keyboards, video monitors, and mice for a single user to one set. Multi-user analog KVM switches are analog KVM switches found in any environment that does not meet the requirements for single user analog KVM switches. Most often this would be a server area where there are many separate servers each of which needs occasional administrative access. Multi-user network attached KVM switches will be found in the same environments where one would find a multi-user analog KVM switch.

Checklist Role:

• Multi-Functional Peripherals
• Router
• Enterprise Router
• Ethernet LAN Switch
• Wireless Networking
• Firewall

Known Issues:

Not provided.

Target Audience:

This document is a requirement for all DoD-administered systems and all systems connected to DoD networks. These requirements are designed to assist SMs, Information Assurance Managers (IAMs), IAOs, and SAs with configuring and maintaining security controls. This guidance supports DoD system design, development, implementation, certification, and accreditation efforts.

Target Operational Environment:

• Managed
• Specialized Security-Limited Functionality (SSLF)

Testing Information:

Not provided.

Regulatory Compliance:

DoDD 8500.1

Comments/Warnings/Miscellaneous:

Not provided.

Disclaimer:

Not provided.

Product Support:

Not provided.

Point of Contact:

disa.stig_spt@mail.mil

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

Version 2, Release 5 - 31 July, 2015
Version 2, Release 3 - 25 October 2013
Version 2, Release 1 - 29 April 2011
Version 2, Release 4 - 30 October 2014
Updated status to "Final" - 07 January 2015
Updated "Point of Contact" - 15 January 2015
Version 2, Release 5 - 31 July, 2015
Changed status from "under review" to "final" - 10 September 2015
Version 2, Release 6 - 2 February, 2016
3/11/2016 - Promote to Final
null
Updated URL to reflect change to the DISA website - http --> https
Updated URLs - 6/6/19

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 12/12/2019